[Launch options](https://cdpfleet.com/docs/options)

# `vpn_tunnel`

VPN Tunnel: UDP/WebRTC full support — all of the browser's traffic, UDP included, goes through the residential exit.

**Use it for:** Work that needs WebRTC or HTTP/3 to look like a home connection, such as video calls or sites that compare the WebRTC address with the page's IP, on a sticky residential exit.

**Browsers:** [Google Chrome](https://cdpfleet.com/docs/browsers/chrome#opt-vpn_tunnel), [Microsoft Edge](https://cdpfleet.com/docs/browsers/edge#opt-vpn_tunnel), [Brave](https://cdpfleet.com/docs/browsers/brave#opt-vpn_tunnel), [Opera](https://cdpfleet.com/docs/browsers/opera#opt-vpn_tunnel), [Naver Whale](https://cdpfleet.com/docs/browsers/whale#opt-vpn_tunnel), [Yandex Browser](https://cdpfleet.com/docs/browsers/yandex#opt-vpn_tunnel), [Chromium](https://cdpfleet.com/docs/browsers/chromium#opt-vpn_tunnel), [Patchright](https://cdpfleet.com/docs/browsers/patchright#opt-vpn_tunnel), [Rebrowser](https://cdpfleet.com/docs/browsers/rebrowser#opt-vpn_tunnel), [Camoufox](https://cdpfleet.com/docs/browsers/camoufox#opt-vpn_tunnel), [Firefox](https://cdpfleet.com/docs/browsers/firefox#opt-vpn_tunnel), [WebKit](https://cdpfleet.com/docs/browsers/webkit#opt-vpn_tunnel).

## Details

-   **Type:** `boolean`
-   **Default:** false
-   **Example:** `{"vpn_tunnel":true}`

The browser gets a network of its own whose only way out is the session's residential proxy, so UDP works as on a home connection: WebRTC shows the residential exit IP as its public address, and HTTP/3 (QUIC) works. Without it, a proxied session sends no UDP at all — WebRTC shows only an anonymous mDNS name and sites fall back to HTTP/2. The TLS fingerprint and the exit IP are the same either way. It is not a VPN: the residential proxy still opens the connections to the site, so the TCP/IP fingerprint the site sees is the exit device's, as without the tunnel. UDP traffic is billed at the token's tier and listed as host `(udp)` on the Proxy traffic page.

Needs the default `proxy` to be a `cdpfleet-resi` token on Tier 1 or Tier 2 (no `-tier-N` is Tier 1), or, on dedicated plans, your own proxy too (UDP then works if your SOCKS5 proxy relays it; not billed); anything else — Tier 3/4, a pool, your own proxy on other plans — returns `400 tunnel_not_available`. `proxy_rules` still route page traffic by host, but UDP (WebRTC, HTTP/3) can leave through a rule's proxy instead of the default, because a UDP flow carries no host for the rules to match: for WebRTC that matches the page's exit, don't combine the tunnel with `proxy_rules`. A live swap must keep a Tier 1/2 token. Sticky sessions (`-session-…`) work best: with a rotating exit, WebRTC and HTTP/3 may show a different residential IP than the page. Adds about 0.1 s to the launch.

## Used in

-   [Case 69: VPN Tunnel vs a plain residential proxy: WebRTC, HTTP/3 and two bot-protection pages](https://cdpfleet.com/docs/cases/vpn-tunnel-vs-proxy)
-   [cdpfleet residential with VPN Tunnel: WebRTC and HTTP/3 on the same exit](https://cdpfleet.com/docs/examples#resi-vpn-tunnel)

All options: [launch options](https://cdpfleet.com/docs/options).

---
Source: https://cdpfleet.com/docs/options/vpn_tunnel · Markdown: https://cdpfleet.com/docs/options/vpn_tunnel.md · All docs for AI tools: https://cdpfleet.com/llms.txt