Setting up a VPN extension in Firefox

Firefox has the best extension proxy support of any browser, and the most ways to leak around it. Both facts come from the same place: Firefox does more of its own networking than Chrome does, so there are more independent settings that can disagree with each other.

Install it

1. Open the extension's page on addons.mozilla.org. VPNmine's is linked from the Firefox page.
2. Add to Firefox, then approve the permission prompt. A proxy extension needs permission to control proxy settings and to read requests, which is a broad permission and correctly flagged as one.
3. Pin the extension to the toolbar via the puzzle-piece menu, so its state is visible rather than buried.
4. Open the popup, sign in or skip, and choose a location.

The toolbar badge is the connection state. Trust it for the browser and for nothing else: an extension proxies Firefox and leaves every other program on the machine alone.

Leak one: SOCKS DNS resolution

A SOCKS5 proxy can resolve hostnames at the proxy or at your machine. If Firefox resolves locally, every domain you visit goes to your normal resolver in the clear while the page content goes through the proxy. Your network operator ends up with a complete browsing list.

Check about:config for network.proxy.socks_remote_dns. It should be true. Modern Firefox defaults it to true and a well-written extension sets it anyway, but a manually configured proxy in Settings, Network Settings will not touch it unless you tick "Proxy DNS when using SOCKS v5".

Leak two: Firefox's own DNS-over-HTTPS

Firefox can send lookups to its own resolver over HTTPS, independently of the system and of any proxy. In several regions this is on by default.

It is not a privacy failure in itself — the lookups are encrypted, and the resolver is a named party rather than your ISP. It is a surprise, because the DNS leak test will report a resolver you did not configure anywhere, and it means your lookups and your traffic are going to two different places.

Settings, Privacy & Security, DNS over HTTPS is where to choose. Off, with the proxy resolving remotely, is the coherent configuration when using an extension.

Leak three: WebRTC

WebRTC collects the addresses the machine can be reached on and hands them to any page that asks, with no permission prompt. A proxy does not touch it, because WebRTC does not go through the proxy.

Firefox is the one browser with a real switch for this. In about:config, set media.peerconnection.enabled to false. That disables browser-based video and voice calls entirely, which is the trade. A VPN extension that offers WebRTC protection is flipping an equivalent internal control for you.

Verify with the WebRTC leak test.

Containers, and why they are worth pairing with this

Firefox Multi-Account Containers separate cookies and site data per container. They do not change your IP address, and they are not a privacy tool in the same sense as a proxy — but they solve the problem a proxy cannot touch.

Changing your exit address does nothing about being signed in. A site you are logged into knows exactly who you are whatever address the request came from. Containers keep those logged-in identities from seeing each other. The proxy handles the network; containers handle the account layer.

Extensions versus the system

An extension in Firefox protects Firefox. Not Chrome, not your mail client, not a desktop app that opens a login window in an embedded browser, and nothing at all when Firefox is closed.

On an untrusted network the concern is what the network sees, and the extension only removes it for one program. That is the case where an app opening a system tunnel is the right tool and the extension is not.

A quick self-check

1. Open the extension popup and confirm the location.
2. Load a page that shows your address and confirm it matches.
3. Run the DNS leak test and check no resolver belongs to your internet provider.
4. Run the WebRTC leak test and check no public address other than the proxy's appears.
5. Open the same address page in a different browser. It should show your real address, which confirms you understand the boundary rather than indicating a fault.