Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Since using www.dnsleaktest.com I have found that any VPN service using Open VPN will leak my DNS through the tunnel.

I have tried and tested several VPN providers, even those who say that they have a solution to the DNS leak problem, such as Mulvad for example, and they all leak. In addition to dnsleaktest.com, I have confirmed the DNS leak though my email provider, which logs the IP address when logging on. Even with a VPN my actual IP will be logged. All those what's your-ip type of sites say that my IP is coming from the VPN server when it is not. I have also tried to fix the leak with a patch script which is downloaded from a link from the dnsleaktest website and have found that this does not work to stop the leak. I have manually configured a remote DNS resolver in Romania through the properties menu in the adapter settings in Windows 7 but still have the leak.

Only two things I have found to not leak. One is Ultrasurf (which I have to manually configure in the browser 127.0.0.1:9666) and the proxy which is built into Epic privacy browser. Unfortunately these are proxies and not VPN tunnels so the servers will be generating logs, but at least my ISP is now blind and if anyone wants to know my surfing habits they will have to take up the task of getting into the proxy server logs. So I have stopped using my paid VPN service and use the proxies because my DNS does not leak from them.

I would very much like to know if anyone has noticed the leak problem with Open VPN and found a solution to the leak.

share|improve this question
    
What exactly do you mean by "Still have the leak", particularly in the case where you changed your DNS resolver to the one in Romania? Does DNSLeakTest show the DNS resolver in Romania or some other resolver? –  Ladadadada Dec 15 '13 at 4:29
    
Networking configuration error and an assumption as to what a VPN is, not sure what it has to do with security. –  Fiasco Labs Dec 15 '13 at 5:40

4 Answers 4

VPNs neither leak DNS nor do they inhibit DNS leaks. A VPN is nothing more or less than an encrypted connection to a remote network. What you do with it (DNS, browsing, etc) is totally up to you and your configuration. In other words, whether or not DNS information goes thorugh your VPN depends on how you've configured your computer to use that VPN link.

A "Full Tunnel" VPN, which is where you configure your workstation to send all of your Internet traffic through the VPN, will not (cannot) leak anything.

Whether or not you're doing full-tunnel or split-tunnel isn't a feature of the VPN, though, it's determined by your own computer's configuration and routing table.

Note that this "Ultrasurf" thing where you reconfigure your browser to use a proxy address is not a VPN. It's a proxy. And proxy servers are not VPNs.

share|improve this answer

Most VPN services push "redirect-gateway def1" so it's unlikely that anything is "leaking". You can check that with Wireshark. It's just that the tap adapter isn't using the DNS server(s) specified by the VPN, but instead those cached locally.

The simplest "solution" is changing the DNS servers in your LAN router from ISP defaults to, for example, those suggested by WikiLeaks. Once you flush your computer's DNS cache, there won't be a direct connection to your ISP.

In Windows, you can specify DNS servers for the VPN tap adapter, but I've never tested that with VPNs. In Linux with Network Manager, you can reliably specify DNS servers for the VPN tunnel. I prefer to use pfSense VMs as VPN clients, and hard code appropriate DNS servers in DHCP for LAN.

If the VPN tunnel fails open, everything will leak. Kill the OpenVPN process while capturing with Wireshark and see ;) To prevent that, you need routing and firewall rules that restrict traffic to the VPN. You can use Comodo in Windows, and there are rules posted in the AirVPN forum. For Linux, adrelanos' VPN-Firewall is easy and effective. It's very easy to secure pfSense.

share|improve this answer

I am showing a solution that I found for the benefit of anyone else who may have had the same problem with OpenVPN. To further clarify what was going on, to try to stop the leak problem, I had been manually changing the preferred dns settings in the TCP/IPv4 properties menu by going through the adapter settings in the local area connections for both the the tap adapter and normal local area connection. When launching the vpn and visiting my email my isp was logged there, meaning that my dns was leaking. This was the result even with the manual changes as described above. Yesterday I downloaded an application called DNSCrypt from OpenDNS, installed it and did the tests again and now it seems there is no more leaking when running the vpn.

New tests now show that only the vpn server in the country where it is located will show up in ip check websites and in my email logon history. Also, only the Open DNS server in the country where the vpn server that I am connected to will be shown in the dnsleaktest.com leak test and sometimes no server shows up at all. The application DNSCrypt has configured the preferred dns settings to for all the local area connections to 127.0.0.1. The DNSCrypt application also prevents any manual changes to the preferred dns settings as any changes I tried to make were switched back to 127.0.0.1 as soon as the adapter properties menu was closed. A nice dns hijack protection feature.

Of course some of the OpenDNS servers keep logs, but at least the problem of transparent dns proxy used by my ISP, Clearwire, is now solved and now anyone wanting logs will have go server searching.

share|improve this answer

There is an option in "Private Internet Access" settings called "DNS Leak Protection". When you check off that setting there are no leaks apparent with any online test like http://ipleak.net/. However, the plug option does mess with your internet connectivity; on the 1st re-boot after activating the option, you will no longer be able to connect. After de-selecting, you might have to boot again before returning to normal usage. The point is it works - you can use it for sessions where you really feel you need leak protection.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.