4

I use OpenVPN through the gnome network manager. When my computer is connected to the VPN, do the DNS requests goes through the VPN IP or from my real IP?

Are the DNS requests sent in the same encrypted tunnel as the rest of my traffic or could someone with network level access read them?

|improve this question
5

In a default configuration, all traffic (including DNS) should be routed through an OpenVPN tunnel.

However OpenVPN in itself does not provide mechanisms to enforce all traffic being routed via its tunnel and if an application or the operating system decides to route traffic via unencrypted interface, it is free to do so (as was the case with Windows 10 Smart Multi-Homed Name Resolution).

As for your intention—protection against snooping on DNS queries by ISPs—you would be better off by configuring and using dnsmasq with DNScrypt even for your non-VPN connections.

By adding an outbound firewall (e.g. iptables in Linux) rules to block all DNS traffic you could ensure that even in case of OpenVPN failure or misconfiguration, you would get a fallback to an encrypted DNS channel (or no connection at all because of FW).

|improve this answer
  • I never explicitly configured dnsmasq is there a way to check that none of my apps configured it? – user May 20 '16 at 1:23
  • That was only an example that default settings could be overridden. From your comment I have a feeling you wanted to find an answer to a question: "how to configure iptables (or other firewall) to block all non-VPN traffic?" – techraf May 20 '16 at 1:43
  • Why did you remove block-outside-dns? – user May 20 '16 at 2:03
  • 1
    Because that seems to be Windows-only extension and you tagged your question as Linux. – techraf May 20 '16 at 2:05
2

Disable all other Network adapters (Ethernet/onboard wifi adapter, etc) because W10 sends DNS requests through all adapters if they're on.

|improve this answer
0
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         0.0.0.0         0.0.0.0         U     1002   0        0 eth0
<private-network-behind-vpn-gw>        0.0.0.0         255.0.0.0       U     0      0        0 tun0
<vpn-server-ip>   192.168.1.1     255.255.255.255 UGH   0      0        0 wlo1
169.254.0.0     0.0.0.0         255.255.0.0     U     0      0        0 eth0
192.168.1.0     0.0.0.0         255.255.255.0   U     0      0        0 wlo1

There is no such compulsion. This depends on how and what that specific implementation want to achieve.

As in my current case you can see my ip payload for 10.0.0.0/8 is getting routed via tun0 (my vpn interface), Which is again encapsulated by another ip header destined to my vpn provider.

When my computer is connected to the vpn do DNS requests look like they come from the vpn exit ip or from my real ip?

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:x.x.x.x  P-t-P:x.x.x.x  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1300  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:28 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:500 
          RX bytes:0 (0.0 B)  TX bytes:1893 (1.8 KB)

If packets for the ip address of DNS that is configured need to be routed via tun0 then your DNS request will have x.x.x.x as source in ip header so it will be encrypted till the vpn gateway else it will be having a source address of interface from where default gateway is reachable.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.