1

I'm currently using OpenDNS as a DNS resolver because of their service FamilyShield which blocks porn and other unwanted websites.

My questions:

If I'm using a VPN, what can OpenDNS really see?
Is the VPN traffic routed via the VPN providers DNS server?

The reason why I ask is because I do a lot of work from home and some of the work I do I wish to keep private between me and the client.

  • Why don't you just use the VPN from a VM? That way your personal browsing habits don't interact with the VPN at all. – CodesInChaos Oct 10 '16 at 7:47
  • Note that with your current setup the VPN provider will see all your traffic, even if you use another DNS. – CodesInChaos Oct 10 '16 at 7:48
3

The first question is "see what?". I assume that you're asking whether OpenDNS can see your DNS resolution, not the entire traffic.

OpenDNS is a DNS resolution service, therefore you configure your router to send DNS queries there. It does nothing to the actual TCP (or even UDP not going to port 53) traffic. OpenDNS performs content filtering by DNS filtering.

Now, if your machine use DHCP to the router and asks there for a DNS server (most do). Your (openDNS configured) router will add itself as the DNS server and relay the DNS queries to OpenDNS. If you use a VPN but do not change the DNS servers of your machine the DNS query will be sent to the router anyway and then relayed to OpenDNS (given that you do not force the VPN to overwrite your current LAN, most will not do that by default).

To make sure that the DNS traffic is not relayed to OpenDNS you need to ensure that the DNS server of your machine is configured to use an IP within the range defined by the VPN (if your VPN is for internet access, then using a public IP of a DNS will do. Google has the classic page about configuring DNS to one of its servers for several OSes).

  • Thank you for your reply. You are right regarding "see what". But if they still can see my DNS resolution, how come I can access blocked websites when I'm using the VPN? – Persson Oct 8 '16 at 20:30
  • @SveaNils - I didn't say it does or not, it depends on your routes and DNS server. If you can resolve non OpenDNS addresses then your VPN must change the DNS server and force the UDP traffic through itself. There are some 100 different VPN implementations (and default configurations at that). In general VPN and DNS are completely different things: DNS deals with DNS requests (at UDP level) and VPN with IP packet routing, if the IP packet with the DNS (UDP) request falls into the route to the VPN it will go there, if not it will go to the next best route. – grochmal Oct 8 '16 at 20:35
  • I see but is it safe to assume that if I'm able to access a blocked website by OpenDNS when I'm behind a VPN, I'm not using OpenDNS as a DNS resolver when using my VPN? – Persson Oct 8 '16 at 20:41
  • @SveaNils - No, it is definitely not safe to assume. They do different things. If you have VPN on, you are using whichever DNS your machine use. It is to the whim of the VPN client developer to decide to add DNS routes (as in LAN routes) of change the DNS servers or not. Your VPN client may do it, another client won't. – grochmal Oct 8 '16 at 20:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.