I'm using a VPN provider in occurance TunnelBear and decided today to run Wireshark in parallel and found out that DNS resolutions are happening un-encrypted using OS default name resolution, e.g. through the DNS server IP addresses set in Windows.

In a nutshell TunnelBear is a plugin that adds on Chrome and is supposed to route all web traffic including DNS encrypted through their network.

This alarmed me quite a bit, and am wondering just to further confirm, if I didn't activate any special packet decryption setup in Wireshark, that truly means that whatever I'm seeing on Wireshark could not have been encrypted originally and decrypted by Wireshark, is that correct ?

  • Where did you run Wireshark, on the router/network or on the host. The later might see decrypted DNS packets after the proxy tunnel (depending on the technology used by TunnelBear) – eckes Jul 9 '17 at 18:48
  • 1
    @eckes I ran Wireshark on the same host running TunnelBear, on my wireless interface. However on the trace, I see a destination IP address of which is the DNS server I had set up. So it looks like the packet is truly going there. – Wadih M. Jul 9 '17 at 20:58
  • It could go encrypted through the tunnel and then to the Google DNS. I would try to sniff on the router or on a wlan bridge for testing. However it might be easier to ask the vendor. On the web page of the browser extension they mention "Encrypting ONLY Your Browser Data" (whatever that is) - this could mean "not DNS". – eckes Jul 9 '17 at 21:36
  • @eckes I contacted their support and they're supposed to encrypt DNS as well, they even have an article priding themselves about it: tunnelbear.com/blog/… . When I reported the issue they said they are looking into it asap. – Wadih M. Jul 9 '17 at 22:05
  • The article seems to talk about their VPN client app "as soon as connected". – eckes Jul 9 '17 at 22:31

I have found the answer after speaking with TunnelBear support and got their confirmation.

Indeed, domain queries were going out unencrypted which is why I could see them in Wireshark when using the TunnelBear browser extension alone.

It's because the extension sandbox in Google Chrome doesn't allow them to override DNS resolutions. But they have a workaround, which is to install the full version of their VPN program.

Here was their response:

Hey Wadih,

Sorry if I wasn't clear in my explanation. I talked to our engineers a little more and they've clarified this for me further.

It doesn't (and can't) encrypt DNS requests made by Chrome browser itself because whatever Chrome does is outside of the our extension's sandbox.

if you are concerned about all traffic and all DNS requests being encrypted, you should be using the full desktop app (tunnelbear.com/download). When using the full VPN application, you should compare your WireShark results, at which point you should be seeing ALL DNS queries as being encrypted.

I hope this helps clarify expected behaviour a little further.

4-3-2-1 Tunnel!


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.