watch DNS queries while using OpenVPN.-

Question

I want to monitor/sniff the DNS queries I make while I'm using a VPN connection with my OpenVPN client. My initial motivation was to check if I'm leaking DNS queries; then using this page it seems I'm not leaking, but I still want to understand the pipeline of my network "dynamics".

I'm running the OpenVPN client in a Docker container, and I set these firewall rules right before establishing the vpn connection:

iptables -F OUTPUT
iptables -P OUTPUT DROP

iptables -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
iptables -A OUTPUT -o tap0 -j ACCEPT
iptables -A OUTPUT -o tun0 -j ACCEPT 

iptables -A OUTPUT -d ${docker_network} -o eth0 -j ACCEPT 
iptables -A OUTPUT -d ${vpn_ip} -p tcp -m tcp --dport $port -j ACCEPT
iptables -A OUTPUT -p udp -m udp --dport $port -j ACCEPT

where: vpn_ip is the IP of the vpn server, port the UDP port for the vpn connection, and docker_network is the local network of the container (e.g. 172.17.0.2/16). Everything below is executed inside the container.

I read everywhere that DNS queries are made to the DNS servers of the VPN provider, so I'd like to "see" that somehow. So I made a ping:

ping -c1 hotmail.com

and it responds normally. At this point the /etc/resolv.conf contains:

nameserver 8.8.8.8

Next, I clean the /etc/resolv.conf to see if the query needs it, so I repeat the ping command and I get:

ping: hotmail.com: Temporary failure in name resolution

Also, if I try to use a browser on top of this container, it doesn't load any page as it usually would.

---

I also "sniffed" my packets while the resolv.conf was using 8.8.8.8 like so:

tcpdump -i tun0 -vv "host 8.8.8.8"

and I get lines like:

10.8.8.7.39209 > google-public-dns-a.google.com.domain: [udp sum ok] 17379+ PTR? ...

I've also tried this with the interface -i eth0 and I get complete silence.

Doing a filter-less sniff, I also checked that eth0 only sees UDP packets, while tun0 sees TCP and UDP packets.

Why do I need a valid /etc/resolv.conf if the DNS query is supposed to be sent over the vpn client? The DNS queries are sent directly to 8.8.8.8 or through my vpn connection?

Answer 1

Why do I need a valid /etc/resolv.conf if the DNS query is supposed to be sent over the vpn client?

The /etc/resolv.conf is the configuration for the resolver libraries which DNS server should be used. Even if you are using a VPN you still need a DNS server. Only, the communication with the given DNS server should be done through the VPN then.

For example if you use 8.8.8.8 as the DNS server then you should see the DNS query passing through your VPN interface (tun0 in your case) - which you also see there according to your question:

tcpdump -i tun0 -vv "host 8.8.8.8"
10.8.8.7.39209 > google-public-dns-a.google.com.domain: [udp sum ok] 17379+ PTR? ...

If you instead would use a DNS server in the local network (like 172.17.0.1) then the DNS query would not go through the VPN interface since the route to the local network is not set through the VPN interface (check netstat -rn or ip route for details). You would instead see the query pass through another interface (possibly eth0, depending on your exact setup). In this case you would have a DNS leak since the DNS query is bypassing the VPN.