Starting at the Computer level, NordVPN gets installed. But according to the experts who know a lot better, a VPN isn't good enough.

So going to the router's IPv4 network settings, the default DNS is changed from the ISPs default DNS (which would have been clearly listed there on the router page), over to Cloudfare's and

But does that make sense to do that?

As I was thinking about this setup, I wondered if it made sense to set the VPN at the router level, too (supports OpenVPN), but figured it would be easier (for a novice who doesn't want to mess up router settings) to install the VPN's provided software, instead.

I tested this thing on ipleak.net, it displayed back a DNS from a Cloudfare server, it showed an IP address from the country where the NordVPN connection was being served from, and it recognized that a proxy was being used (which it threw in with "Your IP addresses"). Since ipleak.net was able to recognize everything I set up, I get the feeling I'm still doing it wrong, but since all the information displayed was wrong, I get the feeling I'm doing it right. Right or wrong?

  • The "extras" are making this too broad. Try and ask clear, distinct questions. Commented Jul 12, 2020 at 7:37
  • "VPN isn't good enough". Good enough for what? It's good for what it's intended for. Who are these experts, where's this statement from and what's its context? Also, why would your ISP call you and tell they are going to lock down your network traffic? After all, they provide you internet access in exchange for money. Commented Jul 12, 2020 at 8:26
  • 1
    @EsaJokinen: Okay, then the question without the extras. Just NordVPN over Cloudfare? And I didn't say it was me... but one potential reason that an ISP might call to warn you about a violation is if you downloaded a bunch of copyrighted content, like movies, for example. That's just one hypothetical possibility. Commented Jul 12, 2020 at 9:47
  • I removed everything extra i.e. details that deviates too much from the title. Hopefully you'll get better answers now that you only have a single clear question. Commented Jul 12, 2020 at 9:59
  • Agree with the comment that "VPN isn't good enough" if one's DNS servers aren't being changed from your ISP to something else. Unfortunately, an ISP can & will shut down your internet (willingly or unwillingly), if forced to do so, due to eg DMCA copyright claims (eg consider some good ISP's use comparatively evil ATT for actual connectivity & the ISP isn't in total control of your connectivity even if they want to keep taking your money). So make sure your VPN is (re)setting your DNS by running a (google it): "DNS leak test".
    – michael
    Commented May 21 at 7:48

2 Answers 2


The purpose of those "IP leak" tests is generally to determine whether anything regarding your DNS/network configuration is allowing information to leak outside of the VPN such as what sites you are visiting to the ISP, and servers may be able to determine your ISP and/or approximate location (however, your DNS/network setup is just one of many ways these could be leaked).

The idea is that a user with a leak will be using a VPN for all of their traffic, but their computer is still set to use the ISP's DNS server or some other local resolver (e.g. router) that is set to the ISP's DNS servers. The site forces your computer to make uniquely identifiable DNS requests (e.g. ahd6Jduek72ks.example.com), and the site will see which recursive DNS server was handling the query. Of course, the site will also see what IP address you are visiting from.

In your case, if you do not see any information that reveals your ISP or location, then you are passing that particular test. Note that the site will always be able to identify your current configuration; that's just the way the internet works.

And of course, passing an "IP leak" test does not guarantee that you have anonymity or privacy. For example, your browser can be fingerprinted, your local IP address can be revealed with WebRTC, your location can be revealed (if allowed by you), and your activities may cause you to be identified (e.g. logging in to personal accounts). Of course, this all depends on who and what you are trying to protect against.

  • Personally, I can think of a few reasons why "And of course, passing an 'IP leak' test does not guarantee that you have anonymity or privacy", but would you like to expand on that for the OP's benefit?
    – user218666
    Commented Jul 12, 2020 at 17:15

I connected with Nord VPN about what looked like a DNS leak that showed Cloudflare for DNS info while we were on Nord VPN.

Our RT-AX88U router was set up with Cloudflare's DNS address ( and, but when using Nord as a VPN client on the router, based on the Nord marketing information, I assumed that the Nord config info in the router would ensure that our service was automatically covered via Nord's DNS service protection. This appears to not be the case. I changed the router DNS info to Nord's and the DNS leak test still came back with Cloudflare listed.

I asked Nord's client support services if they use Cloudflare for DNS and sent them screenshots of the DNS test info including the Cloudflare finding (from several of the Nordvpn server configs - on multiple computers in our network and multiple browsers- all had Cloudflare on the DNS test outcome), and they said this was normal and that 'the browser' pushes the Cloudflare information into the test results- stating clearly that the connection is still secure.

I read Cloudflare's info on logs and they do keep them for a limited amount of time, so even private browsing information may be out there.

This came as a surprise to me given Nord's reputation and their marketing materials that indicate that DNS services are included in their protection.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .