1

Starting at the Computer level, NordVPN gets installed. But according to the experts who know a lot better, a VPN isn't good enough.

So going to the router's IPv4 network settings, the default DNS is changed from the ISPs default DNS (which would have been clearly listed there on the router page), over to Cloudfare's 1.1.1.1 and 1.0.0.1.

But does that make sense to do that?

As I was thinking about this setup, I wondered if it made sense to set the VPN at the router level, too (supports OpenVPN), but figured it would be easier (for a novice who doesn't want to mess up router settings) to install the VPN's provided software, instead.

I tested this thing on ipleak.net, it displayed back a DNS from a Cloudfare server, it showed an IP address from the country where the NordVPN connection was being served from, and it recognized that a proxy was being used (which it threw in with "Your IP addresses"). Since ipleak.net was able to recognize everything I set up, I get the feeling I'm still doing it wrong, but since all the information displayed was wrong, I get the feeling I'm doing it right. Right or wrong?

4
  • The "extras" are making this too broad. Try and ask clear, distinct questions. – Esa Jokinen Jul 12 '20 at 7:37
  • "VPN isn't good enough". Good enough for what? It's good for what it's intended for. Who are these experts, where's this statement from and what's its context? Also, why would your ISP call you and tell they are going to lock down your network traffic? After all, they provide you internet access in exchange for money. – Esa Jokinen Jul 12 '20 at 8:26
  • @EsaJokinen: Okay, then the question without the extras. Just NordVPN over Cloudfare? And I didn't say it was me... but one potential reason that an ISP might call to warn you about a violation is if you downloaded a bunch of copyrighted content, like movies, for example. That's just one hypothetical possibility. – Steven Jul 12 '20 at 9:47
  • I removed everything extra i.e. details that deviates too much from the title. Hopefully you'll get better answers now that you only have a single clear question. – Esa Jokinen Jul 12 '20 at 9:59
1

The purpose of those "IP leak" tests is generally to determine whether anything regarding your DNS/network configuration is allowing information to leak outside of the VPN such as what sites you are visiting to the ISP, and servers may be able to determine your ISP and/or approximate location (however, your DNS/network setup is just one of many ways these could be leaked).

The idea is that a user with a leak will be using a VPN for all of their traffic, but their computer is still set to use the ISP's DNS server or some other local resolver (e.g. router) that is set to the ISP's DNS servers. The site forces your computer to make uniquely identifiable DNS requests (e.g. ahd6Jduek72ks.example.com), and the site will see which recursive DNS server was handling the query. Of course, the site will also see what IP address you are visiting from.

In your case, if you do not see any information that reveals your ISP or location, then you are passing that particular test. Note that the site will always be able to identify your current configuration; that's just the way the internet works.

And of course, passing an "IP leak" test does not guarantee that you have anonymity or privacy. For example, your browser can be fingerprinted, your local IP address can be revealed with WebRTC, your location can be revealed (if allowed by you), and your activities may cause you to be identified (e.g. logging in to personal accounts). Of course, this all depends on who and what you are trying to protect against.

1
  • Personally, I can think of a few reasons why "And of course, passing an 'IP leak' test does not guarantee that you have anonymity or privacy", but would you like to expand on that for the OP's benefit? – Digital Dracula Jul 12 '20 at 17:15
1

I connected with Nord VPN about what looked like a DNS leak that showed Cloudflare for DNS info while we were on Nord VPN.

Our RT-AX88U router was set up with Cloudflare's DNS address (1.0.0.1 and 1.1.1.1), but when using Nord as a VPN client on the router, based on the Nord marketing information, I assumed that the Nord config info in the router would ensure that our service was automatically covered via Nord's DNS service protection. This appears to not be the case. I changed the router DNS info to Nord's and the DNS leak test still came back with Cloudflare listed.

I asked Nord's client support services if they use Cloudflare for DNS and sent them screenshots of the DNS test info including the Cloudflare finding (from several of the Nordvpn server configs - on multiple computers in our network and multiple browsers- all had Cloudflare on the DNS test outcome), and they said this was normal and that 'the browser' pushes the Cloudflare information into the test results- stating clearly that the connection is still secure.

I read Cloudflare's info on logs and they do keep them for a limited amount of time, so even private browsing information may be out there.

This came as a surprise to me given Nord's reputation and their marketing materials that indicate that DNS services are included in their protection.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.