1

I'm not an expert, only have basic knowledge about all this but I'd like to understand what's going on so please bear with me.

I'm currently using a VPN (IKEv2 protocol) on a macOS system and I can see my VPN configuration in the network settings (System Preferences => Network).

With that VPN, I'm also using an app made to encrypt my DNS requests (AdGuard).

I noticed the following: when AdGuard is on, it basically overrides the VPN's DNS settings. In fact, when doing leak tests, AdGuard's DNS is showing up instead of the VPN's. Which is a good thing and what I'm actually looking for.

Now, AdGuard is using a VPN slot in macOS network settings as you can see below:

AdGuard VPN slot

It's not using it as a VPN per se, because AdGuard doesn't have one.

Then, when I'm looking at the AdGuard's slot characteristics, I can see no IP address:

AdGuard's IP address

So I was wondering: when my computer is making DNS queries to AdGuard's DNS, are those queries made with my real IP address or the VPN's one?

Is there something I can do to figure this out?

Edit : here is my route table :

Internet:
Destination        Gateway            Flags           Netif Expire
default            link#20            UCSg           ipsec0       
default            192.168.1.254      UGScIg            en1

and

Internet6:
Destination                             Gateway                         Flags           Netif Expire
default                                 fe80::%utun0                    UGcIg           utun0       
default                                 fe80::%utun1                    UGcIg           utun1       
default                                 fe80::%utun2                    UGcIg           utun2       
::1                                     ::1                             UHL               lo0
Improve this question

1 Answer 1

Reset to default
0

If the DNS servers are set via the VPN (as in they override what you use when NOT on a VPN) or the VPN tunnel is set to tunnel-all (as in they install a default route into your route table, which will have a lower distance/metric than your usual default route), then the request is a part of the encapsulated traffic and is routed through the VPN tunnel, meaning publicly it would use the VPN’s public IP address from the remote node your session is established with.

Improve this answer
13
  • The VPN actually has DNS servers set by default but overridden by AdGuard's DNS. I am unsure if the VPN is configured in full-tunnel or split-tunnel. Is there any way I could know this? I would guess that any VPN (that's not your own) is configured in full-tunnel and split-tunnel is something you have to actually configure yourself but I wouldn't bet on it.
    – spectral-hardware
    Nov 12, 2021 at 16:52
  • @spectral-hardware Easily. If you see that the tunnel installs more than 1 route (anything other than ONLY a default route) it’s in split-tunnel mode. Your guess is not necessarily true. Depending on the environment, such as if a client/customer requests it, the tunnels can be whatever they want. They can even be different per user (one may have split-tunnel while others have tunnel-all). If you want to see which address will be used to reach which DNS server, it’s as easy as looking at your route table on your Mac to see which route encompasses the destination you’re looking for.
    – Jesse P.
    Nov 12, 2021 at 16:58
  • 1
    There you go with the default routes.
    – spectral-hardware
    Nov 12, 2021 at 19:09
  • 1
    Great. Again, thanks for your help and patience on this. I learned pretty useful things.
    – spectral-hardware
    Nov 12, 2021 at 19:26
  • 1
    I did, actually. But as it seems I don't have enough reputation, the website won't let me. However my "feedback has been recorded" (don't know what it means though).
    – spectral-hardware
    Nov 13, 2021 at 14:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.