Open VPN has DNS leak

Question

Since using www.dnsleaktest.com I have found that any VPN service using Open VPN will leak my DNS through the tunnel.

I have tried and tested several VPN providers, even those who say that they have a solution to the DNS leak problem, such as Mulvad for example, and they all leak. In addition to dnsleaktest.com, I have confirmed the DNS leak though my email provider, which logs the IP address when logging on. Even with a VPN my actual IP will be logged. All those what's your-ip type of sites say that my IP is coming from the VPN server when it is not. I have also tried to fix the leak with a patch script which is downloaded from a link from the dnsleaktest website and have found that this does not work to stop the leak. I have manually configured a remote DNS resolver in Romania through the properties menu in the adapter settings in Windows 7 but still have the leak.

Only two things I have found to not leak. One is Ultrasurf (which I have to manually configure in the browser 127.0.0.1:9666) and the proxy which is built into Epic privacy browser. Unfortunately these are proxies and not VPN tunnels so the servers will be generating logs, but at least my ISP is now blind and if anyone wants to know my surfing habits they will have to take up the task of getting into the proxy server logs. So I have stopped using my paid VPN service and use the proxies because my DNS does not leak from them.

I would very much like to know if anyone has noticed the leak problem with Open VPN and found a solution to the leak.

Answer 1

VPNs neither leak DNS nor do they inhibit DNS leaks. A VPN is nothing more or less than an encrypted connection to a remote network. What you do with it (DNS, browsing, etc) is totally up to you and your configuration. In other words, whether or not DNS information goes thorugh your VPN depends on how you've configured your computer to use that VPN link.

A "Full Tunnel" VPN, which is where you configure your workstation to send all of your Internet traffic through the VPN, will not (cannot) leak anything.

Whether or not you're doing full-tunnel or split-tunnel isn't a feature of the VPN, though, it's determined by your own computer's configuration and routing table.

Note that this "Ultrasurf" thing where you reconfigure your browser to use a proxy address is not a VPN. It's a proxy. And proxy servers are not VPNs.

Answer 2

I am showing a solution that I found for the benefit of anyone else who may have had the same problem with OpenVPN. To further clarify what was going on, to try to stop the leak problem, I had been manually changing the preferred dns settings in the TCP/IPv4 properties menu by going through the adapter settings in the local area connections for both the the tap adapter and normal local area connection. When launching the vpn and visiting my email my isp was logged there, meaning that my dns was leaking. This was the result even with the manual changes as described above. Yesterday I downloaded an application called DNSCrypt from OpenDNS, installed it and did the tests again and now it seems there is no more leaking when running the vpn.

New tests now show that only the vpn server in the country where it is located will show up in ip check websites and in my email logon history. Also, only the Open DNS server in the country where the vpn server that I am connected to will be shown in the dnsleaktest.com leak test and sometimes no server shows up at all. The application DNSCrypt has configured the preferred dns settings to for all the local area connections to 127.0.0.1. The DNSCrypt application also prevents any manual changes to the preferred dns settings as any changes I tried to make were switched back to 127.0.0.1 as soon as the adapter properties menu was closed. A nice dns hijack protection feature.

Of course some of the OpenDNS servers keep logs, but at least the problem of transparent dns proxy used by my ISP, Clearwire, is now solved and now anyone wanting logs will have go server searching.

Answer 3

Pavel Ryzhov has a solution involving adding a few lines at the end of ovpn files which worked for me: https://askubuntu.com/a/949272/311570

To copy his solution:

In order to let openvpn to alter the system DNS settings, therefore eliminating the leak, add the following lines at the end of the your *.ovpn configuration file:

script-security 2
up /etc/openvpn/update-resolv-conf
down /etc/openvpn/update-resolv-conf

Details of what this does are included in his post.

Answer 4

CHROME: Download uBlock Origin -> settings -> <x> Prevent WebRTC from leaking local IP address

FIREFOX: type in the URL -> about:config -> type media.peerconnection.disable to TRUE

Answer 5

Most VPN services push "redirect-gateway def1" so it's unlikely that anything is "leaking". You can check that with Wireshark. It's just that the tap adapter isn't using the DNS server(s) specified by the VPN, but instead those cached locally.

The simplest "solution" is changing the DNS servers in your LAN router from ISP defaults to, for example, those suggested by WikiLeaks. Once you flush your computer's DNS cache, there won't be a direct connection to your ISP.

In Windows, you can specify DNS servers for the VPN tap adapter, but I've never tested that with VPNs. In Linux with Network Manager, you can reliably specify DNS servers for the VPN tunnel. I prefer to use pfSense VMs as VPN clients, and hard code appropriate DNS servers in DHCP for LAN.

If the VPN tunnel fails open, everything will leak. Kill the OpenVPN process while capturing with Wireshark and see ;) To prevent that, you need routing and firewall rules that restrict traffic to the VPN. You can use Comodo in Windows, and there are rules posted in the AirVPN forum. For Linux, adrelanos' VPN-Firewall is easy and effective. It's very easy to secure pfSense.

Answer 6

There is an option in "Private Internet Access" settings called "DNS Leak Protection". When you check off that setting there are no leaks apparent with any online test like http://ipleak.net/. However, the plug option does mess with your internet connectivity; on the 1st re-boot after activating the option, you will no longer be able to connect. After de-selecting, you might have to boot again before returning to normal usage. The point is it works - you can use it for sessions where you really feel you need leak protection.

Answer 7

I created a couple of batch files to simplify changing the adapter setting when I connect to an anonymous VPN, which is just easier then manually going into the adapter settings.

For a windows OS, paste this into notepad and save as VPNON.bat. Change Ethernet to the actual name of the interface.

netsh interface IPv4 set dnsserver "Ethernet" static 0.0.0.0 both
ipconfig /flushdns

And then this and save as VPNOFF.bat

netsh interface IPv4 set dnsserver "Ethernet" dhcp
ipconfig /flushdns

After connecting to your VPN run the VPNON.bat file. After disconnecting run VPNOFF. Test on https://www.dnsleaktest.com/ or however you prefer. You may need to use the Run as Administrator option depending on your OS version. If you're a linux user I'm assuming you know how to create a shell script file to do the same thing.

Answer 8

I've had this problem too. I don't believe OpenVPN alone changes the DNS without being told. If you're on Windows I recommend this, If you're using a Linux machine just change the DNS in "/etc/resolv.conf".