DNS Leaks while usin OpenVPN on Mint Linux to IPVanish

MikeP2017

Hi Everybody

I am now in my third week of posting on the Linux Mint forums and conversing with IPVanish support to try to crack my problem

System - Linux Mint 18.2 Cinnamon 64-bit Linux kernel 4.4.0-53-generic
VPN - IPVanish
OpenVPN - Version: 2.3.10-1ubuntu2.1

IPv6 Permanently disabled in system

Router set to Google DNS servers 8.8.8.8 and 8.8.4.4

.ovpn file
client
dev tun0
proto udp
remote ams-a24.ipvanish.com 443
dhcp-option DNS 198.18.0.1
block-outside-dns
resolv-retry infinite
nobind
persist-key
persist-tun
persist-remote-ip
ca ca.ipvanish.com.crt
verify-x509-name ams-a24.ipvanish.com name
auth-user-pass
comp-lzo
verb 3
auth SHA256
cipher AES-256-CBC
keysize 256
tls-cipher TLS-DHE-RSA-WITH-AES-256-CBC-SHA:TLS-DHE-DSS-WITH-AES-256-CBC-SHA:TLS-RSA-WITH-AES-256-CBC-SHA

When I run a dns leak test for the first time only the IPVanish server shows on list
but on every dns leak test thereafter there is a whole bunch of Google servers listed

Between IPVanish support (who are very responsive and helpful, by the way) and the Mint forums, we have tested every conceivable adjustment to the system and the .ovpn files. WE are beginning to suspect that there is a bug in the Mint system

Any idea out there?

Thanks in advance

TinCanTech

MikeP2017 wrote block-outside-dns

Only available for Windows ..

MikeP2017 wrote dhcp-option DNS 198.18.0.1

Requires a script to work on Linux ..

Are you using Linux NetworkManager to control openvpn ?

MikeP2017

Thanks for the reply

Does this mean that I can not prevent DNS leaks using OpenVPN on Linux?

"Are you using Linux NetworkManager to control openvpn ?"

I installed OpenVPN following instructions from IPVanish and I select from my imported .ovpn files from the network drop-down which lists all available connections
So I guess the answer is yes

TinCanTech

MikeP2017 wrote installed OpenVPN following instructions from IPVanish and I select from my imported .ovpn files

These files are for Windows not Linux .. so I guess IPVanish do not support Linux, they are not helpful at all.

TinCanTech wrote Are you using Linux NetworkManager to control openvpn ?

MikeP2017 wrote I guess the answer is yes

Best not to guess but to know instead .. I cannot help you with NetworkManager.

Here are some details how to start openvpn on Linux not using NM:
https://openvpn.net/index.php/open-source/documentation/howto.html#startup

If you installed openvpn in Linux Mint from the Mint repos then this is what you need for DNS ..
Linux requires the following client directives to have some options be successfully --push'ed

Client config:

script-security 2
up /etc/openvpn/update-resolv-conf
down /etc/openvpn/update-resolv-conf

You may also be able to use the repos listed here:
https://community.openvpn.net/openvpn/wiki/OpenvpnSoftwareRepos

MikeP2017

It has taken me for ever to find my thread

I posted it in 'OpenVpn Access server' which is what I have installed

For some reason it had been moved to 'off topic'

I can't think of anything more 'on topic' !!

anyway................................

Thanks for your reply TinCanTech but no, .ovpn files are not Windows only. OpenVPN files are OpenVPN files regardless of platform ........................see here >>>>>
https://support.ipvanish.com/hc/en-us/articles/360001738513-How-to-Configure-OpenVPN-in-Linux-Mint-
and here .... https://www.techrepublic.com/blog/linux-and-open-source/how-to-set-up-a-linux-openvpn-client/
for explanations

I followed, to the letter, the installation guides for OpenVPN and IPVanish

If you installed openvpn in Linux Mint from the Mint repos then this is what you need for DNS ..
Linux requires the following client directives to have some options be successfully --push'ed
all Greek to me

I have been pointed to page after page after page of 'helpful' , 'how to's

Thanks for the input everybody, but I am waiting for a reply from an OpenVPN/Linux/IPVanish user/expert who can sort this out and talk to me in English..........................but maybe there are none

Thanks anyway

TinCanTech

MikeP2017 wrote posted it in 'OpenVpn Access server' which is what I have installed

Maybe but you are not using Access Server to connect to IPVanish.

MikeP2017 wrote For some reason it had been moved to 'off topic'

It is Off Topic because this Forum does not provide support for Online Service Providers.

They take your money therefore they provide support.

--

MikeP2017 wrote If you installed openvpn in Linux Mint from the Mint repos then this is what you need for DNS ..
Linux requires the following client directives to have some options be successfully --push'ed
all Greek to me

TinCanTech wrote

Client config:

script-security 2
up /etc/openvpn/update-resolv-conf
down /etc/openvpn/update-resolv-conf

Looks straight forward enough to me ..

MikeP2017 wrote but no, .ovpn files are not Windows only. OpenVPN files are OpenVPN files regardless of platform

That might be the goal, eventually .. but it is not the case as it stands.

MikeP2017 wrote I followed, to the letter, the installation guides for OpenVPN and IPVanish

The IPVanish guide does not explain that you need the code I gave you above .. so they do not officially support Linux.

MikeP2017 wrote Thanks for the input everybody, but I am waiting for a reply from an OpenVPN/Linux/IPVanish user/expert who can sort this out and talk to me in English..........................but maybe there are none

Am i not using English ?

There is a learning curve and plenty of documentation, if you will not read it then good luck ..

MikeP2017

Thanks for your time TinCan

It is Off Topic because this Forum does not provide support for Online Service Providers

I am not asking for support for Online Service Providers. Please read my initial post. I am asking for support for OpenVPN

If I can not get support here for OpenVPN, is there another forum or other route to support?

That might be the goal, eventually .. but it is not the case as it stands.

Still wrong, I reccommend reading articles such as :-
https://openvpn.net/index.php/access-server/docs/admin-guides-sp-859543150/howto-connect-client-configuration/182-how-to-connect-to-access-server-with-linux-clients.html
and
https://openvpn.net/index.php/open-source/documentation/howto.html

I think you are getting confused with terms such as client and server

IPVanish run Open VPN compatible access servers
.opvn files are files that specify which server to connect to (and other parameters). These are specified in Windows, IOS, Ubuntu, etc etc
I am running an OpenVPN client, the software for which was downloaded from an OpenVPN site. I expect it to work as advertised. It does not. It is full of holes

Can anybody suggest a VPN system for Linux that does not involve OpenVPN as we really can not afford to be using 'hobbyist' software which is not supported. All of the commercial VPNs we have looked at rely on OpenVPN to connect to their access servers in Linux

We are dealing with very sensitive data which is why we use a Linux system for the inherent security. As we can not trust the combination of Linux and OpenVPN we must look for another solution.

Thanks in advance for any solutions

TinCanTech

I will make this simple .. Windows .ovpn file are different to Lunix .conf files.

The goal maybe to make the client config files platform agnostic but it is not currently the case.

MikeP2017 wrote IPVanish run Open VPN compatible access servers
.opvn files are files that specify which server to connect to (and other parameters). These are specified in Windows, IOS, Ubuntu, etc etc
I am running an OpenVPN client, the software for which was downloaded from an OpenVPN site. I expect it to work as advertised. It does not. It is full of holes

So complain to IPVanish .. we do not maintain their servers.

ciao

MikeP2017

Again, thanks for your time TinCan, but we will have to agree to disagree

This is nothing specific to IPVanish servers. The same thing happens regardless of which provider's VPN servers are used.

I have OpenVPN installed to connect to my Linux system to an IPVanish server of choice.
That choice is made by choosing a VPN connection from the drop-down in Network Manager
The listings in the VPN section of the drop-down are network connections created by importing .ovpn files

Perhaps pictures might help

They are

1.png - My software Manager showing which OpenVPN components are installed

2.png - The relevant entry (imported from .ovpn file) in etc/NetworkManager/system-connections (this is where .ovpn files come in to Linux)

3.png - The import file (.OVPN dialog box

So
I installed OpenVPN components
I imported .ovpn file for my chosen VPN server
I selected that connection from network manager

This all works fine , no problems
My visible IP address has changed and I have a secure connection except that I have a dns leak, which is why I started this thread.

It appears to be the way in which the OpenVPN implementation on linux imports the .ovpn files to create the system connection binaries in etc/NetworkManager/ There seems to be items missing.

It has been suggested that the Linux implementation of OpenVPN does not accept either dhcp-option 'DNS xxx.xxx.xxx.xxx' or 'block-outside-dns' Although they are specified in the .ovpn file, they seem to be missing once imported to become system connection.

Our main use of a VPN is to transfer client data which must be kept secure so the DNS leak is no biggie.
But for others using the system for anonymity purposes, it could be, which is why we are trying to get to the bottom of this.

Thanks again TinCan for your trouble but, if you don't mind, I will wait to see if we have anybody who is expert on the Linux implementation can help

TinCanTech

MikeP2017 wrote we will have to agree to disagree

Have you seen how long I have been supporting openvpn (then quadruple that .. )

MikeP2017 wrote This is nothing specific to IPVanish servers. The same thing happens regardless of which provider's VPN servers are used

And we do not provide support for any of them.

TinCanTech wrote I cannot help you with NetworkManager.

Reiterated ..

MikeP2017 wrote I have a secure connection except that I have a dns leak

Already solved:

script-security 2
up /etc/openvpn/update-resolv-conf
down /etc/openvpn/update-resolv-conf

MikeP2017 wrote It has been suggested that the Linux implementation of OpenVPN does not accept either dhcp-option 'DNS xxx.xxx.xxx.xxx' or 'block-outside-dns' Although they are specified in the .ovpn file, they seem to be missing once imported to become system connection.

Once again:

dhcp-option 'DNS xxx.xxx.xxx.xxx'
- works on Linux with the above NON-Windows code.
block-outside-dns
- Not supported by Linux
Although they are specified in the .ovpn file, they seem to be missing once imported to become system connection
- Because .ovpn is for Windows not Linux and NetworkManager is [expletive deleted] - You will have to ask the NM team what it is doing ..

MikeP2017 wrote if you don't mind, I will wait to see if we have anybody who is expert on the Linux implementation can help

Good luck .. try reading the documentation.

MikeP2017

I am grateful for any help you can give me

but

"And we do not provide support for any of them"

I am not asking for support for anything other than OpenVPN. A DNS leak can only be as a result of system/comms software/OpenVPN software/router being mis-configured. It can not possibly be as a result of the configuration of the server being targeted. So the only people who can help are the support groups for Linux and OpenVPN

I have the following installed and I was assuming that they are supplied by, and therefore supported by, OpenVPN

Openvpn - virtual private network daemon
Network-manager-openvpn-gnome - Network management framework(openvpn plugin gnome gui)
Network-manager-openvpn - Network management framework (openvpn core)

but having read your "NetworkManager is [expletive deleted]", I am not so sure
So I will apologise and ask how I contact the NM team

"Already solved:

script-security 2
up /etc/openvpn/update-resolv-conf
down /etc/openvpn/update-resolv-conf"

sorry, didn't make any difference, still leaking

"Because .ovpn is for Windows not Linux"

For your reference, these are some of the downloads of .OVPN CONFIGURATION FILES FOR LINUX OPENVPN from various well known VPN vendors. Take a look. They are all .ovpn configuration files for Linux OpenVPN

Nordvpn https://downloads.nordcdn.com/configs/archives/servers/ovpn.zip
Purevpn https://s3-us-west-1.amazonaws.com/heartbleed/linux/linux-files.zip
IPVanish https://www.ipvanish.com/software/configs/configs.zip

I have just posted this via Amsterdam using one of IPVanish's servers (ams-24) having selected the connection created by ipvanish-NL-Amsterdam-ams-a24.ovpn

Every single VPN provider, in its Linux set up guides, say (in essense)

1) download and install OpenVPN
2) download configuration files (.ovpn) and crt files
3) select .ovpn file
4) off you go

"try reading the documentation"

I have read dozens and dozens of pages of documentation on OpenVPN client, .ovpn files, vpn servers, Mint Network Manager, etc, etc and there seems to be so much confusion to the point that a (presumably) expert insists that .ovpn files are not used in Linux

It also seems strange that there is a specific section in the forum for OpenVPN Server but OpenVPN Client is considered to be "off topic" to the support/forum

I am about to create a virgin Linux installation and start from the beginning, one step at a time, without network manager, to see if I can crack this.
I will report back with my findings as it worries me that there may be an awful lot of people who do not realise that, with a standard install of OpenVPN on Linux, they will probably be suffering from dns leaks

TinCanTech

MikeP2017 wrote "Already solved:

script-security 2
up /etc/openvpn/update-resolv-conf
down /etc/openvpn/update-resolv-conf"

sorry, didn't make any difference, still leaking

Focus on this.

The easiest way to start openvpn on Linux is from a root terminal.

me@home /etc/openvpn/ # openvpn --config /path/to/config.conf

Comment out the --log directive in config.conf and add --verb 4, the output will be on screen.

Include this code in config.conf:

script-security 2
up /etc/openvpn/update-resolv-conf
down /etc/openvpn/update-resolv-conf

then please post your log file.

MikeP2017

I can't believe that some people think that remembering and typing in a whole bunch of not very meaningful characters into a terminal is easier than a single mouse click. Back in the late 60's I programed IBM 1401s in Fortran and in the early 80's I created spreadsheets and databases in MsDos so.......Thank God for GUIs . Some are better than others, but they are all a damn sight better than Command Prompt and the Linux Terminal, both from the Dark Ages. I could have kissed Bill Gates in 1987 when he gave me Excel for Windows.

As I said before your code does not work

But fortunately I have found a group of Linux experts who are aware of the limitations of the Linux implementation of OpenVPN.

Our temporary fix, in case anybody is following this thread with the same problems as us, is to have the following specified in IPv4 section of network settings

automatic DNS turned off

DNS servers, in this order:

1 the VPN DNS server (for IPVanish 168.18.0.1)
2 the contingency VPN DNS server (for IPVanish 168.18.0.2)
3 1.1.1.1 (Cloudflare public DNS)
4 1.0.0.1 (Cloudflare contingency public DNS)

This would ensure that with the VPN off, the Cloudflare servers will be used, and that when it is on any leaks will only be to the Cloudflare's non-logging DNS servers

It is not perfect but it will do until OpenVPN and the Linux/Network Manager guys get together to fix the bugs and and plug the security hole

Once again, thanks for your efforts TinCan, but I have found the solution elsewhere. If nothing else you have learned that the Linux implementation uses .opvn configuration files

All the best

end of thread

TinCanTech

MikeP2017 wrote As I said before your code does not work

Prove it ..

Edit: It works but you have done it wrong.

TinCanTech

MikeP2017 wrote I can't believe that some people think that remembering and typing in a whole bunch of not very meaningful characters into a terminal is easier than a single mouse click. Back in the late 60's I programed IBM 1401s in Fortran and in the early 80's I created spreadsheets and databases in MsDos so.......Thank God for GUIs . Some are better than others, but they are all a damn sight better than Command Prompt and the Linux Terminal, both from the Dark Ages. I could have kissed Bill Gates in 1987 when he gave me Excel for Windows.

I don't believe you have really got to grips with Linux yet ..

MikeP2017 wrote end of thread

Sure :twisted:

ant-s

MikeP2017 wrote I can't believe that some people think that remembering and typing in a whole bunch of not very meaningful characters into a terminal is easier than a single mouse click. Back in the late 60's I programed IBM 1401s in Fortran and in the early 80's I created spreadsheets and databases in MsDos so.......Thank God for GUIs . Some are better than others, but they are all a damn sight better than Command Prompt and the Linux Terminal, both from the Dark Ages. I could have kissed Bill Gates in 1987 when he gave me Excel for Windows.

As I said before your code does not work

But fortunately I have found a group of Linux experts who are aware of the limitations of the Linux implementation of OpenVPN.

Our temporary fix, in case anybody is following this thread with the same problems as us, is to have the following specified in IPv4 section of network settings

automatic DNS turned off

DNS servers, in this order:

1 the VPN DNS server (for IPVanish 168.18.0.1)
2 the contingency VPN DNS server (for IPVanish 168.18.0.2)
3 1.1.1.1 (Cloudflare public DNS)
4 1.0.0.1 (Cloudflare contingency public DNS)

This would ensure that with the VPN off, the Cloudflare servers will be used, and that when it is on any leaks will only be to the Cloudflare's non-logging DNS servers

It is not perfect but it will do until OpenVPN and the Linux/Network Manager guys get together to fix the bugs and and plug the security hole

Once again, thanks for your efforts TinCan, but I have found the solution elsewhere. If nothing else you have learned that the Linux implementation uses .opvn configuration files

All the best

end of thread

I concur with MikeP2017. I've built my own OpenVPN server for remote access to my network and encrypting traffic when on public WIFI, so all traffic is routed through the VPN. I've had no issues with DNS leak on my windows/android devices using ( block-outside-dns ) in my .ovpn client config file. Obviously this does not work on Linux.

I've just started using Linux Mint 19 and found out ( block-outside-dns ) makes OpenVPN fail in terminal. So I have removed ( block-outside-dns ), tried the below commands added to my client .ovpn file and was still getting DNS leak as tested with www.dnsleaktest.com.

script-security 2
up /etc/openvpn/update-resolv-conf
down /etc/openvpn/update-resolv-conf

After searching other forums I also tried the below commands added to client .ovpn file. Making sure I have the correct packages installed.

script-security 2
up /etc/openvpn/update-systemd-resolved
down /etc/openvpn/update-systemd-resolved

Installed Packages

sudo dpkg-query -l | grep resolv
ii  libgeoip1:amd64					1.6.12-1                       	     amd64        non-DNS IP-to-country resolver library
ii  libnss-resolve:amd64				237-3ubuntu10                  	    amd64        nss module to resolve names via systemd-resolved
ii  openvpn-systemd-resolved			1.2.7-1                          	 amd64        integrates OpenVPN with systemd-resolved
ii  resolvconf						1.79ubuntu10                        all          name server information handler

Even tried adding the below commands to my client .ovpn file in different combinations with the above commands.

dhcp-option DNS 192.168.1.2
dhcp-option DOMAIN-ROUTE

Still did not solve my DNS leak issue. By the way I was running the OpenVPN client in the terminal with the ( openvpn myvpnfile.ovpn ) command.
The OpenVPN terminal output showed that the added commands to my .ovpn file had taken, but the DNS leak fault was still present when tested. www.dnsleaktest.com.

The only thing that has fixed this issue for me is what MikeP2017 has posted. see below

Setting for my physical network device in the Network Manager

automatic DNS turned off

DNS servers, in this order:

1 the VPN DNS server (for IPVanish 168.18.0.1)
2 the contingency VPN DNS server (for IPVanish 168.18.0.2)
3 1.1.1.1 (Cloudflare public DNS)
4 1.0.0.1 (Cloudflare contingency public DNS)

I just modified the above to suite my needs. But as MikeP2017 said this is just a temp work a round not a fix..

Thanks for help MikeP2017.

It seems to me that the Linux version of OpenVPN is not re-routing DNS requests through the VPN tunnel even with the correct commands in the .ovpn file.
If anyone has a proper fix for this please share. until then MikeP2017 work a round is messy but works for now. 😃 😃 😃

Ant-S

Pippin

You guys/girls need to ask Mint devs.
OpenVPN works properly :!:
Linux comes in many flavors, networking gets done differently.

About block-outside-dns, it gets mentioned frequently over at Mint forum. Posted two times that`s a Windows only option but it just keeps popping up.
If it comes to OpenVPN start reading the OpenVPN manual/howto but first basic networking.

Another thing, so worried about DNS leaks, which seems to have a different definition depending who you ask on Mint forum 😉, but i never see any question about NTP leaks, update server leaks or browser leaks or other applications...
Ever used tcpdump to see what`s more leaving WAN directly besides DNS..........?

And yeah, learn Linux or live with the GUI shortcomings, or network manager`s shortcomings or go back to what you`re used to.

TinCanTech

ant-s wrote I've had no issues with DNS leak on my windows/android devices using ( block-outside-dns ) in my .ovpn client config file.

Android does not support --block-outside-dns either ..

ant-s wrote using Linux Mint 19 and found out ( block-outside-dns ) makes OpenVPN fail in terminal.

No it does not.

ant-s wrote still getting DNS leak as tested with www.dnsleaktest.com

You must have done it wrong as well .. are you using NetworkManager ? If so .. don't !

We do not support NetworkManager.

There is one caveat to changing your DNS server with Openvpn --dhcp-option when using Linux:

Your original DNS server is preserved and used if the DNS servers set by --dhcp-option fail.

---

Pippin wrote Another thing, so worried about DNS leaks, which seems to have a different definition depending who you ask on Mint forum 😉, but i never see any question about NTP leaks, update server leaks or browser leaks or other applications...

Browser leaks .. yeah what fun ..

Server update leaks .. that does not fall into the category of leaks .. it is essential that you stay upto date.

NTP leaks .. you need the time and it is not something which can really be abused.

DNS leaks .. absolutely are abused by whoever captures that data .. Even if you use DNSSEC, if you do not own and manage your own DNS server then your request will eventually be captured.

One final word .. LOGS

No log files .. no support.
And this entire thread has not one single line of log file output.