DNS Leak on Linux

smugcloud

Hey Folks,

I am running Pop OS 21.10, and appear to have a DNS leak. Here are my configs:

Client

remote <IP> 1194
persist-key
persist-tun
dev tun
proto udp
cipher AES-256-CBC
reneg-sec 0
resolv-retry infinite
nobind
ifconfig 10.8.0.2 10.8.0.1
comp-lzo
verb 4
tls-client
redirect-gateway
script-security 2
up /etc/openvpn/update-resolv-conf
down /etc/openvpn/update-resolv-conf

Server

port 1194
proto udp
dev tun
ifconfig 10.8.0.1 10.8.0.2
push "redirect-gateway def1"
push "dhcp-option DNS 8.8.8.8"
reneg-sec 28800
keepalive 10 120
comp-lzo
persist-tun
status server-tcp.log
verb 4
cipher AES-256-CBC

My public IP is as expected. What am I missing to protect the DNS queries?

TinCanTech

When you say DNS Leak, what do you mean ?

You have configured your VPN client to use google DNS (8.8.8.8).

smugcloud

TinCanTech wrote When you say DNS Leak, what do you mean ?

You have configured your VPN client to use google DNS (8.8.8.8).

I am referring to sites like https://dnsleak.com/ indicating that the DNS queries are leaking my actual IP. I am trying make all traffic appear as if it originates from the OpenVPN server.

TinCanTech

smugcloud wrote I am trying make all traffic appear as if it originates from the OpenVPN server.

Use NAT at your server firewall.

https://community.openvpn.net/openvpn/wiki/HOWTO#Routingallclienttrafficincludingweb-trafficthroughtheVPN

smugcloud

TinCanTech wrote
smugcloud wrote I am trying make all traffic appear as if it originates from the OpenVPN server.
Use NAT at your server firewall.

https://community.openvpn.net/openvpn/wiki/HOWTO#Routingallclienttrafficincludingweb-trafficthroughtheVPN

Thanks @TinCanTech. I have previously tried this, and am curious about this note:

push "dhcp-option DNS 10.8.0.1"

will configure Windows clients (or non-Windows clients with some extra server-side scripting) to use 10.8.0.1 as their DNS server. Any address which is reachable from clients may be used as the DNS server address.

I am using a Linux client as well, so what is the "extra server-side scripting" that is needed for this?

TinCanTech

smugcloud wrote I am using a Linux client as well, so what is the "extra server-side scripting" that is needed for this?

That .. is a bug. It should read "client-side scripting".

Linux requires a script to configure your client DNS resolver, usually one of these:
https://github.com/jonathanio/update-systemd-resolved
https://github.com/alfredopalhares/openvpn-update-resolv-conf

smugcloud

Thanks @TinCanTech.

So I have the OpenVPN update-resolv-conf on the client machine

$ file /etc/openvpn/update-resolv-conf 
/etc/openvpn/update-resolv-conf: Bourne-Again shell script, ASCII text executable

My client is configured to use it

up /etc/openvpn/update-resolv-conf
down /etc/openvpn/update-resolv-conf

The server has iptables configured

Chain POSTROUTING (policy ACCEPT)
num  target     prot opt source               destination         
1    MASQUERADE  all  --  10.8.0.0/24          anywhere

and I've reconfigured the server conf to mirror the config guide

push "redirect-gateway local def1"
push "dhcp-option DNS 10.8.0.1"

The OpenVPN client seems to be using the resolve-confg script correctl

2022-01-26 10:53:12 us=708461 net_addr_ptp_v4_add: 10.8.0.2 peer 10.8.0.1 dev tun0
2022-01-26 10:53:12 us=709377 /etc/openvpn/update-resolv-conf tun0 1500 1558 10.8.0.2 10.8.0.1 init

Yet I still see the "DNS leaks" on sites like I posted. Is that perhaps a red herring? Is there a better test to validate this?

TinCanTech

Are your server and client located at the same IP address, like your home ?

smugcloud

No, the server is in a remote location.

Pippin

Your browser might "leak"...

smugcloud

Pippin wrote Your browser might "leak"...

Hmm, is it not possible to force all traffic from the client machine to route through the tunnel/server?

Pippin

Not easily.
Look into "browser leaks", which is off topic here...

TinCanTech

smugcloud wrote is it not possible to force all traffic from the client machine to route through the tunnel/server?

If you setup your VPN correctly it is.

I just carefully read your configs .. where did you get that crap from ?

smugcloud

TinCanTech wrote I just carefully read your configs .. where did you get that crap from ?

Ha, some from the OpenVPN docs, and some hacked together. I'm all ears if there is a simpler/better config to use.

TinCanTech

Start with the howto. https://community.openvpn.net/openvpn/wiki/HOWTO