Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I've set up OpenVPN on a Linux server. All my Internet traffic goes through the VPN from that server. I'm running Windows 7 at home. I noticed in Wireshark that DNS queries are not going through the encrypted tunnel, but instead directly to my ISP's designated DNS servers.

To overcome this, I tried pushing DNS for OpenVPN from the server to my computer, and also inputting the DNS address in my wireless adapter's configuration options. This appears to have secured the DNS leak, but is it the proper way to go about it? If I didn't push the DNS address from the server to the client and only set the DNS in the client's wireless adapter, then I couldn't visit any website. And if I just pushed the DNS but didn't set it in the adapter, then some DNS requests still leaked to the ISP's DNS servers.

share|improve this question
1  
Odd, and nice to know one might need to be careful! When only pushing it from the VPN server: any chance that only unresolved DNS requests were sent to the ISP? (For a retry, as the first DNS couldn't find it.) Or maybe only from some specific programs? (That somehow might have cached the DNS settings from before the VPN was activated?) –  Arjan Mar 22 '11 at 21:12

2 Answers 2

You say that all your traffic goes through the VPN, can you check if udp traffic is going through it? DNS queries are done over UDP, not TCP. I think OpenVPN routes UDP, but I don't know your configuration so that could be it. You can check this simply by querying other nameservers (like 4.2.2.2 or 8.8.8.8) and see if it goes through the VPN.

Depending on where the other end of the VPN is, you may not be able to querying your ISP's DNS servers from the other end, a lot of resolving DNS servers block queries from anything off their own network.

share|improve this answer
    
I'm using udp for the vpn. As i know its best to avoid vpn over tcp as it has worse performance. Pushing dns from the server is supposed to force windows clients to use that dns but it doesn't work like that in my case (maybe in lots of cases). My router which my isp provided has a dns server running on it that overides or at least makes my computer want to use the isp's dns servers all the time. –  abaooooo34342 Mar 23 '11 at 10:18

I make use of the freevpn.me service. I also have the problem that my dns requests leak. However, I always connect over TCP because UDP simply doesn't work for me. Even if I open all the ports on my router.

Using socks proxies works for me to prevent DNS leaks properly.

This is what worked for me (step by step): On my windows system (clients) I

  • Install firefox and disable WebRTC detection.
  • Install Foxyproxy for firefox
  • Force Firefox to only accept data from VPN adapter with (Comodo Free) firewall, is a permanent killswitch in case your VPN dies.
  • Gather socks proxy info from the internet and configure foxyproxy. ==> I use 'xroxy (dot) com' to filter and find ‘socks proxies’, and use www.sockslist.net to check if the proxy works. This way you should have your DNS changed, and an extra security layer.

This also works when you want to download torrents:

You can set up Vuze to only accept data from the VPN adapter (ip binding), and set it up to use the socks proxy too. This way you can ensure that Vuze isn’t using the DNS from the router. If the VPN dies, Vuze won’t be able to download because of the IP binding, similar to a firewall killswitch.

Firefox simply stops working if the Socks proxy fails, and Vuze changes it's green proxy icon (in the bottom) to yellow/red if it isn't working properly. This allows you to stop the torrent and find a new proxy for this purpose.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.