2

If I use a VPN that encrypts my connection and a third party DNS like Google's or OpenDNS' (to avoid DNS leaks?), what can my ISP see, exactly? Just me querying the DNS server?

To clarify, I got an account with a VPN provider located in a privacy-oriented jurisdiction. I tested for DNS leaks using DNSleaktest.com and it still detected my provider's DNS servers. So I went and changed my DNS servers to Google's ones, just to see what would happen, and it worked, namely, my provider's DNS servers were gone.

My understanding is, and by all means correct me if I'm wrong, that my traffic goes through the VPN and my DNS queries go through Google's servers, so all the ISP can see right now is me communicating with those servers but nothing more, not the websites I'm reaching, and not the content.

Improve this question
5
  • How exactly is using a third-party DNS service provider suppose to avoid DNS leaks? You assume Google or OpenDNS does not have the ability to do exactly what your ISP has the ability to do when dealing with the information shared with a DNS server. I support using said third-party services with the understanding they solve an entirely different problem other than DNS security ( although I admit some of the features are indeed security related ).
    – Ramhound
    Oct 10, 2013 at 14:36
  • What exactly are you trying to achieve / avoid?
    – Richard Lucas
    Oct 10, 2013 at 14:37
  • @Richard I might be sent overseas to work in a country where internet is censored. I want to make my connection secure and private. Ideally the ISP would not have any idea of what I'm doing.
    – Reddast
    Oct 10, 2013 at 14:39
  • 1
    @Reddast - You assume you will even be able to connect to the VPN. The embassy in said country should be able to suggest a few solutions
    – Ramhound
    Oct 10, 2013 at 14:41
  • @Ramhound Yes, I will, it's already been tested. I updated my answer.
    – Reddast
    Oct 10, 2013 at 14:47

2 Answers 2

Reset to default
1

To be secure you have to ensure that all your traffic (including your DNS requests) goes through the VPN. This should be the default configuration for such anonymization VPN services.

In this case the ISP would see just the VPN connection (and sizes of the packets, their timing etc.). From the DNS requests going outside of the VPN they would easily see the addresses you are connecting to!

Dangers of anonymization VPNs

The problem on anonymization VPNs is that the VPN provider can easily see (and modify!) all your traffic! In many cases using anonymization VPNs (without using end-to-end encryption like SSL/TLS) could be very dangerous!

The VPN providers can also log the traffic and provide the logs to others (government institutions etc.).

More secure alternative - Tor

If you do not want to use a high bandwidth (e.g. downloads) and low latency (e.g. VoIP), much more secure alternative could be the Tor network. To get the basic idea you can see How should one explain Tor? See also the home page with more information: https://www.torproject.org/

One of the main differences is that no-one sees your IP address and your open communication at the same time so when using Tor properly practically no-one should be able to connect your IP address with your open communication. There is a high number of exit nodes (from which your traffic goes to the destination computers) which are selected randomly. The routing path randomly changes every 10 minutes.

Avoiding detection of Tor

From some characteristics ISP can detect that you are using Tor. There are modules which can encapsulate the traffic so that it looks like a regular SSL/TLS and be almost indistinguishable from HTTPS traffic. See How are 'Pluggable Transport' bundles different from 'regular' Tor Browser Bundles?

Improve this answer
7
  • @Ramhound: I added basic information about avoiding of Tor detection to the reply. Of course if you are serious about security (including anonymity) you have to obey some rules. Anyway in most of the cases Tor is much more secure than usual anonymization VPN.
    – pabouk - Ukraine stay strong
    Oct 10, 2013 at 15:35
  • @pabouk Tor is in my arsenal but I can't use it for bandwidth-intensive stuff like VoIP, video chats, and so on. I'm also going to disable Javascript and Flash for security reasons, so I can't use it for much beyond light browsing. My current VPN provider supports encryption, and I can see I'm using SSL from the OpenVPN log.
    – Reddast
    Oct 10, 2013 at 15:40
  • @Reddast: I was afraid of that. In such case I would recommend you keeping in mind the dangers of anonymization VPNs and selecting a good VPN provider. Probably there are VPN provides which offer SSL/TLS encapsulated connections which would be hard to detect by the ISP.
    – pabouk - Ukraine stay strong
    Oct 10, 2013 at 15:45
  • @Ramhound: Certainly there are some dangers but if you are behaving securely they can be strongly minimized. I would trust Tor more than anonymization VPNs except I would run the VPN gateway myself (or by my trusted friend) :)
    – pabouk - Ukraine stay strong
    Oct 10, 2013 at 15:49
  • @pabouk - I think we can agree there is no perfect solution unless you have the ability to run your own VPN service but even that solution has a serious BUT with that ip address being connected to somebody.
    – Ramhound
    Oct 10, 2013 at 15:54
0

I'm just wondering what my ISP can see now.

They can see that you're only connected to a single IP address which is owned by a known privacy-oriented VPN provider.

...very suspicious.

Improve this answer
4
  • Which is fine by me, my local ISP doesn't care and my future ISP won't consider it suspicious if a foreign worker uses a VPN, most companies use them. It's all they see, though? Just one IP? What about the DNS servers?
    – Reddast
    Oct 10, 2013 at 14:54
  • @Reddast - That really depends on the DNS Server. If you are asking if the services you asked about are more secure, then the ISP in said foreign country would be, the answer more then likely they are. Your understand is indeed correct about how content a VPN provider would see, what content your ISP would see, and the connection to both to your DNS provider.
    – Ramhound
    Oct 10, 2013 at 15:00
  • @Reddast: If DNS requests aren't also going through your VPN, then there's something wrong with your setup. And if you want to hide information from your ISP, then you probably shouldn't use their DNS services.
    – Oliver Salzburg
    Oct 10, 2013 at 15:04
  • @OliverSalzburg My VPN provider offers no information re: forcing DNS requests to go through their VPN. In their knowledgebase they either suggest DCHP or Google DNS/OpenDNS, so maybe they don't support that. I will open a ticket.
    – Reddast
    Oct 10, 2013 at 16:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .