I ran tcpdump -ni eth0 port 53 and tcpdump -ni openvpn port 53, to see if DNS information was being routed through my normal internet connection or my OpenVPN service.

I am running transmission-daemon, and I was surprised that the monitoring of eth0 showed traffic to a torrent tracker, while openvpn did not display any traffic on port 53 at all.

$ tcpdump -ni eth0 port 53

XX:XX:XX.XXXXXX IP (tos 0x0, ttl 64, id 21651, offset 0, flags [none], proto UDP (17), length 94) > XXXXX 2/0/0 bt.xxxxx.com. A XXX.XXX.XXX.XXX, bt.xxxxx.com. A XXX.XXX.XXX.XXX (66)

Does this imply that my "real" IP address is leaking to the tracker, or does it simply mean that eth0 is what's being used to transport the openvpn traffic?

When using this TorGuard IP test torrent in my Torrent application, it displays the correct VPN IP address – not my original one.

I have set up a firewall script to bind the VPN to use the port 24328 for BitTorrent traffic (which I can also see when I monitor that port). My thinking is that the tracker could be sending other types of requests via other ports than 24328, and that traffic goes via the normal interface eth0 to the tracker?


# Print environment variables for transmission's benefit
printenv > /etc/openvpn/myprovider/vpn.env

# Set up VPN routes
ip route add default via $route_vpn_gateway dev $dev table 10

ip rule add from $ifconfig_local/32 table 10
ip rule add to $route_vpn_gateway/32 table 10

ip route flush cache

# Add firewall rules
iptables -A INPUT -i $dev -p udp --dport 24328 -j ACCEPT
iptables -A INPUT -i $dev -p tcp --dport 24328 -j ACCEPT

iptables -A OUTPUT -o $dev -p udp --sport 24328 -j ACCEPT
iptables -A OUTPUT -o $dev -p tcp --sport 24328 -j ACCEPT

If you have configured to query dns servers on local eth0 network, it's possible. Check /etc/resolv.conf, traffic is routed through default gateway to everywhere except for the local network.

  • I have added the VPN DNS servers to resolv.conf. There is a local IP adress in there as well. Even if I remove it, if I restart the computer, it's added again. Could it be the culprit, and any way to prevent it from doing that? – Winterflags Apr 12 '16 at 17:10
  • You can change your router dhcp service configuration... – Sancho Panza Apr 12 '16 at 17:16
  • I changed the router to link to the DNS servers, but it didn't resolve my problem unfortunately. – Winterflags Apr 16 '16 at 18:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.