tcpdump -ni eth0 port 53 and
tcpdump -ni openvpn port 53, to see if DNS information was being routed through my normal internet connection or my OpenVPN service.
I am running
transmission-daemon, and I was surprised that the monitoring of
eth0 showed traffic to a torrent tracker, while
openvpn did not display any traffic on port
53 at all.
$ tcpdump -ni eth0 port 53 XX:XX:XX.XXXXXX IP (tos 0x0, ttl 64, id 21651, offset 0, flags [none], proto UDP (17), length 94) 192.168.0.1.53 > 192.168.0.15.XXXXX: XXXXX 2/0/0 bt.xxxxx.com. A XXX.XXX.XXX.XXX, bt.xxxxx.com. A XXX.XXX.XXX.XXX (66)
Does this imply that my "real" IP address is leaking to the tracker, or does it simply mean that
eth0 is what's being used to transport the
When using this TorGuard IP test torrent in my Torrent application, it displays the correct VPN IP address – not my original one.
I have set up a firewall script to bind the VPN to use the port
24328 for BitTorrent traffic (which I can also see when I monitor that port). My thinking is that the tracker could be sending other types of requests via other ports than
24328, and that traffic goes via the normal interface
eth0 to the tracker?
#!/bin/sh # Print environment variables for transmission's benefit printenv > /etc/openvpn/myprovider/vpn.env # Set up VPN routes ip route add default via $route_vpn_gateway dev $dev table 10 ip rule add from $ifconfig_local/32 table 10 ip rule add to $route_vpn_gateway/32 table 10 ip route flush cache # Add firewall rules iptables -A INPUT -i $dev -p udp --dport 24328 -j ACCEPT iptables -A INPUT -i $dev -p tcp --dport 24328 -j ACCEPT iptables -A OUTPUT -o $dev -p udp --sport 24328 -j ACCEPT iptables -A OUTPUT -o $dev -p tcp --sport 24328 -j ACCEPT