Question

VPN Question about DNS Leaks and plugging them

Posted February 17, 2018 2.6k views
Server Optimization DNS VPN Applications Ubuntu 16.04

Setup ALGO to run on a small server on DO.

Working on locking down DNS Leaks by running terminal checks, flushing DNS Cache, running checks through DNS leak test and whoer.net

Obviously Chrome is out of use because of WebRTC leaks and can’t be shut off, but testing through Safari and Firefox I think DNS is still leaking.

My expectation is that if the server I setup on DO through ALGO is say 111.111.11.111 and my local machines IP is 11.11.11.1 that all traffic would route through the ALGO VPN and no other IP addresses would show up. However, using Firefox and Safari I still see a bunch of DNS show up with addresses like.

74.125.44.132 (which traces to Google)
74.125.19.12 (which traces to Google)
74.125.44.66 (which traces to Google)
74.125.19.2 (which traces to Google)
74.125.19.8 (which traces to Google)
74.125.44.74 (which traces to Google)

If a VPN is working properly the only address that should show up is the one running on ALGO server at the 111.111.11.111 address.

Could this be a plugin that’s leaking? I have HTTPS Everywhere running and a few others? What else could it be?

Add a comment
caledonia
By:
caledonia
Add a comment

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

3 answers
kamaln7 February 20, 2018

It looks like Algo is configuring dnsmasq to relay requests to Google’s DNS servers by default: https://github.com/trailofbits/algo/blob/d8f0393dd8d9a88fe72dec47f0290e9990e9e125/config.cfg#L32

That might be why you’re seeing those IP addresses that are owned by Google. What I would suggest is replacing Google’s DNS resolvers with, for example, OpenDNS’s and seeing what happens then.

Reply Report
caledonia February 20, 2018

Thanks @kamaln7 . That’s a good catch. I also was playing with all the telemetry settings in Firefox as well. When I did so in one of my tests DNS leaks weren’t happening when I checked using whoer.net another site that looks for leaks though is https://www.dnsleaktest.com/ and that still had the google servers. Apparently Firefox has a lot of telemetry data on by default. I wish it was easier to just turn it all off.

I also caught quite a few plugins that I use that are pinging Google too.

I’ll take your answer and post it to the community issue forum for Algo and see what they say and then update this thread with any response in case anyone else is curious about DNS leaks.

Reply Report
tomka July 3, 2018

I just want to notice, that in terminal mode is hard to use Internet browser. But it’s very helpful to run simple Python script for DNS leak test https://github.com/macvk/dnsleaktest (for instance)

Reply Report
Submit an Answer

Related

Looking for something else?

Ask a new question Search for more help