VPN Question about DNS Leaks and plugging them

February 17, 2018 929 views
VPN DNS Applications Server Optimization Ubuntu 16.04
caledonia
By:
caledonia

Setup ALGO to run on a small server on DO.

Working on locking down DNS Leaks by running terminal checks, flushing DNS Cache, running checks through DNS leak test and whoer.net

Obviously Chrome is out of use because of WebRTC leaks and can't be shut off, but testing through Safari and Firefox I think DNS is still leaking.

My expectation is that if the server I setup on DO through ALGO is say 111.111.11.111 and my local machines IP is 11.11.11.1 that all traffic would route through the ALGO VPN and no other IP addresses would show up. However, using Firefox and Safari I still see a bunch of DNS show up with addresses like.

74.125.44.132 (which traces to Google)
74.125.19.12 (which traces to Google)
74.125.44.66 (which traces to Google)
74.125.19.2 (which traces to Google)
74.125.19.8 (which traces to Google)
74.125.44.74 (which traces to Google)

If a VPN is working properly the only address that should show up is the one running on ALGO server at the 111.111.11.111 address.

Could this be a plugin that's leaking? I have HTTPS Everywhere running and a few others? What else could it be?

Log In to Comment
3 Answers
kamaln7 MOD February 20, 2018
Accepted Answer

It looks like Algo is configuring dnsmasq to relay requests to Google's DNS servers by default: https://github.com/trailofbits/algo/blob/d8f0393dd8d9a88fe72dec47f0290e9990e9e125/config.cfg#L32

That might be why you're seeing those IP addresses that are owned by Google. What I would suggest is replacing Google's DNS resolvers with, for example, OpenDNS's and seeing what happens then.

Reply
caledonia February 20, 2018

Thanks @kamaln7 . That's a good catch. I also was playing with all the telemetry settings in Firefox as well. When I did so in one of my tests DNS leaks weren't happening when I checked using whoer.net another site that looks for leaks though is https://www.dnsleaktest.com/ and that still had the google servers. Apparently Firefox has a lot of telemetry data on by default. I wish it was easier to just turn it all off.

I also caught quite a few plugins that I use that are pinging Google too.

I'll take your answer and post it to the community issue forum for Algo and see what they say and then update this thread with any response in case anyone else is curious about DNS leaks.

Reply
tomka July 3, 2018

I just want to notice, that in terminal mode is hard to use Internet browser. But it's very helpful to run simple Python script for DNS leak test https://github.com/macvk/dnsleaktest (for instance)

Reply
Have another answer? Share your knowledge.

Related Questions