Question
VPN Question about DNS Leaks and plugging them
- Posted February 17, 2018
- VPNDNSApplicationsServer OptimizationUbuntu 16.04
Setup ALGO to run on a small server on DO.
Working on locking down DNS Leaks by running terminal checks, flushing DNS Cache, running checks through DNS leak test and whoer.net
Obviously Chrome is out of use because of WebRTC leaks and can’t be shut off, but testing through Safari and Firefox I think DNS is still leaking.
My expectation is that if the server I setup on DO through ALGO is say 111.111.11.111 and my local machines IP is 11.11.11.1 that all traffic would route through the ALGO VPN and no other IP addresses would show up. However, using Firefox and Safari I still see a bunch of DNS show up with addresses like.
74.125.44.132 (which traces to Google) 74.125.19.12 (which traces to Google) 74.125.44.66 (which traces to Google) 74.125.19.2 (which traces to Google) 74.125.19.8 (which traces to Google) 74.125.44.74 (which traces to Google)
If a VPN is working properly the only address that should show up is the one running on ALGO server at the 111.111.11.111 address.
Could this be a plugin that’s leaking? I have HTTPS Everywhere running and a few others? What else could it be?
These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.
It looks like Algo is configuring dnsmasq to relay requests to Google’s DNS servers by default: https://github.com/trailofbits/algo/blob/d8f0393dd8d9a88fe72dec47f0290e9990e9e125/config.cfg#L32
That might be why you’re seeing those IP addresses that are owned by Google. What I would suggest is replacing Google’s DNS resolvers with, for example, OpenDNS’s and seeing what happens then.
I just want to notice, that in terminal mode is hard to use Internet browser. But it’s very helpful to run simple Python script for DNS leak test https://github.com/macvk/dnsleaktest (for instance)
Thanks @kamaln7 . That’s a good catch. I also was playing with all the telemetry settings in Firefox as well. When I did so in one of my tests DNS leaks weren’t happening when I checked using whoer.net another site that looks for leaks though is https://www.dnsleaktest.com/ and that still had the google servers. Apparently Firefox has a lot of telemetry data on by default. I wish it was easier to just turn it all off.
I also caught quite a few plugins that I use that are pinging Google too.
I’ll take your answer and post it to the community issue forum for Algo and see what they say and then update this thread with any response in case anyone else is curious about DNS leaks.