Question

VPN Question about DNS Leaks and plugging them

Setup ALGO to run on a small server on DO.

Working on locking down DNS Leaks by running terminal checks, flushing DNS Cache, running checks through DNS leak test and whoer.net

Obviously Chrome is out of use because of WebRTC leaks and can’t be shut off, but testing through Safari and Firefox I think DNS is still leaking.

My expectation is that if the server I setup on DO through ALGO is say 111.111.11.111 and my local machines IP is 11.11.11.1 that all traffic would route through the ALGO VPN and no other IP addresses would show up. However, using Firefox and Safari I still see a bunch of DNS show up with addresses like.

74.125.44.132 (which traces to Google) 74.125.19.12 (which traces to Google) 74.125.44.66 (which traces to Google) 74.125.19.2 (which traces to Google) 74.125.19.8 (which traces to Google) 74.125.44.74 (which traces to Google)

If a VPN is working properly the only address that should show up is the one running on ALGO server at the 111.111.11.111 address.

Could this be a plugin that’s leaking? I have HTTPS Everywhere running and a few others? What else could it be?


Submit an answer


This textbox defaults to using Markdown to format your answer.

You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!

Sign In or Sign Up to Answer

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

Kamal Nasser
DigitalOcean Employee
DigitalOcean Employee badge
February 20, 2018
Accepted Answer

It looks like Algo is configuring dnsmasq to relay requests to Google’s DNS servers by default: https://github.com/trailofbits/algo/blob/d8f0393dd8d9a88fe72dec47f0290e9990e9e125/config.cfg#L32

That might be why you’re seeing those IP addresses that are owned by Google. What I would suggest is replacing Google’s DNS resolvers with, for example, OpenDNS’s and seeing what happens then.

I just want to notice, that in terminal mode is hard to use Internet browser. But it’s very helpful to run simple Python script for DNS leak test https://github.com/macvk/dnsleaktest (for instance)

Thanks @kamaln7 . That’s a good catch. I also was playing with all the telemetry settings in Firefox as well. When I did so in one of my tests DNS leaks weren’t happening when I checked using whoer.net another site that looks for leaks though is https://www.dnsleaktest.com/ and that still had the google servers. Apparently Firefox has a lot of telemetry data on by default. I wish it was easier to just turn it all off.

I also caught quite a few plugins that I use that are pinging Google too.

I’ll take your answer and post it to the community issue forum for Algo and see what they say and then update this thread with any response in case anyone else is curious about DNS leaks.

Try DigitalOcean for free

Click below to sign up and get $200 of credit to try our products over 60 days!

Sign up

Get our biweekly newsletter

Sign up for Infrastructure as a Newsletter.

Hollie's Hub for Good

Working on improving health and education, reducing inequality, and spurring economic growth? We'd like to help.

Become a contributor

Get paid to write technical tutorials and select a tech-focused charity to receive a matching donation.

Welcome to the developer cloud

DigitalOcean makes it simple to launch in the cloud and scale up as you grow — whether you're running one virtual machine or ten thousand.

Learn more
DigitalOcean Cloud Control Panel