Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

VPN DNS leak test

dnsleaktest.com

Post reply on HN
Print view View original

21–30 of 46 posts

Re: VPN DNS leak test

#21

Post by simcop2387 »

ploggingdev wrote: post #7
ehPReth wrote: post #4

This is also a handy way to see if your outbound DNS requests are being hijacked and sent to another resolver instead of your chosen ones. One router I tested redirected everything to OpenDNS if parental controls were in use, some networks redirect everything to their internal resolvers, etc. Mainly for interest purposes/spotting configuration mistakes than anything else.

There's a page about transparent DNS proxies [0] on the same site. They also have a page about how to fix dns leaks when using OpenVPN [1]. One way to ensure that DNS responses have not been tampered with is to use DNSCrypt [2]. Can someone confirm that I understand this correctly : if I don't use DNSCrypt and if my DNS responses are tampered with in a phishing attempt, on a site that uses https, the browser will rai…

Not just http, any unencrypted channel is vulnerable to this. So SMTP or pop without encryption would also let someone into your email.

Re: VPN DNS leak test

#22

Post by QasimK »

the8472 wrote: post #16
Klathmon wrote: post #11

Why is a software VPN so difficult to get right? Why are so many of them so poor, or miss certain protocols, or have so many leaks? Casting aside actual "vulnerabilities" (like buffer overflows, bad encryption, etc...), why can't a software VPN act just like a hardware VPN? Take every byte of traffic sent to a network device, and tunnel it to another endpoint? I'm assuming there are several major reasons that I don't…

It does not even have to be that difficult these days. Create VPN, spin up network namespace, move tunnel interface to network namespace, start resolver in that namespace, start VPN'ed applications in that namespace. if-up scripts for OpenVPN can do this for you[0]. As long as you operate the tunnel interface and the genuine network interface side by side some applications may simply decide to ignore default routes a…

I was recently exploring this case, where you accurately isolate particular applications to using a VPN. The best guide I found was this one (https://coldfix.eu/2017/01/29/vpn-box/) which goes into more depth and looks at alternative approaches as well.

Re: VPN DNS leak test

#23

Post by metalliqaz »

kibwen wrote: post #12

It would appear that Firefox's built-in SOCKS support successfully proxies DNS as well, though I've always wondered whether or not there aren't other ways to leak your IP via browser APIs. I imagine that Flash almost certainly would, and I wouldn't be surprised if WebRTC does somehow.

Yeah, but you have to set "socks_remote_dns" to "True" in about:config, which is not the default.

Re: VPN DNS leak test

#24

Post by JetSpiegel »

Klathmon wrote: post #11

Why is a software VPN so difficult to get right? Why are so many of them so poor, or miss certain protocols, or have so many leaks? Casting aside actual "vulnerabilities" (like buffer overflows, bad encryption, etc...), why can't a software VPN act just like a hardware VPN? Take every byte of traffic sent to a network device, and tunnel it to another endpoint? I'm assuming there are several major reasons that I don't…

"Software VPN" such as OpenVPN has two main use cases fighting each other.

The usage you mention is the roadwarrior, where the physical network is untrusted and you want to route all traffic through the server. This is what commercial VPN providers provide.

The other use case is routing a set of domains though the tunnel, since the local network is trusted. This is useful when you are at home with your personal computer and want to access the work's LAN, but still want YouTube or large traffic to keep going through the local network. Since you are not exclusively bound to an uplink, you can have multiple VPN of this type connected that "expose" different sets of domains. This is possible if you dig through docs, since everyone and their mother are trying to do the other kind.

Re: VPN DNS leak test

#25

Post by jwilk »

metalliqaz wrote: post #23
kibwen wrote: post #12

It would appear that Firefox's built-in SOCKS support successfully proxies DNS as well, though I've always wondered whether or not there aren't other ways to leak your IP via browser APIs. I imagine that Flash almost certainly would, and I wouldn't be surprised if WebRTC does somehow.

Yeah, but you have to set "socks_remote_dns" to "True" in about:config, which is not the default.

At least in Firefox 52 ESR there's UI to enable that (so no need to fiddle with about:config):

Edit → Preferences → Network → Settings → Proxy DNS when using Socks v5

But yeah, it's not the default. :\

Re: VPN DNS leak test

#26

Post by mirimir »

dylz wrote: post #13
Klathmon wrote: post #11

Why is a software VPN so difficult to get right? Why are so many of them so poor, or miss certain protocols, or have so many leaks? Casting aside actual "vulnerabilities" (like buffer overflows, bad encryption, etc...), why can't a software VPN act just like a hardware VPN? Take every byte of traffic sent to a network device, and tunnel it to another endpoint? I'm assuming there are several major reasons that I don't…

Software VPN managing all routes is perfectly fine to network traffic. The network traffic is totally taken. The problem here is OTHER SOFTWARE running on the computer that also has visibility into the OS. For example, browsers with p2p connections will enumerate all network interfaces - including your actual adapter's IP

Yes, and neither routing nor firewall rules will prevent that.

The simplest solution is working in VMs, with a VPN client running in the host. VMs have only virtual/internal and VPN IPs, so there's nothing sensitive to leak. Or you can use pfSense VMs as VPN gateways. Indeed, you can use a few of them, to create nested VPN chains. Also Whonix, for Tor connectivity.

Re: VPN DNS leak test

#28

Post by gambiting »

pbhjpbhj wrote: post #9
diggan wrote: post #8

Earlier quoted context omitted.

Well, not always or not always like that. For example, I use VPN so I can achieve my true download speed when downloading from Steam, since my ISP limits to download speed in that case.

Which country, which ISP, please?

I'm not OP, but the same thing happens to me - UK, Virgin Media, even on their highest tier truly unlimited 200mbps bundle. Steam will start downloading at close to 20MB/s and then slow down after 10-15 minutes. When connected via VPN it runs at full speed all the time.

Re: VPN DNS leak test

#29

Post by Yxogenium »

And this issue could be easily overcome if more projects implemented the "socks5h://" protocol (note the 'h'), initially introduced by curl[1] to mandate the SOCKS proxy to also tunnel DNS requests. Sadly it seems that very few programs recognize this (non-standard) protocol: git[2] (using curl), python's request (and urllib) module[3] ... And not much else.

[1]: https://curl.haxx.se/docs/manpage.html#--proxy [2]: https://github.com/git/git/blob/20fed7cad40ed0b96232feb82812... [3]: http://docs.python-requests.org/en/master/user/advanced/#soc...

Re: VPN DNS leak test

#30

Post by Izmaki »

The test works fine on my iPhone but as soon as I try it on my PC connected through Viscosity it's stuck seemlingly forever. I killed it after a few minutes. Upon disconnecting it's all good and fast. What could I be doing wrong here?
Post reply on HN