Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

VPN DNS leak test

dnsleaktest.com

Post reply on HN
Print view View original

31–40 of 46 posts

Re: VPN DNS leak test

#31

Post by pedrocr »

Yxogenium wrote: post #29

And this issue could be easily overcome if more projects implemented the "socks5h://" protocol (note the 'h'), initially introduced by curl[1] to mandate the SOCKS proxy to also tunnel DNS requests. Sadly it seems that very few programs recognize this (non-standard) protocol: git[2] (using curl), python's request (and urllib) module[3] ... And not much else. [1]: https://curl.haxx.se/docs/manpage.html#--proxy [2]: ht…

Firefox over a SOCKS5 proxy done with ssh passes this test if you enable the proxy DNS setting. Creating the proxy is as simple as:

  ssh -D 9999 -q -N
and then configure that in the firefox proxy settings (socks to localhost:9999). If you want a simple way to enable/disable this in firefox I built a minimal extension to do it:

https://addons.mozilla.org/en-US/firefox/addon/proxyswitcher...

The defaults in the config already match that ssh line so all you need to do is press the globe button to enable the proxy.

Re: VPN DNS leak test

#32

Post by exikyut »

I'm really really interested to find out how they're discovering the DNS server IP addresses I'm using.

The only clue I have is that they're trying to resolve a bunch of fake domain names (which show up as unresolveable in the console).

The webpage has the IP addresses written directly into it (so clearly the data came from the server) which means there's nothing I can investigate (eg, in JS) from my end.

What's going on?

Re: VPN DNS leak test

#33

Post by Viper007Bond »

exikyut wrote: post #32

I'm really really interested to find out how they're discovering the DNS server IP addresses I'm using. The only clue I have is that they're trying to resolve a bunch of fake domain names (which show up as unresolveable in the console). The webpage has the IP addresses written directly into it (so clearly the data came from the server) which means there's nothing I can investigate (eg, in JS) from my end. What's goin…

"The DNS leak test works by sending your client a series of domain names to resolve within a specific test domain. Each request is sent from your client to your configured DNS server. Even if you have configured a single DNS server, there may be many other servers that the request is passed on to in order to be resolved (normally to load balance the requests). For example if you configure Google DNS then you will often find 6-10 Google DNS servers which are fullfilling the DNS requests."

via https://www.dnsleaktest.com/what-is-the-difference.html

Basically it's sending you unique subdomains and then in turn seeing what IP addresses DNS requests come from. Since the subdomains are tied to you, it can tie the requests from the DNS servers you're using back to you.

Re: VPN DNS leak test

#34

Post by diggan »

pbhjpbhj wrote: post #9
diggan wrote: post #8

Earlier quoted context omitted.

Well, not always or not always like that. For example, I use VPN so I can achieve my true download speed when downloading from Steam, since my ISP limits to download speed in that case.

Which country, which ISP, please?

Spain, Jazztel

Re: VPN DNS leak test

#35

Post by diggan »

gambiting wrote: post #28
pbhjpbhj wrote: post #9

Earlier quoted context omitted.

Which country, which ISP, please?

I'm not OP, but the same thing happens to me - UK, Virgin Media, even on their highest tier truly unlimited 200mbps bundle. Steam will start downloading at close to 20MB/s and then slow down after 10-15 minutes. When connected via VPN it runs at full speed all the time.

Similar speeds here but works differently. Mine just gets throttled to ~2.5MB/s from start until I turn my VPN on, then I get my correct 20MB/s.

Re: VPN DNS leak test

#36

Post by pwdisswordfish2 »

magnat wrote: post #14
Klathmon wrote: post #11

Why is a software VPN so difficult to get right? Why are so many of them so poor, or miss certain protocols, or have so many leaks? Casting aside actual "vulnerabilities" (like buffer overflows, bad encryption, etc...), why can't a software VPN act just like a hardware VPN? Take every byte of traffic sent to a network device, and tunnel it to another endpoint? I'm assuming there are several major reasons that I don't…

> Take every byte of traffic sent to a network device, and tunnel it to another endpoint? You have to set up routing tables to decide which interface to use for which destination address. Obviously you can't direct VPN packets via VPN - that would be circular. They have to use your normal, physical connection to get to your default gateway. But what if your default gateway is also a local DNS server? You can't differ…

"You have to set up routing tables..."

Not true if using an overlay at layer 2. I use one. In case of any doubt, I am not referring to OpenVPN, OpenSSH or any other software mentioned on HN.

The "VPN" interface (/dev/tap) can be assigned an RFC 1918 non-routable IP address. To software, it looks like an "internal network".

The user wanting to run servers over the "VPN" binds those servers to the tap interface's IP address when she starts them.

VPN is in quotes because what I am using allows users on the private network to connect to each other without going through a "VPN gateway". With a VPN there is usually a "gateway" computer that each user must connect to in order to reach the other users.

Re: VPN DNS leak test

#37

Post by snowpanda »

pedrocr wrote: post #31
Yxogenium wrote: post #29

And this issue could be easily overcome if more projects implemented the "socks5h://" protocol (note the 'h'), initially introduced by curl[1] to mandate the SOCKS proxy to also tunnel DNS requests. Sadly it seems that very few programs recognize this (non-standard) protocol: git[2] (using curl), python's request (and urllib) module[3] ... And not much else. [1]: https://curl.haxx.se/docs/manpage.html#--proxy [2]: ht…

Firefox over a SOCKS5 proxy done with ssh passes this test if you enable the proxy DNS setting. Creating the proxy is as simple as: ssh -D 9999 -q -N and then configure that in the firefox proxy settings (socks to localhost:9999). If you want a simple way to enable/disable this in firefox I built a minimal extension to do it: https://addons.mozilla.org/en-US/firefox/addon/proxyswitcher... The defaults in the config a…

You might be the right person to ask:

When I tried shadowsocks and enabled "proxy dns" in Firefox, every website became painfully slow. Is this simply because no DNS cache had been built?

Re: VPN DNS leak test

#40

Post by clairity »

Viper007Bond wrote: post #33
exikyut wrote: post #32

I'm really really interested to find out how they're discovering the DNS server IP addresses I'm using. The only clue I have is that they're trying to resolve a bunch of fake domain names (which show up as unresolveable in the console). The webpage has the IP addresses written directly into it (so clearly the data came from the server) which means there's nothing I can investigate (eg, in JS) from my end. What's goin…

"The DNS leak test works by sending your client a series of domain names to resolve within a specific test domain. Each request is sent from your client to your configured DNS server. Even if you have configured a single DNS server, there may be many other servers that the request is passed on to in order to be resolved (normally to load balance the requests). For example if you configure Google DNS then you will oft…

friendly reminder not to use google DNS if you care about privacy (which you probably do if you're using a VPN in the first place), because you're basically giving them your fingerprint in the form of the websites you visit.
Post reply on HN