DNS leaks using OpenVPN client tunnel

gschmidt · Apr 3, 2018, 8:01 PM

Right!…I changed the order...but still...leaking Google and OpenDNS (which i did not specify anywhere in pfsense)

NAT-02.jpg = NAT Redirection of ExpressVPN DNS servers

Result= dnsleaktest.jpg

Derelict · Apr 3, 2018, 8:06 PM

WHAT DNS SERVERS ARE YOUR CLIENTS SET TO USE?

DNS is NOT this hard, people.

With your rules like that, the express_vpn_dns servers will be queried using the default gateway, NOT the VPN, unless you have redirect gateway for the VPN itself.

strangegopher · Apr 3, 2018, 8:10 PM

@gschmidt:

I have specified the Google servers at System/General Setup/DNS Server Settings

No need to do this as unbound by default uses root servers for dns, so no need for dns forwarding.
If you want you can remove all the dns servers from this section and dns will still work.

above or under which rule should your "I am also blocking any access to dns server on the firewall" rule be located?

Sorry I posted the wrong image.
This is what the dns rule should look like:
(above all other rules in your case [except anti-lockout])
Action: Block
Protocol: IPv4 TCP/UDP
Source: ExpressVPN_Hosts
Src Port: Any
Destination: This Firewall
Dst Port: 53 (DNS)

That will block access to firewall's dns server.

Now you will have to to do to is go to:
Services/DHCP Server/LAN
and Under DNS Servers add dns server of your choice (like google dns).

Also like Derelict mentioned you can remove the 2nd rule of NAT redirection to expressvpn.
And any other port forwarding rules u created under Firewall -> Nat.

gschmidt · Apr 3, 2018, 8:15 PM

On the static DHCP mappings in pfSense (which is my main router): Empty
On client 1 (Window 10 PC): automatically (which is the gateway 192.168.1.1)
On client 2 (linux device): 192.168.1.1

strangegopher · Apr 3, 2018, 8:20 PM

Do you not see this under Services/DHCP Server/LAN?

Derelict · Apr 3, 2018, 8:40 PM

That DOES NOT MEAN that you do not have static DNS servers on the client you are testing, bro.

This really is. not. that. hard.

gschmidt · Apr 3, 2018, 8:44 PM

Ok….I have created the rule =Block rule.jpg
Added the google dns servers = "DHCP Server DNS Server.jpg"
and the ExpressVPN DNS servers = Static DHCP Mapping.jpg"

dnsleaktest result= dnsleaktest.jpg

:o

![Block Rule.JPG](/public/imported_attachments/1/Block Rule.JPG)
![Block Rule.JPG_thumb](/public/imported_attachments/1/Block Rule.JPG_thumb)
![DHCP Server DNS Server.JPG](/public/imported_attachments/1/DHCP Server DNS Server.JPG)
![DHCP Server DNS Server.JPG_thumb](/public/imported_attachments/1/DHCP Server DNS Server.JPG_thumb)
![Static DHCP Mapping.JPG](/public/imported_attachments/1/Static DHCP Mapping.JPG)
![Static DHCP Mapping.JPG_thumb](/public/imported_attachments/1/Static DHCP Mapping.JPG_thumb)

gschmidt · Apr 3, 2018, 8:54 PM

I did an nslookup at the client W10 PC
Which shows the DNS server of ExpressVPN
Which I entered in the Static Mapping DNS servers in pfSense

strangegopher · Apr 3, 2018, 9:12 PM

try removing the ExpressVPN DNS servers from Static DHCP Mapping and replacing it with 8.8.8.8 and 8.8.4.4

Derelict · Apr 3, 2018, 9:22 PM

It doesn't matter where anything is configured. What are the DNS servers configured on the client. Use ipconfig /all

Hell, if you're having this much trouble, configure them statically.

gschmidt · Apr 3, 2018, 9:33 PM

ipconfig /all

I dont see static dns servers?
Only the express vpn dns servers i have specified in pfsense

strangegopher · Apr 3, 2018, 9:43 PM

my guess is expressvpn dns servers might be the issue, so try using 8.8.8.8 in windows go to Control Panel\Network and Internet\Network Connections right click your interface, select properties, double click "Internet Protocol Version 4", select "Use Following DNS server addresses" and enter 8.8.8.8 and 8.8.4.4

and run dns leak test again

gschmidt · Apr 3, 2018, 9:48 PM

@strangegopher:

try removing the ExpressVPN DNS servers from Static DHCP Mapping and replacing it with 8.8.8.8 and 8.8.4.4

Check!…Still leaking Google and openDNS servers....looks exact the same as with the NAT redirection of port 53
I just did a default pfsense 2.4.2 setup (update to 2.4.3), nothing special

strangegopher · Apr 3, 2018, 10:00 PM

Well I am out of ideas then. I don't know what could be going wrong.

Derelict · Apr 3, 2018, 10:11 PM

What matters is that they are not coming from YOU. You cannot control where the resolvers you query go to get their information. If the resolvers you query don't do what you like, use different resolvers.

gschmidt · Apr 3, 2018, 10:12 PM

@strangegopher:

Well I am out of ideas then. I don't know what could be going wrong.

Look now I have removed the DNS servers at System/General Setup
And in DNS Resolver i set (see picture)
In DHCP Server all DNS Servers are empty
Also Clients have no DNS specified
Your rule (stopped temporarily)

See dnsleaktest pic!

![DNS Resolver.JPG](/public/imported_attachments/1/DNS Resolver.JPG)
![DNS Resolver.JPG_thumb](/public/imported_attachments/1/DNS Resolver.JPG_thumb)

gschmidt · Apr 3, 2018, 10:15 PM

But with this setup, all my network clients use the EXPRESSVPN interface….so if this interface is down...no internet for all

strangegopher · Apr 3, 2018, 10:22 PM

you can try setting the outgoing interface in dns to WAN and try with dhcp settings and firewall rule again and see if that works.

gschmidt · Apr 3, 2018, 10:22 PM

@Derelict:

What matters is that they are not coming from YOU. You cannot control where the resolvers you query go to get their information. If the resolvers you query don't do what you like, use different resolvers.

….my knowledge is not that fancy of pfsense I admit...but i knew that my clients did NOT have static dns servers
On a simple modem with OPENWRT this was a piece of cake....on their forum they helped instead of shouting

gschmidt · Apr 3, 2018, 10:24 PM

@strangegopher:

you can try setting the outgoing interface in dns to WAN and try with dhcp settings and firewall rule again and see if that works.

Thanx man for your help sofar, I will try tomorrow…have to get some sleep now...ciao!