DNS leaks using OpenVPN client tunnel

[gschmidt]

Express VPN will assign you an RFC1918 Address (an internal IP Address) . E.g. 10.8.0.5 with a Gateway of 10.8.0.1

My VPN Provider (Mullvad) also has a DNS Server listening on 10.8.0.1.

So the DNAT(Port Forward rule) should forward DNS Traffic to 10.8.0.1 and there shouldn't be any leaks anymore.

I have difficulties finding the RFC1918 Address of the expressvpn gateway…
When i use the internal ip-adress I thought was the gateway (see previous attachment), the clients that have to go through the expressvpn tunnel have no internet connection.

Besides that, every time I reboot pfsense or restart the OpenVPN (ExpressVPN) service I get different RFC1918 Addresses.
Is this pfsense or expressvpn responible for the change?

[gcu_greyarea]

I have difficulties finding the RFC1918 Address of the expressvpn gateway…
When i use the internal ip-adress I thought was the gateway (see previous attachment), the clients that have to go through the expressvpn tunnel have no internet connection

The Express VPN Servers may not listen for DNS Requests on the Gateway (10.111.0.21).

Besides that, every time I reboot pfsense or restart the OpenVPN (ExpressVPN) service I get different RFC1918 Addresses.
Is this pfsense or expressvpn responible for the change?

The VPN Server will assign you another IP Address each time you reconnect, similar to a DHCP Server on your LAN.
I hope I wasn't confusing you. The example I provided works with Mullvad VPN.
Mullvad hand to the same Gateway IP Each time.. which Express VPN may not do…

[gcu_greyarea]

Here's an Example of my Config.

• I use 4 VPN Tunnels concurrently.

• Therefore I have 4 Tunnel Gateways, In this example I will use Tunnel Mullvad_AU

• Port Forwarding Rules are used to 'HiJack' DNS Traffic. Here you could use your Own Destination  (85.203.37.1 )
  Once the DNS traffic traverses the VPN Tunnel your VPN Provider will use its own DNS Server (85.203.37.1)

• Manual Outbound NAT is required so your LAN Clients (or Alias) can send Traffic via the Tunnel

• The Firewall Rules "policy route" traffic through the Tunnel Gateway and set the "No Wan Egress" Flag
  The Relevant rules are highlighted in green. For both Rules the Advanced Settings are identical.

• The Floating Outbound Rule ensures that Traffic Marked "No WAN Egress" will get Rejected immediately

[gschmidt]

I have pretty much the same setup…only my LAN firewall rule is over my LAN interface and yours over the VLAN

I notice in the FW_LAN_rules that you also block access to "this firewall" and all Subnets???

What DNS servers have you specified in System/General Setup?
Did you also checked "Disable DNS Forwarder"?
Any DNS Servers specified somewhere else at DHCP Server?


[gcu_greyarea]

I notice in the FW_LAN_rules that you also block access to "this firewall" and all Subnets???

From this VLAN I do not want anybody to be able to connect to the pfSense Webadmin Interface.Therefore I blocked access to "This Firewall".
This is OK because even DNS Requests to 192.168.80.1 would be Forwarded to the DNS Server I specified.

Block Access to all other subnets stops Clients on this VLAN from accessing other VLANS.

What DNS servers have you specified in System/General Setup?

I specified the public DNS Server of Mullvad VPN (193.138.219.228)

https://mullvad.net/en/guides/dns-leaks/

There's always the possibility that your ISP may HiJAck DNS Traffic, but I do not mind. 193.138.219.228 is only used to resolve the Mullvad VPN Serves in order to establish the Tunnel. Also pfSense uses this DNS Server for Updates etc..

Did you also checked "Disable DNS Forwarder"?

I use neither DNS Forwarder nor Resolver on my pfSsense box.

Any DNS Servers specified somewhere else at DHCP Server?

No. The DHCP Server hands out the Gateway Address as DNS Server. There is no DNS Server Listening on my Gateway (LAN IF Address). Instead the Port Forward Rule will forward the DNS Request to the Server I Specified.
With this setup you can manually override DNS Settings on the Client, but DNS Requests will still be forwarded to the DNS Server I specified.

In your DNS Firewall Rule you should also specify the Gateway (ExpressVPN_VPNV4). Right now you are using the default GW (*) which is most likely your WAN GW.

Also double check your NAT Rules.The should be two Outbound NAT Rules which have your LAN as Source NET.

1. Going to the VPN Tunnel IF
2. Going to the WAN IF

[NeoDude]

@gschmidt:

@NeoDude:

Setup an alias for Google DNS servers (8.8.8.8 & 8.8.4.4), or your VPN providers DNS servers, or any ones you want.

Add a port forward on your LAN…

Source Address = Your VPN Hosts Alias
Dest Port = 53 (DNS)
Redirect Target IP = Your DNS Alias created above
Redirect Target Port = DNS

On the corresponding automatically created LAN rule make sure your VPN Gateway is selected in advanced.

Using this method you can add or remove VPN hosts by simply editing your VPN Hosts Alias, without having to mess about with static DNS addresses. Anything in your VPN Hosts alias will use the DNS servers in your alias created above through the VPN tunnel. Everything else will use the DNS resolver or whatever your default is.

And keep the settings in the DNS Resolver (2.4.3) default, or do you have a specific selection of interfaces?

Yep, keep them however you want. It'll only be your non-VPN hosts that'll use the resolver anyways.

I think my way is easier than setting DNS servers via DHCP tbh. My way only involves one step when adding or removing a host from using the VPN. Anything added to the VPNHOSTS alias automatically gets it's DNS requests routed through the tunnel.

[gschmidt]

When I perform an CMD nslookup on the Windows 10 PC (which is member of my ExpressVPN_hosts)
my Expressvpn DNS server address I used in the portfarward rule is shown, so the redirection is working!

but when I perform a dnsleaktest.com, I get all google, opendns or cloudflare servers returned
Why is that?

[NeoDude]

dnsleaktest will show what DNS server is resolving for you. In the case of you using the resolver in PfSense with default settings (not forwarding) it will show your IP address. If you're using an external DNS server (via forwarding or via the VPN tunnel) it will show the IP of the DNS server.

Assuming you're using the settings I suggest and have the PfSense resolver setup not to use forwarding the easiest way to test that your DNS requests are going through the VPN is to run dnsleaktest on a machine that is not a member of your VPN alias. (or temporary remove the one you're using just now). Anything not in the list should show your IP address (assuming UnBound isn't forwarding).

[gschmidt]

@NeoDude:

dnsleaktest will show what DNS server is resolving for you. In the case of you using the resolver in PfSense with default settings (not forwarding) it will show your IP address. If you're using an external DNS server (via forwarding or via the VPN tunnel) it will show the IP of the DNS server.

Assuming you're using the settings I suggest and have the PfSense resolver setup not to use forwarding the easiest way to test that your DNS requests are going through the VPN is to run dnsleaktest on a machine that is not a member of your VPN alias. (or temporary remove the one you're using just now). Anything not in the list should show your IP address (assuming UnBound isn't forwarding).

I have setup the DNS 53 port forwarding to your suggestion (this actually pretty much the same as "gcu_greyarea" has)
It doesn't matter whether I check or uncheck  "Disable DNS Forwarder" in System/General Settings. (Same result in dnsleaktest.com)
It doesn't matter whether I have specified DNS Servers at System/General Settings or not  (Same result in dnsleaktest.com)
I don't have DNS servers specified in the the DHCP/LAN server

With the setup above:
When I perform a dnsleaktest.com on a machine OUTSIDE the "ExpressVPN_Hosts" alias….it returns my ISP ip-address (WAN)....as it should!
When I perform a dnsleaktest.com on a machine INSIDE the "ExpressVPN_Hosts" alias....it returns NOT my ISP ip-address and NOT my ExpressVPN ip-address but a lot of ip-addresses of Google, OpenDNS or Cloudflare DNS servers....

When I perform an NSLOOKUP (nslookup whoami.akamai.net) on a machine INSIDE "ExpressVPN_Hosts" alias, The DNS server I specified in the Port forward rule is shown so the Port forward rule seems to work, however it returns NOT my ISP ip-address and NOT my ExpressVPN ip-address but another ip-address, probably one of the addresses shown when I perform a dnsleaktest.com.

So my question is....is this a leak or not?

[NeoDude]

No, it's not a leak, that all sounds correct. The dnsleaktest isn't supposed to show you where your dns requests are coming FROM, it shows you what server is actually resolving them. Your non VPN clients will be using UnBound to resolve hence why your ISP IP shows up. Your VPN clients will be bypassing UnBound and going out through the tunnel directly to whatever DNS addresses you have set in your alias, hence it is these addresses that show.

If you take unbound out of resolver mode (Services/DNS Resolver and tick "Enable Forwarding Mode") you should see that your non VPN clients will also start showing Google/CloudFlare or whatever you have set up under general.

The surefire way to check is to do a packet capture on port 53 on your VPN interface with level of detail set on high. Load up a webpage on a VPN client. Stop the packet capture and you should be able to confirm by matching the website that your client did indeed send it's DNS request over the tunnel.

[gschmidt]

@NeoDude:

The surefire way to check is to do a packet capture on port 53 on your VPN interface with level of detail set on high. Load up a webpage on a VPN client. Stop the packet capture and you should be able to confirm by matching the website that your client did indeed send it's DNS request over the tunnel.

Diagnostics/Packet Capture seems not to work…the view capture is empty...I have the settings attached.
The host address field is one of the machines going through the EXPRESSVPN interface
Do I have to turn on something else in system or so?


[NeoDude]

That's not going to work because NAT has already taken place by that point. Leave everything as default except the interface set to your VPN gateway, the port set to 53 and detail set to high. That's why I said to use a specific web page and then you can match that page in the packet capture.

[gcu_greyarea]

I would test the following:

Packet Capture on WAN IF , Proto Any , Port 53
Start Capture
Run DNS Leak Test
Stop Capture
What do you see ? Any DNS Servers other than what you have specified in pfense General/DNS Port Forward Rule (used for the tunnel)
No. Then that"s great, no leaks.
Yes. There's a client using DNS Servers other than what you have specified.

Packet Capture on LAN IF , Proto Any , Port 53 , Source: IP of your tunnel client
Start Capture
Run DNS Leak Test
Stop Capture
Which Server does your client contact ?
Only the one you have specified via DHCP. Good.
Other DNS Servers ? Strange, but check if the requests are forwarded through the tunnel (Test 3)

Packet Capture on Express VPN IF, Proto Any , Port 53,  , Source: ANY
Start Capture
Run DNS Leak Test
Stop Capture
Which Destination Servers do you see ?
Only the one you specified in the forwarding rule. Good. No DNS Leak.
Others. Block them via Floating outgoing Rules.

What does this test show you ?
https://www.expressvpn.com/dns-leak-test

Bottom of this page explains various types of leaks:

https://www.expressvpn.com/internet-privacy/expressvpn-leak-testing-tools/

[gschmidt]

I already figured out….I did 2 tests...on the LAN and the EXPRESSVPN interfaces.
During both tests I started a website in the browser with a machine from the ExpressVPN_Hosts alias.
For the Packet Capture on the LAN I typed the ip-address of the machine

The results are attached...I wiped the local ip-address of the machine and virtual ip-address of the ExpressVPN connection. To me it looks OK...

But i find it still strange that with the port forwarding 53 rule all those google,opendns and cloudflare ip's are shown during a leaktest.
and when I use the DNS Resolver (only EXPRESSVPN as outgoing interface, and no DNS servers specified anywhere in pfsense) the leaktest only shows my expressvpn ip-address (which is the only config, according to the "ExpressVPN DNS leak check page", whithout any DNS leak = showing the vpn ip-address)


[gschmidt]

Here the leak test on the ExpressVPN site. (Looks like a Vanilla Leak)

DNS requests go through the VPN tunnel AND go to a third party DNS server
This type of leak is the least severe. The DNS requests will be encrypted all the way to the VPN server, preventing any MitM from eavesdropping and seeing the DNS requests. This makes it effectively impossible to determine which individual sent a given DNS request. However, in a very targeted attack there may be complex methods an attacker could employ to use this to determine information about the sender.

(Note that these descriptions assume that the DNS servers run by the VPN providers are both logless and secure. This is an important aspect of protecting of any VPN provider, but is beyond the scope of this leak case study.)

I also tested on the same PC Windows 10 the WebRTC leak on their site. This gave on this machine a ipv6 leak.
But this machine I only use for testing…The Laptop i am typing on now (when I added it to the VPN_Host alias) did not have this ipv6 WebRTC leak
The PC Window10 has a hidden "Teredo Tunneling Pseudo Interface" which probably is causing the ipv6 WebRTC leak.


[gcu_greyarea]

One thing I noticed in your packet capture is that there are AAAA DNS Requests. Could this be the problem ?

https://en.wikipedia.org/wiki/Teredo_tunneling

In System -> Advanced -> Firewall ->

Do you have this enabled ?  "IPv6 over IPv4 Tunneling"

What happens when you block all IPv6 traffic?

Honestly - I'm fishing in the dark :)

[gschmidt]

What does AAAA mean then?

You mean in System/Advanced/Networking - IPv6 Options?
Nothing checked there…

Maybe the teredo tunneling device is installed because I have setup 2 VPN client software (ExpressVPN and PureVPN) on that machine?

[gcu_greyarea]

AAAA is an IPv6 DNS Request. Perhaps these AAAA Requests are sent through the tunnel or out the WAN Interface…

The way I understand it is that Windows 10 could send IPv6 DNS Requests via the Teredo Tunnel (which tunnels IPv6 over IPv4), hence causing the DNS Leaks.

The firewall rules and port forward rules in pfSense may not catch that traffic and fail to policy route it via the tunnel...

You mentioned ExpressVPN and PureVPN Client Software on your Win10 machine ?  Are you trying to tunnel inside the pfSense ovpnclient ? Or is that just a "fallback" option ?

[gschmidt]

This Packet Capture is from my LAPTOP which I temporarily put in the ExpressVPN_Host alias.
This A DNS instead of AAAA DNS
Also in the WebRTC test…OK

But a ExpressVPN DNS leak test also shows ip-addresses from Google, OpenDNS or Cloudflare

[gschmidt]

Well that explains the AAAA DNS request…The teredo tunnel device may be the WebRTC leak problem

@gcu_greyarea:

You mentioned ExpressVPN and PureVPN Client Software on your Win10 machine ?  Are you trying to tunnel inside the pfSense ovpnclient ? Or is that just a "fallback" option ?

No, before I started with pfsense, I was already playing around with VPN.
18 months ago I started with a cheap purevpn account…which I forgot to stop..so I have it till december 2018.
expressvpn I have since december 2017...for testing I installed the vpn client windows software of both providers on the machine I am using now to test pfsense.
This may be the reason why the teredo tunneling device is present (hidden)

Oh, by the way...when I perform a Packet Capture on the WAN port 53 with my laptop (temporarily added to the VPN_Host alias), nothing happens