Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    DNS leaks using OpenVPN client tunnel

    Scheduled Pinned Locked Moved OpenVPN
    69 Posts 7 Posters 23.7k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • G
      gschmidt
      last edited by

      Here the leak test on the ExpressVPN site. (Looks like a Vanilla Leak)

      DNS requests go through the VPN tunnel AND go to a third party DNS server
      This type of leak is the least severe. The DNS requests will be encrypted all the way to the VPN server, preventing any MitM from eavesdropping and seeing the DNS requests. This makes it effectively impossible to determine which individual sent a given DNS request. However, in a very targeted attack there may be complex methods an attacker could employ to use this to determine information about the sender.

      (Note that these descriptions assume that the DNS servers run by the VPN providers are both logless and secure. This is an important aspect of protecting of any VPN provider, but is beyond the scope of this leak case study.)

      I also tested on the same PC Windows 10 the WebRTC leak on their site. This gave on this machine a ipv6 leak.
      But this machine I only use for testing…The Laptop i am typing on now (when I added it to the VPN_Host alias) did not have this ipv6 WebRTC leak
      The PC Window10 has a hidden "Teredo Tunneling Pseudo Interface" which probably is causing the ipv6 WebRTC leak.

      ![ExpressVPN Leak Test.JPG](/public/imported_attachments/1/ExpressVPN Leak Test.JPG)
      ![ExpressVPN Leak Test.JPG_thumb](/public/imported_attachments/1/ExpressVPN Leak Test.JPG_thumb)

      1 Reply Last reply Reply Quote 0
      • G
        gcu_greyarea
        last edited by

        One thing I noticed in your packet capture is that there are AAAA DNS Requests. Could this be the problem ?

        https://en.wikipedia.org/wiki/Teredo_tunneling

        In System -> Advanced -> Firewall ->

        Do you have this enabled ?  "IPv6 over IPv4 Tunneling"

        What happens when you block all IPv6 traffic?

        Honestly - I'm fishing in the dark :)

        1 Reply Last reply Reply Quote 0
        • G
          gschmidt
          last edited by

          What does AAAA mean then?

          You mean in System/Advanced/Networking - IPv6 Options?
          Nothing checked there…

          Maybe the teredo tunneling device is installed because I have setup 2 VPN client software (ExpressVPN and PureVPN) on that machine?

          1 Reply Last reply Reply Quote 0
          • G
            gcu_greyarea
            last edited by

            AAAA is an IPv6 DNS Request. Perhaps these AAAA Requests are sent through the tunnel or out the WAN Interface…

            The way I understand it is that Windows 10 could send IPv6 DNS Requests via the Teredo Tunnel (which tunnels IPv6 over IPv4), hence causing the DNS Leaks.

            The firewall rules and port forward rules in pfSense may not catch that traffic and fail to policy route it via the tunnel...

            You mentioned ExpressVPN and PureVPN Client Software on your Win10 machine ?  Are you trying to tunnel inside the pfSense ovpnclient ? Or is that just a "fallback" option ?

            1 Reply Last reply Reply Quote 0
            • G
              gschmidt
              last edited by

              This Packet Capture is from my LAPTOP which I temporarily put in the ExpressVPN_Host alias.
              This A DNS instead of AAAA DNS
              Also in the WebRTC test…OK

              But a ExpressVPN DNS leak test also shows ip-addresses from Google, OpenDNS or Cloudflare

              Knipsel.JPG
              Knipsel.JPG_thumb
              WebRTC.JPG
              WebRTC.JPG_thumb

              1 Reply Last reply Reply Quote 0
              • G
                gschmidt
                last edited by

                Well that explains the AAAA DNS request…The teredo tunnel device may be the WebRTC leak problem

                @gcu_greyarea:

                You mentioned ExpressVPN and PureVPN Client Software on your Win10 machine ?  Are you trying to tunnel inside the pfSense ovpnclient ? Or is that just a "fallback" option ?

                No, before I started with pfsense, I was already playing around with VPN.
                18 months ago I started with a cheap purevpn account…which I forgot to stop..so I have it till december 2018.
                expressvpn I have since december 2017...for testing I installed the vpn client windows software of both providers on the machine I am using now to test pfsense.
                This may be the reason why the teredo tunneling device is present (hidden)

                Oh, by the way...when I perform a Packet Capture on the WAN port 53 with my laptop (temporarily added to the VPN_Host alias), nothing happens

                1 Reply Last reply Reply Quote 0
                • NeoDudeN
                  NeoDude
                  last edited by

                  @gschmidt:

                  But i find it still strange that with the port forwarding 53 rule all those google,opendns and cloudflare ip's are shown during a leaktest.
                  and when I use the DNS Resolver (only EXPRESSVPN as outgoing interface, and no DNS servers specified anywhere in pfsense) the leaktest only shows my expressvpn ip-address (which is the only config, according to the "ExpressVPN DNS leak check page", whithout any DNS leak = showing the vpn ip-address)

                  What's strange about it? This is exactly what you would expect.

                  With port forwarding it's the Google, OpenDNS an CloudFlare servers that are resolving your requests.

                  When using UnBound via your ExpressVPN it's your PfSense box that's resolving DNS requests using your VPN interface.

                  That's exactly what the leaktest is showing.

                  People seem to misunderstand what an online leaktest shows. It doesn't show where the DNS requests come from, it shows what server is resolving them.

                  Home Server "Gandalf":  unRAID Pro 6 | MB**:**  ASUS Z9PE-D8 WS | CPU:  Dual Xeon E5-2670 | RAM:  64GB Crucial PC-1600 ECC

                  1 Reply Last reply Reply Quote 0
                  • G
                    gschmidt
                    last edited by

                    Hmmm I thought that the dnsleaktest pict. I showed in « Reply #35 on: April 03, 2018, 05:12:11 pm » on page 3 was what You would expect…showing only the assigned ip-address of the vpn provider, which also is possible with a certain pfsense setup.

                    1 Reply Last reply Reply Quote 0
                    • NeoDudeN
                      NeoDude
                      last edited by

                      @gschmidt:

                      Hmmm I thought that the dnsleaktest pict. I showed in « Reply #35 on: April 03, 2018, 05:12:11 pm » on page 3 was what You would expect…showing only the assigned ip-address of the vpn provider, which also is possible with a certain pfsense setup.

                      That will only happen when you are using PfSense to resolve DNS via the VPN. If you're forwarding DNS it will show whatever servers you're forwarding to, doesn't mean it's not using the VPN though.

                      Home Server "Gandalf":  unRAID Pro 6 | MB**:**  ASUS Z9PE-D8 WS | CPU:  Dual Xeon E5-2670 | RAM:  64GB Crucial PC-1600 ECC

                      1 Reply Last reply Reply Quote 0
                      • G
                        gschmidt
                        last edited by

                        Ok thanx for the help man, I spend a lot of time getting into this….in the end it worked already 2 weeks ago whitout knowing!

                        1 Reply Last reply Reply Quote 0
                        • G
                          gschmidt
                          last edited by

                          Oh, one more thing…what if i want to install pfblocker? Would there be any issues with the current policy based openvpn client routing I have?

                          1 Reply Last reply Reply Quote 0
                          • T
                            TallTacoTristan @gschmidt
                            last edited by

                            @gschmidt i stumbled upon this and while youve seem to have had your issue solved, i found two solutions within the several hours i was trying to fix this leak.
                            one way is to use cmd in windows and using openvpn community edition cmd line interface to use

                            "path to ovpn gui exe, keep quotations" --config "path to ovpn file to use, keep quotations" --block-outside-dns
                            pause

                            OR
                            change all dns to google or cloudflare dns in network connections
                            you can use this software to do it automatically instead of manually
                            https://www.sordum.org/9432/dns-lock-v1-5/

                            1 Reply Last reply Reply Quote 0
                            • First post
                              Last post
                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.