DNS leaks using OpenVPN client tunnel
-
AAAA is an IPv6 DNS Request. Perhaps these AAAA Requests are sent through the tunnel or out the WAN Interface…
The way I understand it is that Windows 10 could send IPv6 DNS Requests via the Teredo Tunnel (which tunnels IPv6 over IPv4), hence causing the DNS Leaks.
The firewall rules and port forward rules in pfSense may not catch that traffic and fail to policy route it via the tunnel...
You mentioned ExpressVPN and PureVPN Client Software on your Win10 machine ? Are you trying to tunnel inside the pfSense ovpnclient ? Or is that just a "fallback" option ?
-
This Packet Capture is from my LAPTOP which I temporarily put in the ExpressVPN_Host alias.
This A DNS instead of AAAA DNS
Also in the WebRTC test…OKBut a ExpressVPN DNS leak test also shows ip-addresses from Google, OpenDNS or Cloudflare
-
Well that explains the AAAA DNS request…The teredo tunnel device may be the WebRTC leak problem
You mentioned ExpressVPN and PureVPN Client Software on your Win10 machine ? Are you trying to tunnel inside the pfSense ovpnclient ? Or is that just a "fallback" option ?
No, before I started with pfsense, I was already playing around with VPN.
18 months ago I started with a cheap purevpn account…which I forgot to stop..so I have it till december 2018.
expressvpn I have since december 2017...for testing I installed the vpn client windows software of both providers on the machine I am using now to test pfsense.
This may be the reason why the teredo tunneling device is present (hidden)Oh, by the way...when I perform a Packet Capture on the WAN port 53 with my laptop (temporarily added to the VPN_Host alias), nothing happens
-
But i find it still strange that with the port forwarding 53 rule all those google,opendns and cloudflare ip's are shown during a leaktest.
and when I use the DNS Resolver (only EXPRESSVPN as outgoing interface, and no DNS servers specified anywhere in pfsense) the leaktest only shows my expressvpn ip-address (which is the only config, according to the "ExpressVPN DNS leak check page", whithout any DNS leak = showing the vpn ip-address)What's strange about it? This is exactly what you would expect.
With port forwarding it's the Google, OpenDNS an CloudFlare servers that are resolving your requests.
When using UnBound via your ExpressVPN it's your PfSense box that's resolving DNS requests using your VPN interface.
That's exactly what the leaktest is showing.
People seem to misunderstand what an online leaktest shows. It doesn't show where the DNS requests come from, it shows what server is resolving them.
-
Hmmm I thought that the dnsleaktest pict. I showed in « Reply #35 on: April 03, 2018, 05:12:11 pm » on page 3 was what You would expect…showing only the assigned ip-address of the vpn provider, which also is possible with a certain pfsense setup.
-
Hmmm I thought that the dnsleaktest pict. I showed in « Reply #35 on: April 03, 2018, 05:12:11 pm » on page 3 was what You would expect…showing only the assigned ip-address of the vpn provider, which also is possible with a certain pfsense setup.
That will only happen when you are using PfSense to resolve DNS via the VPN. If you're forwarding DNS it will show whatever servers you're forwarding to, doesn't mean it's not using the VPN though.
-
Ok thanx for the help man, I spend a lot of time getting into this….in the end it worked already 2 weeks ago whitout knowing!
-
Oh, one more thing…what if i want to install pfblocker? Would there be any issues with the current policy based openvpn client routing I have?
-
@gschmidt i stumbled upon this and while youve seem to have had your issue solved, i found two solutions within the several hours i was trying to fix this leak.
one way is to use cmd in windows and using openvpn community edition cmd line interface to use"path to ovpn gui exe, keep quotations" --config "path to ovpn file to use, keep quotations" --block-outside-dns
pauseOR
change all dns to google or cloudflare dns in network connections
you can use this software to do it automatically instead of manually
https://www.sordum.org/9432/dns-lock-v1-5/
