How to Prevent DNS Leaks on OpenVPN

OpenVPN Setup (Windows)​

OpenVPN Setup (Linux)​

Steps to Prevent DNS Leaks on Linux​

1. Install openresolv:
   

• sudo apt install openresolv<br>
  This package helps to automatically update DNS servers.
• Install Up and Down Scripts: Download the “update-resolv-conf” script, which manages DNS settings when the OpenVPN connection is established or terminated.
• Add Script to OpenVPN Config: Include the following lines in your OpenVPN configuration file:
  

1. script-security 2 # Allows script execution<br>up /etc/openvpn/update-resolv-conf<br>down /etc/openvpn/update-resolv-conf<br>
   With these steps, your DNS settings will automatically update when you connect to or disconnect from the VPN, blocking DNS requests outside the VPN tunnel and minimizing leak risks.

Testing for DNS Leaks​

LWsystem said:

Using a VPN encrypts your internet traffic, safeguarding your privacy. However, even with a VPN, DNS leaks can still jeopardize your security. Wondering what a DNS leak is and why it’s important? A DNS leak happens when your DNS requests still reach your ISP’s DNS servers instead of going through your VPN tunnel. This means your ISP can still track which sites you’re visiting, even though the rest of your traffic is encrypted via VPN.

Here, we’ll cover how to prevent DNS leaks specifically with OpenVPN and explain setup techniques for different operating systems.

What’s a DNS Leak?

DNS (Domain Name System) is what translates website names into IP addresses, and usually, your ISP handles these DNS requests. When you’re not using a VPN, all your DNS requests go to your ISP’s DNS servers, allowing them to see your browsing history. A VPN, though, is supposed to route these requests through the VPN tunnel, stopping outsiders from spying on what you’re browsing.

But if your VPN setup isn’t configured correctly, DNS requests can “leak” out of the VPN tunnel. In this case, even if your web traffic is encrypted, your ISP or malicious actors could still monitor your DNS queries and track your online activity. That’s why preventing DNS leaks is crucial when using a VPN.

DNS Leak Issue with OpenVPN

OpenVPN is a widely used VPN protocol known for its security. However, if your OpenVPN setup isn’t properly configured, you might still experience DNS leaks. This issue can require different approaches depending on your operating system, be it Windows, Linux, or macOS.

We’ll walk you through steps to prevent DNS leaks on Windows and Linux systems below.

OpenVPN Setup (Windows)​

On Windows, here’s a basic OpenVPN configuration example with options to prevent DNS leaks:




client<br>proto udp<br>explicit-exit-notify<br>remote &lt;ip&gt; 1194<br>dev tun<br>resolv-retry infinite<br>nobind<br>persist-key<br>persist-tun<br>remote-cert-tls server<br>verify-x509-name server name<br>auth SHA256<br>auth-nocache<br>cipher AES-128-GCM<br>tls-client<br>tls-version-min 1.2<br>tls-cipher TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256<br>ignore-unknown-option block-outside-dns<br>setenv opt block-outside-dns # Prevents DNS leaks on Windows 10+<br>verb 3<br>
Explanation: The block-outside-dns option is available on Windows 10 and later. This option stops other network adapters from accessing DNS servers outside the VPN connection. Using Windows Filtering Platform (WFP), it restricts applications from accessing DNS over TCP or UDP port 53, ensuring all DNS queries go through the VPN tunnel.

This setup is quite effective on Windows-based systems. However, this option doesn’t work by default on Linux or macOS since they lack a built-in filtering mechanism like Windows.

OpenVPN Setup (Linux)​

To prevent DNS leaks on Linux, you’ll need to take some extra steps. Unlike Windows, OpenVPN doesn’t automatically manage DNS settings on Linux, so you’ll have to control them manually with scripts.

Steps to Prevent DNS Leaks on Linux​

1. Install openresolv:

• sudo apt install openresolv<br>
  This package helps to automatically update DNS servers.
• Install Up and Down Scripts: Download the “update-resolv-conf” script, which manages DNS settings when the OpenVPN connection is established or terminated.
• Add Script to OpenVPN Config: Include the following lines in your OpenVPN configuration file:

1. script-security 2 # Allows script execution<br>up /etc/openvpn/update-resolv-conf<br>down /etc/openvpn/update-resolv-conf<br>
   With these steps, your DNS settings will automatically update when you connect to or disconnect from the VPN, blocking DNS requests outside the VPN tunnel and minimizing leak risks.

Testing for DNS Leaks​

To check for DNS leaks, use DNS leak test tools. There are plenty of online testing tools available, but building your own testing tool gives you more control.

Here's a link to a DNS leak testing tool I created for Linux systems to help verify if your OpenVPN connection is configured correctly: DNS Leak Test Tool.

Be sure to test your VPN connection and DNS setup, as proper configuration is essential for both privacy and security.

Click to expand...

chewba said:

Thanks!

Do you also know how to prevent DNS leaks on Android?

As a small addition I'd use better ciphers like cipher AES-256-GCM with TLS-DHE-RSA-WITH-AES-256-GCM-SHA384.

Click to expand...