search

alfredopalhares / openvpn-update-resolv-conf

Script that updates DNS settings are pushed by the OpenVPN server
462 stars 129 forks source link

Solves domain name resolution data leakage? #3

Closed TheNotary closed 8 years ago

TheNotary commented 8 years ago

Hey, thanks for uploading this. Just to clarify, this solves DNS resolution so domain names cannot be resolved through your ISP's DNS?

Also, do you know a way of testing that this is working?

alfredopalhares commented 8 years ago

Hello @TheNotary Depending on the situation this can or it cannot solve that problem. All the script does it to update the DNS entries on your /etc/resolv.conf file.

If you want to hide the DNS request from your ISP, you will need to have a DNS server inside the network you are connecting to, and all the DNS queries will go to that server. To test you can use the dig command once you're connected:

$ dig google.com 

; <<>> DiG 9.10.3 <<>> google.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 32416
;; flags: qr rd ra; QUERY: 1, ANSWER: 6, AUTHORITY: 13, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;google.com.            IN  A

;; ANSWER SECTION:
google.com.     247 IN  A   173.194.205.138
google.com.     247 IN  A   173.194.205.113
google.com.     247 IN  A   173.194.205.100
google.com.     247 IN  A   173.194.205.101
google.com.     247 IN  A   173.194.205.102
google.com.     247 IN  A   173.194.205.139

;; AUTHORITY SECTION:
.           3513    IN  NS  f.root-servers.net.
.           3513    IN  NS  d.root-servers.net.
.           3513    IN  NS  a.root-servers.net.
.           3513    IN  NS  g.root-servers.net.
.           3513    IN  NS  i.root-servers.net.
.           3513    IN  NS  l.root-servers.net.
.           3513    IN  NS  h.root-servers.net.
.           3513    IN  NS  m.root-servers.net.
.           3513    IN  NS  c.root-servers.net.
.           3513    IN  NS  b.root-servers.net.
.           3513    IN  NS  j.root-servers.net.
.           3513    IN  NS  e.root-servers.net.
.           3513    IN  NS  k.root-servers.net.

;; Query time: 119 msec
;; SERVER: 123.456.123.789#53(172.31.9.199)
;; WHEN: Mon Nov 16 16:24:56 WET 2015
;; MSG SIZE  rcvd: 12

The SERVER section tells you the IP address of the DNS server that responded to your request. If the IP is from a server on the network inside the network, your ISP won't get that query.

Hope this helps.

TheNotary commented 8 years ago

Thanks for this answer, it's greatly appreciated =)

alfredopalhares commented 8 years ago

I will close this issue. Reopen if you any more questions.