Open absolution1 opened 9 months ago
Hi there. To test this, I've swapped from using AirVPN's DNS to DOT+cloudflare (the Gluetun default).
I'm experiencing a similar thing.
I'm logging the DNS server used every minute using the command line DNS leak checker. The vast majority of the time I simply see this
162.158.148.72 [Switzerland, Swiss Confederation AS13335 CloudFlare Inc.]
Periodically, I see other DNS servers. Here are a few
80.255.10.194 [Germany AS201011 Core-Backbone GmbH]
194.110.115.34 [Belgium AS9009 M247 Europe SRL]
142.147.89.225 [United States of America AS6233 xTom]
79.142.69.160 [Switzerland, Swiss Confederation AS51430 AltusHost B.V.]
What should I do here?
Hi there!
Gluetun doesn't prevent dns leaks within the VPN tunnel. It does set the Gluetun container resolver to 127.0.0.1
(DNS_ADDRESS
value) so everything plugged into it by default will use that nameserver (by default Unbound+Cloudflare). But a container plugged through Gluetun could use its nameserver of choice (still, as long as it goes through the VPN). What containers do you have running connected through Gluetun?
If you check the few IP extra addresses you have:
admin@perfect-privacy.com
- perfect privacy is a vpn providerMullvad VPN AB
- mullvad is a vpn providerHowever, I guess I could add an option, disabled by default, to block DNS traffic not going through the DNS_ADDRESS
with another firewall rule.
Hi @qdm12 Thank you for checking in on this, apologies for the delay responding.
I'm running a QBT container that relies on gluetun for its networking.
I never ended up figuring this situation out. The list of IPs that appear aren't connected to my VPN provider (AirVPN) but you are right that they mostly seem to be other privacy-focused providers (Though I saw google appear once in the list).
What's strange is that I only see this happen when using the mentioned command line script. Under the hood this uses bash.ws for checking dns. Other online DNS checkers only ever report the DNS that I'd expect (cloudflare, but in the same country as my VPN).
Adding in that extra option would be a good test. Do you have any suggestions for what I could dig into to see where these other DNS addresses are coming from?
I don't know if I said this before but it's only rarely that I see these other DNS providers being returned from the command line script. The vast majority of the time I just see cloudflare...
Is this urgent?
Yes
Host OS
Ubuntu server LTS 20.04
CPU arch
x86_64
VPN service provider
AirVPN
What are you using to run the container
docker-compose
What is the version of Gluetun
Running version latest built on 2023-10-07T13:26:08.155Z (commit 1c43a1d)
What's the problem π€
As described in the title, I am periodically seeing a DNS leak when connected to AIRVPN. 99 times out of 100 I see the same DNS server as the VPN server but, very occasionally, I get a separate DNS server in a different country.
I am using the bash script here within a container attached to the gluetun container network to test for DNS leaks: https://github.com/macvk/dnsleaktest
Sometimes I see the output I expect
Your IP: REMOVED [Switzerland, Swiss Confederation AS51430 AltusHost B.V.]
You use 1 DNS server:
REMOVED [Switzerland, Swiss Confederation AS51430 AltusHost B.V.]
Conclusion: DNS is not leaking.
Sometimes I see this
Your IP: REMOVED [Switzerland, Swiss Confederation AS51430 AltusHost B.V.]
You use 2 DNS servers:
REMOVED [Switzerland, Swiss Confederation AS51430 AltusHost B.V.]
REMOVED [Germany AS28753 LeaseWeb Deutschland GmbH]
Conclusion: DNS may be leaking.
I have seen other DNS servers appear to e.g. in the US and the Netherlands (the Netherlands addresses were cloudflare addresses if that helps)
I am -almost- following the standard docker-compose setup. The only change I have made is to include DNS_ADDRESS as otherwise the DNS server is ubound and then points to cloudflare for DNS.
Share your logs (at least 10 lines)
Share your configuration