DNS leaks persistent in OpenVPN

[Pattern_Juggled]

After an astute observation from one of our customers, the Cryptocloud tech team has been doing some research on DNS leaks to be found in the Windows version of the current OpenVPN client code.

We're pulling together what we could find - a little bit in raw format at first - so we can all chew on it and start to boil it down to confirmed findings, open questions, and potential avenues for response. So... feel free to pitch in with questions, observations, or other resources to help nail our understanding down!

http://forum.hidemyass.com/index.php/to ... e-and-fix/

https://forum.perfect-privacy.com/showthread.php?t=702

https://forums.openvpn.net/topic7143.html

http://www.wilderssecurity.com/archive/ ... 98893.html

DNS leaks have to do with "DHCP renewal" and it is a problem,

“A DNS leak may happen whenever a DNS query ‘bypasses’ the routing table and gateway pushed by the OpenVPN server. The trigger on Windows systems may be as simple as a slight delay in the answer from the VPN DNS, or the VPN DNS unable to resolve some name,” explains Paolo from AirVPN.

its a universal problem with the protocol, a slight hiccup/delay and the users machine will resolve with their own DNS instead.

http://www.dnsleaktest.com/how-to-fix-a-dns-leak.php has information on how people can fix it

[cryptostorm_support]

There's a potential security/privacy issue with OpenVPN that could make it easier to identify your actual IP address. The problem is always present in Windows, and may or may not be a problem for those using Macs or Linux. Fortunately, there's also a fix that's relatively simple.

In a nutshell, the problem is that DNS servers assigned to you by your ISP are often passed to OpenVPN, and used by OpenVPN, even though this isn't supposed to happen. Because of the DNS leak, your ISP or someone checking on your internet usage, could get some clues about your true IP address. (P2P programs do not use DNS, so the DNS leak isn't a problem for those.)

Here's how to tell if you have the problem -- connect your HMA VPN, then go to -- http://entropy.dns-oarc.net -- Click 'Test My DNS' -- ignore "Good" "Great" and everything except 'dns resolver' listed addresses). Then, look for any related to your IP address, your internet provider, or that are in your country rather than the country of the VPN server you are using. If anything like that is listed, you have a DNS leak.

If you have the leak, it's easy to fix in Windows using a freeware program "NetSetMan" -- you can get it here http://www.netsetman...index.php?s=nsm. Download and install the program; then:

(1) Select the first tab. Choose Profile>Get all current settings - IP/DNS addresses should then appear. Tick only 'IP' and 'DNS Server'. Select 'Use the following IP address' and 'Use the following DNS Server addresses' leaving the IP/DNS addresses untouched.

(2) Then select the second tab. Tick only 'Use the following DNS Server addresses'. 'Preferred' and 'Alternate' -- and leave them blank.

Now just connect to HMA VPN as you normally would; after you connect, go to the second tab of NetSetMan and click "Activate" -- That fixes the problem by removing your ISP's DNS servers from your normal Network adapter -- with the result that these DNS servers are no longer passed to your VPN adapter and do not leak. Now you can check for leakage at http://entropy.dns-oarc.net

The problem should be fixed.

IMPORTANT When you disconnect from HMA VPN you must got to the first tab of NetSetMan and click "Activate" to restore your original network settings.

Apparently the problem does exist in some cases with Linux and Macs and can be fixed by using fixed ISP addresses (instead of DHCP). I cannot help beyond that.

You can get more detail here -- https://forum.perfec...hread.php?t=702

I want to emphasize -- this is NOT a problem caused by HMA. It's caused by OpenVPN and/or Windows. The same problem also exists with PPTP VPNs in Windows.

http://forum.hidemyass.com/index.php/to ... e-and-fix/

[cryptostorm_support]

"ixing the leak

To fix the leak reliably, it is necessary to:

1) Set the computer to use fixed, not auto/dhcp settings - before connecting to the VPN. This is only necessary for XP.

2) After connecting to the VPN, set the dns name server of the regular internet connection to 'none' - forcing dns name lookups through the VPN connection exclusively.

3) Set everything back to normal after disconnecting the VPN.

Tech details:
OpenVPN allows for batch files to run prior to connecting, after connecting and after disconnecting the VPN (e.g. Steinsel_pre.bat, Steinsel_up.bat, Steinsel_down.bat) . They are all placed in the C:\Program Files\OpenVPN\config folder (or "Program Files (x86)" for 64 bit versions). The three batch files must be duplicated and renamed for each OpenVPN connection.



Easy Solutions

Used with the "saved password" version of OpenVPN, these are complete and fully mobile one click solutions. "CCleaner" also performs a secure data trail cleanup before and after each VPN session.

To install, first make sure OpenVPN is working, then make sure CCleaner is installed: Go to Options>Advanced - untick everything. Go to Options>Settings>Secure file deletion> choose 1 or 3 pass. For convenience, un-tick 'History' and 'Recently typed URLs' on the main page - re-tick periodically for a full cleanup.

Then choose from below:"

perfect privacy

[cryptostorm_support]

"I've set up a new (dev) OpenVPN on a linux server. I've configured it to push googles 8.8.8.8 DNS server to the clients.

I'm on a windows box. nslookup shows that it's using the 8.8.8.8 DNS server just fine.

When I do a packet capture I see that all traffic, including DNS is going through the VPN (I go to a random website to ensure DNS is called, also nslookup's don't show any traffic outside of the VPN).

There is a case, however, where DNS requests are going through my local DNS server, I think it's when a flash app comes up.

I'm racking my brain trying to figure out how or why there are any exceptions. Does anyone have a thought on what I might do to track down exactly what's happening here? How can I understand the routing logic going on behind the scenes for the odd case here?"




"Check if your local server is still in your resolv.conf
you may need to tweak the update-resolv-conf script to remove it, since it sounds like an app is not behaving as expected

<edit>
oops the client is windows...
Check if windows still knows about the local dns server, same thing different OS"











openvpn.nets forum

[cryptostorm_support]

I ran across this the other day;

http://www.dnsleaktest.com/how-to-fix-a-dns-leak.php

Take a look at;

Solution B - Manually clearing the DNS

Number 5 & 7, seems like a load of nonsense to me...

You can't run ' static 0.0.0.0 both'...

What's wrong with just flushing the dns and then putting in the dns you want to use in your router, or adapters and being on your merry way? Personally that's all I do and I'm not leaking any dns, at least with all the tests I have done it's not...
SteveTX
May 10th, 2011, 07:24 PM
because if you don't knock out the dns resolver AND dhcp source AND convert your routes to static, the dhcp on the other end (your vpn or isp) can send dhcp updates directly to your tap adapter and put all that information back into your adapter/interface.
DasFox
May 10th, 2011, 08:24 PM
-{ Quote: "because if you don't knock out the dns resolver AND dhcp source AND convert your routes to static, the dhcp on the other end (your vpn or isp) can send dhcp updates directly to your tap adapter and put all that information back into your adapter/interface." }-


Well all I've ever done is add in the Pri & Sec DNS to the adapters, flush the dns and go about my business, so what's wrong with just doing that?

If that isn't enough then what do you recommend, what I have shown you in this link or another method?

Are you suppose to run this command as you actually see it below? Because I don't understand what 0.0.0.0 represents and you can't run it like that.

netsh interface IPv4 set dnsserver "Local Area Connection" static 0.0.0.0 both

THANKS
SteveTX
May 10th, 2011, 10:03 PM
Here is a tutorial on preventing DNS leaks (https://xerobank.com/support/articles/h ... dns-leaks/) from TAP adapters / OpenVPN.
DasFox
May 10th, 2011, 11:38 PM
-{ Quote: "Here is a tutorial on preventing DNS leaks (https://xerobank.com/support/articles/h ... dns-leaks/) from TAP adapters / OpenVPN." }-

Yes I do know this link of yours, I was thinking you were going to show it to me, hehe...

3. Find out which adapters are active.
'and see who gets dhcp updates', see who gets updates where?

5. If you run this command on the connection connected to you are going to get disconnected, this is ok?
netsh interface ip set address "Local Area Connection" static 192.168.1.4 255.255.255.0 192.168.1.1 1

7. Clear the DNS Resolver cache again.
This time the DNS information won't come back, won't come back where?

Everytime you are done using the VPN you have to run netsh exec c:\net.cfg and then when you connect to the VPN again, you have to run the steps over?

How does do this prevent your computer from talking through any adapter except your VPN TAP adapter?

How about this in OSX and Linux TUT too?

THANKS
SteveTX
May 11th, 2011, 01:16 AM
-{ Quote: "Yes I do know this link of yours, I was thinking you were going to show it to me, hehe...

3. Find out which adapters are active.
'and see who gets dhcp updates', see who gets updates where?" }-

To see which interfaces are being updated from dhcp.

-{ Quote: "
5. If you run this command on the connection connected to you are going to get disconnected, this is ok?
netsh interface ip set address "Local Area Connection" static 192.168.1.4 255.255.255.0 192.168.1.1 1" }-

Shouldn't get disconnected. Should stay up and keep routing, only statically. If the IP you are connecting to frequently changes, that could be an issue. Otherwise, it should work.

-{ Quote: "
7. Clear the DNS Resolver cache again.
This time the DNS information won't come back, won't come back where?
" }-

DNS resolver cache means the cached IP addresses of domains you look up via DNS, ex: ebay.com. So you don't have stale, cached, or poisoned DNS entries in your existing resolver cache, and if any crept in while you were changing the above settings, they get wiped out.

-{ Quote: "
Everytime you are done using the VPN you have to run netsh exec c:\net.cfg and then when you connect to the VPN again, you have to run the steps over?
" }-

Sigh, yes.

-{ Quote: "
How does do this prevent your computer from talking through any adapter except your VPN TAP adapter?" }-

Leaks occur when your computer knows of interfaces to get out of your computer. So what we do here is cripple the other interfaces while keeping the expected routes up, and stop listening to anyone sending network updates other than the TAP adapter.

-{ Quote: "
How about this in OSX and Linux TUT too?
" }-





wildersecurity.com

[CyberNinja]

This is all nice and appreciate the effort.

But the Question still exists................
When is CryptoCloud going to fix this ??? Why is PrivateInternetAccess works and CryptoCloud shows the leak. Why are other VPN software works and prevents the leak but ONLY CryptoCloud who believes in PRIVACY can't fix this?

This shouldn't be just a discussion. It should be THE FIX which it should've been here by now..... not bunch of guides which I already know and know how to manually fix.

^THIS^

Considering how i just stumbled on this thread, and have been using this service for a long time now, i feel pretty stupid knowing that all my DNS queries have been going through my ISP ALL THIS TIME. I really like CryptoCloud, and i will continue to like them for as long as they're around. HOWEVER, it amazes me that this hasn't been a top priority issue YEARS ago when they were getting their head start in the VPN game.

For a company that spouts "Hardcore Privacy", this surely has to be a major embarrassment considering they have never logged anything, yet allow something like this to slip through their client so the customers' ISP DNS servers catch everything and log it for God knows how long.

If this is a big enough issue to this company it will be patched as quickly as possible in the next version of the client, at least i hope it is to them since this is a huge security issue. And that is my two cents, hopefully it will get someone's wheels spinning towards that objective hastily. I'd hate to see this problem persist, it certainly isn't benefiting anyone but the ISP's people logging, analyzing, and storing the data for x amount of time.


CyberNinja

[Guest]

So by doing a little research about this bullshit issue we're having with DNS leaks, i have come up with a pretty straightforward solution to the DNS leaking problem. One thing our users can do is force their NIC to use specific DNS servers other than their ISP's DNS servers, which i will explain in this post down the line.

I also did some research on some other channels and i found that there are what are known as Tier-2 DNS servers at opennicproject.org, which offer alternative DNS servers you can use at your heart's content.Doing this, as cool as it sounds, is not a permanent fix since if the DNS traffic being sent is in clearform your ISP can still use what is known as transparent DNS proxying. Transparent DNS Proxying is a fancy term for invisible interception of your DNS requests even if you use a separate DNS server, which is really where I've almost hit a roadblock here in the issue of privacy and security.

However, i HAVE found somewhat of a solution to this problem with a free tool called DNScrypt by OpenDNS, a program that encrypts your DNS traffic from would-be snoopers. This sounds fantastic at first until you read that you have to use OpenDNS' servers, and OpenDNS' privacy policy which to my knowledge, does log everything you do through their DNS servers.

per their site:

Service Usage Information

When you use our Services, OpenDNS stores certain DNS, IP address and related information about you to improve the quality of our Service, to provide you with Services and for internal business and analysis purposes. For example, OpenDNS runs a Domain Name System (DNS) service. DNS translates a domain name (e.g., http://www.example.com) into the corresponding numerical address (e.g., 192.0.34.166) that allows your system to access the domain over the network."

This means by using their DNS servers, even if encrypted, leaves a data trail. It would be safe to assume that we in the CryptoCloud community are all about NOT leaving data trails in any way, which is why we're trying to patch this fucking DNS problem in the first place, right? Well this is where i have a bit of a hangup, you can use alternative DNS servers that don't log anything, but if your ISP is using a TDNSP it doesn't do much justice in the first place.

If any other users here have any suggestions on how to encrypt DNS traffic without using OpenDNS' servers i think we would all be more than happy to see what can be done.

Now if you haven't already looked at opennicproject,org to see how you can change where your DNS traffic goes, i can post the links on how to do it for each respective OS.

Here you go folks:

http://www.opennicproject.org/configure ... windows-7/
http://www.opennicproject.org/configure ... s-xpvista/
http://www.opennicproject.org/configure ... -on-a-mac/
http://www.opennicproject.org/configure ... ntu-linux/

First person to find a highly encrypted, logless DNS server or a way to encrypt DNS traffic without using OpenDNS' servers gets an internet high-five, yes i know its not much but at least you get SOMETHING for it, haha.

CyberNinja

[CyberNinja]

So by doing a little research about this bullshit issue we're having with DNS leaks, i have come up with a pretty straightforward solution to the DNS leaking problem. One thing our users can do is force their NIC to use specific DNS servers other than their ISP's DNS servers, which i will explain in this post down the line.

I also did some research on some other channels and i found that there are what are known as Tier-2 DNS servers at opennicproject.org, which offer alternative DNS servers you can use at your heart's content.Doing this, as cool as it sounds, is not a permanent fix since if the DNS traffic being sent is in clearform your ISP can still use what is known as transparent DNS proxying. Transparent DNS Proxying is a fancy term for invisible interception of your DNS requests even if you use a separate DNS server, which is really where I've almost hit a roadblock here in the issue of privacy and security.

However, i HAVE found somewhat of a solution to this problem with a free tool called DNScrypt by OpenDNS, a program that encrypts your DNS traffic from would-be snoopers. This sounds fantastic at first until you read that you have to use OpenDNS' servers, and OpenDNS' privacy policy which to my knowledge, does log everything you do through their DNS servers.

per their site:

Service Usage Information

When you use our Services, OpenDNS stores certain DNS, IP address and related information about you to improve the quality of our Service, to provide you with Services and for internal business and analysis purposes. For example, OpenDNS runs a Domain Name System (DNS) service. DNS translates a domain name (e.g., http://www.example.com) into the corresponding numerical address (e.g., 192.0.34.166) that allows your system to access the domain over the network."

This means by using their DNS servers, even if encrypted, leaves a data trail. It would be safe to assume that we in the CryptoCloud community are all about NOT leaving data trails in any way, which is why we're trying to patch this fucking DNS problem in the first place, right? Well this is where i have a bit of a hangup, you can use alternative DNS servers that don't log anything, but if your ISP is using a TDNSP it doesn't do much justice in the first place.

If any other users here have any suggestions on how to encrypt DNS traffic without using OpenDNS' servers i think we would all be more than happy to see what can be done.

Now if you haven't already looked at opennicproject,org to see how you can change where your DNS traffic goes, i can post the links on how to do it for each respective OS.

Here you go folks:

http://www.opennicproject.org/configure ... windows-7/
http://www.opennicproject.org/configure ... s-xpvista/
http://www.opennicproject.org/configure ... -on-a-mac/
http://www.opennicproject.org/configure ... ntu-linux/

First person to find a highly encrypted, logless DNS server or a way to encrypt DNS traffic without using OpenDNS' servers gets an internet high-five, yes i know its not much but at least you get SOMETHING for it, haha.

CyberNinja

[Pattern_Juggled]

I have a very simple question to ask, how is it that other provider's software does not have this issue and our software does? Is it that CC's DNS are not resolving properly and not pushing set DNS entries?

I've made a bit of a hobby of educating myself on this DNS leak stuff for the past few weeks, and rather than bogging down this thread with my rather verbose review of the whole category of "DNS leaks" and the various ways it can be defined, I've posted it up in a separate thread.

Cliff notes version: I'm pretty sure there's at least two very different things being referred to as "DNS leaks" by folks in this thread, and elsewhere. It took me a while to figure this out. And one of these "DNS leaks" is far, far more serious in terms of potential security implications than the other - although, in an ideal world, both will be made to go away at a structural level.

I'm really curious to see if I'm imagining this split in definitional categories, or if in fact there's a blurring of language that's making these discussions far more difficult than they'd be otherwise.