I'm on Ubuntu 13.10 if relevant.

I want to set up a VPN for privacy. So far so good, I can do that. But my limited knowledge of networking made me wonder how DNS requests are handled. I've done some further digging and it seems that my DNS requests still go to the same place. I may be wrong but the things I've tried seem to indicate this is so. If this is my ISP's DNS servers, does this not mean that even though I am connecting via a VPN, they have a full log of everywhere I was visiting? Do the DNS requests come from the other end of my VPN tunnel or from my computer first and I THEN use the resulting information to visit that IP address via the VPN?

I need to know how I can check this.

Many thanks. I wasn't quite sure whether to place this in Networking or Security, but it seemed more of a security question to me.

Unless you use modified network settings to use the VPN tunnels default gateway traffic indeed may end up at your ISPs.


That's why it's good to add "-j LOG" and "-j DROP" rules for your regular destinations while using a VPN. Easiest way to audit traffic doesn't reach certain targets.


Taxonomy says it is a routing issue (Networking) but I do understand people class it as a security issue.

1 members found this post helpful.

Are you talking about subscribing to a VPN service provider, or are you setting up a VPN server of your own (e.g., OpenVPN) running on your home system? If the former, check with the VPN provider to see how DNS is handled. If the latter, you need to redirect the default network gateway through your VPN, and push your preferred DNS servers to the client.

In your OpenVPN server.conf, these statements redirect the network gateway for clients that connect to you, and push the openDNS servers IP addresses to the client. You could use any DNS servers you trust, including ones of your own.

Hi. Thanks for both replies. To clarify (@Z038), I am subscribing to a VPN service provider. Whilst this provides some anonymity from the places I visit, I had wrongly thought that it provided anonymity from my ISP also. I.e. all my traffic was going through it, but it now seems likely that DNS requests - i.e. a complete list of where I'm going - is available to my ISP.

I'm surprised this isn't more widely known. Perhaps it is with the people who frequent this forum, but I'm sure there are a lot of people out there who think turning on their VPN offers this sort of privacy.

So anyway, this now turns into two questions:
1) How do I ensure ONLY my VPN provider's DNS servers are used. (They do provide DNS for those that want it).
2) How do I ensure that any network traffic ONLY goes via the VPN.

To explain that second one, the VPN occasionally drops. At this point, as far as I can see, Ubuntu cheerfully goes back to using its non-VPN connection. Is there any way to tell it: "unless you are connected to this VPN don't send / receive"? I'm /guessing/ that I could add something to IP tables that dropped anything outgoing other than to the VPN servers address? Not sure how I'd do that.

Also, sorry - I think now that I did put this in the wrong forum. My apologies for that. If a mod does want to move it over to Networking...

Again, thanks for all replies. This is very helpful. The world grows ever more surveillance-y and I'm interested in how to safeguard privacy.

It would probably be a good idea to ask a mod to move your thread to the Networking forum. You can use the Report button to ask them to do that.

My VPN knowledge is basic. I run an OpenVPN server on my home system so I can connect to it from my laptop when I'm away from home. I also run Bind (named) on my home system to provide my own DNS service. When I'm connected to my VPN from airport/hotel/coffee shop public WiFi, I'm only concerned with securing my traffic from other users of those public networks. I'm not concerned with hiding my IP address. All of my internet accesses appear to be from my home IP address, since that is my exit point.

I have tested my DNS for leaks using these sites, and they always show my own DNS server being used:

https://www.dnsleaktest.com/
http://dnsleak.com/
http://ipleak.net/

As for your first question, I should think you'd be able to ask your VPN provider how to make sure that only its own DNS servers are being used.

I'm interested in your second question too, since I'd also like to make sure that I won't fall back to a public open network if my VPN connection drops. I suspect it's possible to firewall your network traffic using iptables to ensure that everything leaving your own network can go out only through your VPN connection, but I don't know how to do it.

I did find this link that might be of some help. https://airvpn.org/topic/9139-preven...inux-iptables/

1 members found this post helpful.

No problem and no apologies necessary.
We're here to help.
I'll just move your thread to the Networking forum.
Have fun!