[SOLVED] DNS leaks in PVE7

S

Spoonman2002

Well-Known Member
Jul 6, 2021
351
29
48
54
Holland
Hi all,

I have a VPN Gateway (Ubuntu 20.04 LXC) running in PVE7.
When I connect from a VM to this Gateway I have a DNS leak....
(https://dnsleaktest.com)

Same VPN Gateway setup on ESXi 6.x (Ubuntu 20.04) gives no DNS leaks.

Is there a network setting in PVE7 that needs further configuration?
I have no exotic setup, just nic0 and vmbr0 as Bridge (default).
 
hi,

Spoonman2002 said:
I have a VPN Gateway (Ubuntu 20.04 LXC) running in PVE7.
When I connect from a VM to this Gateway I have a DNS leak....
(https://dnsleaktest.com)

Same VPN Gateway setup on ESXi 6.x (Ubuntu 20.04) gives no DNS leaks.
Click to expand...
are you using the same openvpn configuration on both servers?

what kind of dns leak are you having? is there a configured dns server on the vpn side?

what OS is the client running?
 
- yes, same openvpn config files on both servers.
- DNS server is configured on the VPN side.
- the leak test shows DNS servers from my default VLAN1 network.
I have firewall rules in my router that isolate all my VLANs.
- The client from which I'm testing is a vm Linux Mint 20.2 on VLAN44.
(When I test from a Windows 10 client vm there are NO DNS leaks....).
 
Spoonman2002 said:
- The client from which I'm testing is a vm Linux Mint 20.2 on VLAN44.
(When I test from a Windows 10 client vm there are NO DNS leaks....).
Click to expand...
what is your /etc/resolv.conf contents in the linux mint VM? it should point to the correct dns server from your VPN.

maybe you can add in your client conf file:
Code: 
script-security 2
up /etc/openvpn/update-resolv-conf
down /etc/openvpn/update-resolv-conf

(on my machine the script doesn't have a ".sh" extension, check yours)

[0]: https://community.openvpn.net/openvpn/wiki/Pushing-DNS-to-clients
 
Spoonman2002 said:
it says: 127.0.0.53
Click to expand...
that's your local IP address. if you want no DNS leaks then you should be using the IP address of the DNS server supplied by your VPN server
 
Okay........... I found the cause of the DNS leaks:
in my router/firewall (OPNsense) there was a mis-configuration with internal DNS traffic.
Solution:
delete all DNS entries in the general section in OPNsense and provide DNS servers per VLAN.

I also changed in Proxmox from default Bridge config to OVS with seperate intports/VLANs.
Probably not necessary to change to OVS but it gives me more structural overview.
 
You must log in or register to reply here.
Top Bottom