>Its not "VPN providers" its "VPN provider software"
OpenVPN leaks DNS on every default Ubuntu installation I have tried. But I think it's actually Ubuntu NetworkManager's fault.
The WebRTC leaks discussed in this article are not prevented by OpenVPN either (last time I checked, which was a while ago). You have to disable WebRTC in the browser.
Incorrect. An easy and foolproof way of using VPNs is with network namespaces. You start the VPN in your init network namespace and then move the created device into a dedicated VPN namespace. OpenVPN has support for this because it allows you to execute a shell script after the VPN device has been created. Then you simply start your browser, torrent client, whatever in this namespace and you are completely safe:
1. If the VPN fails, then the only network device inside the network namespace disappears (modulo the lo device) and the programs in this namespace cannot use the internet.
2. Since the browser can only see the devices within the network namespace, the only IP it can see is the one assigned to you by your VPN provider (usually 10.x.y.z or similar.)
DNS leaks can be prevented by using a generic DNS provider such as 8.8.8.8.
"DNS leaks can be prevented by using a generic DNS provider such as 8.8.8.8."
... and you replied:
"You mean leaking to Google doesn't count as leaking?"
But I don't understand where the DNS leaks would be coming from if you are using an actual VPN for your entire network stack - wouldn't that tunnel all traffic (TCP and UDP) to your endpoint ?
1) All network traffic should go through the VPN tunnel.
2) All DNS requests should be sent to the VPN provider's DNS server and not to the one configured in the OS.
If either or both of these two things isn't happening then it's a DNS leak.
If I understood correctly, then mahkoh was saying that (2) doesn't matter if the host DNS is configured to use Google's public DNS server 8.8.8.8. That's what I called "leaking to Google".
I wouldn't say "easy"! I wrote up an article on running a single application in a vpn[1]. It was quite difficult to be honest having never used network namespaces before. Thankfully, someone else wrote a very useful guide which saved me a lot of time.
>OpenVPN leaks DNS on every default Ubuntu installation I have tried. But I think it's actually Ubuntu NetworkManager's fault.
Yeah, that's known behaviour. I think it's working as intended from Ubuntu/NM's standpoint since that bug has been open for a while with no fixes. The one line fix for that is to comment out dns=dnsmasq in NM's config. This is the bug for reference: https://bugs.launchpad.net/ubuntu/+source/network-manager/+b...
OpenVPN leaks DNS on every default Ubuntu installation I have tried. But I think it's actually Ubuntu NetworkManager's fault.
The WebRTC leaks discussed in this article are not prevented by OpenVPN either (last time I checked, which was a while ago). You have to disable WebRTC in the browser.