2

Enabling VPN connection from the Network manager automatically add's IPv6 address to DHCP Wired connection even if it's disabled on the settings. This causes the VPN to leak on all DNS address queries that are for IPv6 addresses.

How can I prevent this behavior?

Sam

SamTzu
  • 91

2 Answers2

0

This is the only way that actually works on Debian based distro's.

Disable IPv6 on Linux

sysctl -w net.ipv6.conf.all.disable_ipv6=1

Enable

sysctl -w net.ipv6.conf.all.disable_ipv6=0

Community
  • 1
SamTzu
  • 91
0

This detailed blog post might be a big help: https://aaronhorler.com/articles/openvpn-17.10-dns-leak.html

Here is the solution they provided:

  1. INSTALL UPDATE-SYSTEMD-RESOLVED BY JONATHANIO. update-systemd-resolved is a helper script that directly updates the system's DNS settings on connection to an OpenVPN server, and resets them on disconnection.
    Installation instructions are detailed here, but, for simplicity, I will repeat exactly what I did.
    Note that I have forked this repository and added kill switch functionality using UFW. If you're interested in a kill switch, you can use my fork instead.
    Clone the respository, and compile.

    sudo apt update
sudo apt install git make openvpn
git clone https://github.com/jonathanio/update-systemd-resolved.git
cd update-systemd-resolved
sudo make

    Ensure that systemd-resolved is enabled and running.

    sudo systemctl enable systemd-resolved.service
sudo systemctl start systemd-resolved.service

    Now, update /etc/nsswitch.conf.

    sudo nano /etc/nsswitch.conf

    Find the line starting with hosts: , and alter it as below.

    hosts: files resolve dns myhostname


  2. ALTER YOUR OPENVPN CONFIGURATION FILE/S. An OpenVPN configuration file usually uses the .ovpn file extension, and is used to connect to a specific server.
    Locate it, and open it in a text editor.

    nano example.ovpn

    Add the following lines.

    dhcp-option DNSSEC allow-downgrade
dhcp-option DOMAIN-ROUTE .

script-security 2
setenv PATH /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
up /etc/openvpn/scripts/update-systemd-resolved
down /etc/openvpn/scripts/update-systemd-resolved
down-pre dhcp-option

    DNSSEC allow-downgrade will enable DNSSEC if the server supports it. If you know your server supports DNSSEC (and you don't want to allow downgrades), you can change allow-downgrade to yes.
    dhcp-option DOMAIN-ROUTE . will route all DNS requests through the OpenVPN-specified DNS server.
    All other lines are required for running the script.

  3. CONNECT USING THE TERMINAL. Do not connect to OpenVPN using the Network Manager (network-manager-openvpn-gnome). This will guarantee DNS leaks.
    Instead run OpenVPN from the command line.

    sudo openvpn --config example.ovpn

    If you're concerned about not being notified of disconnects, I advise you use my fork of update-systemd-resolved that implements a simple UFW killswitch.
    You should no longer be experiencing DNS leaks! Test here.

OptimusPrime
  • 31