How to avoid DNS leak?

[finnvyrn]

Currently I use dip(geoip:private) && dport(53) -> block at the very first line in the routing config.

But there was still DNS leak. Test:

• DNS Leak Test - BrowserLeaks
• IP/DNS Detect - What is your IP, what is your DNS, what informations you send to websites.

[ppdragon16]

You need to configure in dns section instead of routing.

Note: there are known issues may cause dns leak:

• TCP 53: chrome browser on windows tends to resolve via TCP dns and dae doesn't intercept dns requests at tcp 53.
• Sniffing: when dialMode is domain, dae sniffing tries to check whether the domain is real which may cause dns leak.

[finnvyrn]

Thank you so much. I tried your tips but it didn't solve the problem.

• I'm behind GFW.
• I run dae directly on my Linux desktop.
• The router is OpenWrt, which doesn't run any proxy client.
• I tried both Vivaldi (Chroimum based) and Librewolf (Firefox based).
• I tried ip, domain, domain+, domain++.

Cfg:

routing {
    dip(geoip:private) && dport(53) -> block
    dip(geoip:private) -> must_direct
    dip(224.0.0.0/3, 'ff00::/8') -> must_direct
    pname(NetworkManager, systemd-resolved, dnsmasq, syncthing, steamwebhelper, steam, qbittorrent) -> must_direct
    fallback: all
}

dns {
    upstream {
         googledns: 'tcp+udp://dns.google:53'
    }
    routing {
        request {
            fallback: googledns
        }
    }
}

• I rarely use Chinese sites so I don't split based on whether it's CN domains or IPs.

[ppdragon16]

So the dns server of your Linux desktop points to OpenWrt or localhost?

Btw, how do you configure lan_interface and wan_interface in global section?

[finnvyrn]

The DNS server points to OpenWrt. When I changed it to localhost, I couldn't the Internet anymore.

The wan_interface is my Ethernet interface. No lan_interface configured.

[ppdragon16]

Hmm... I don't know what's going on. Maybe you can check dae's log and dnsmasq log on OpenWrt, and see how your dns requests are handled.

[finnvyrn]

Thanks. Do you have this problem? What's your setup?

When I used the Proton VPN in Vavaldi with dae, the issue was gone.

[ppdragon16]

I deployed dae on my ImmortalWrt. And I have my own hack to avoid TCP dns leak.

[finnvyrn]

I see. Thanks