Tcpdump shows vpn dns queries

[Goobi]

Hi community,

I got PIA vpn configured on my 86u router with policy rules. The VPN DNS gets pushed down to the clients and dnsleaktest on them show the VPN DNS. However, I was testing out DoT and running tcpdump to see if I see any traffic on port 53. Aside for a few time lookups from the router itself, I see all the queries from my VPN DNS. Is this normal? Is this considered a DNS leak?

Thanks in advance

 

[MaziahBebop]

Hi community,

I got PIA vpn configured on my 86u router with policy rules. The VPN DNS gets pushed down to the clients and dnsleaktest on them show the VPN DNS. However, I was testing out DoT and running tcpdump to see if I see any traffic on port 53. Aside for a few time lookups from the router itself, I see all the queries from my VPN DNS. Is this normal? Is this considered a DNS leak?

Thanks in advance

This sounds like not a DNS leak, since tcpdump is picking up the query before it enters the tunnel.
Without knowing more about your setup, that's my initial hunch.

[edit]

To confirm that hunch, I'd follow along these kind of steps:

• Assuming TCPDump is on the router itself, and testing is done from wifi/wired clients
• Visit a new and unique domain name from the client (e.g., www.ihavenotvsitiedthissitebefore.net)
• Watch all the TCPDump log for that domain
• You should notice that the router received a query on the LAN for that domain
• You should also notice that the router did not send a query on the WAN for that domain.
• If all of the above are true... it should be indicative of no DNS leak.

 

[Goobi]

Thanks, tcpdump is on the router and I will continue to monitor using the above as a guide.