A VPN encrypts your traffic and routes it through a remote server, masking your public IP address. However, if your DNS queries bypass the VPN tunnel and go directly to your ISP’s resolver, you are experiencing a DNS leak.
This undermines the privacy guarantees of your VPN.
The Domain Name System (DNS) translates human-readable domain names (e.g., example.com) into IP addresses. When you visit a website:
If this DNS query goes outside the encrypted VPN tunnel, your ISP (or any observer) can see:
Even if the actual HTTP/HTTPS traffic is tunneled.
Suppose:
Even though your browser traffic exits via Switzerland, your DNS requests still go to your Texas-based ISP resolver.
This creates a metadata correlation:
DNS servers often log:
This is sufficient to infer your true location.
Common causes:
Visit:
If you see your ISP’s DNS servers instead of your VPN provider’s DNS servers — you are leaking.
Run:
dig +short myip.opendns.com @resolver1.opendns.com
Then check which DNS server is being used:
cat /etc/resolv.conf
Or:
nmcli dev show | grep DNS
If DNS servers belong to your ISP — you are leaking.
The goal is:
Force all DNS queries through the VPN tunnel and prevent fallback to ISP DNS.
If using OpenVPN:
Edit your .ovpn file and add:
block-outside-dns
dhcp-option DNS 10.8.0.1
(Use your VPN’s internal DNS server.)
Edit:
sudo nano /etc/systemd/resolved.conf
Set:
DNS=
FallbackDNS=
Then restart:
sudo systemctl restart systemd-resolved
Using nmcli:
List connections:
nmcli connection show
Modify your VPN connection:
nmcli connection modify <vpn-name> ipv4.ignore-auto-dns yes
nmcli connection modify <vpn-name> ipv4.dns "10.8.0.1"
nmcli connection modify <vpn-name> ipv6.ignore-auto-dns yes
Bring connection down/up:
nmcli connection down <vpn-name>
nmcli connection up <vpn-name>
sudo iptables -A OUTPUT ! -o tun0 -p udp --dport 53 -j DROP
sudo iptables -A OUTPUT ! -o tun0 -p tcp --dport 53 -j DROP
This ensures DNS cannot exit outside tun0.
Open:
Control Panel → Network and Internet → Network Connections
Right-click your physical adapter → Properties
Select:
Internet Protocol Version 4 (TCP/IPv4)
Click Properties → Advanced → DNS tab
Uncheck:
Register this connection's addresses in DNS
After VPN is connected:
Open PowerShell as Administrator:
Get-DnsClientServerAddress
If wrong DNS servers appear, set VPN interface DNS manually:
Set-DnsClientServerAddress -InterfaceAlias "VPN" -ServerAddresses 10.8.0.1
Windows may leak DNS via parallel queries.
Run:
Set-ItemProperty -Path "HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient" -Name DisableSmartNameResolution -Value 1
Reboot.
macOS frequently overrides VPN DNS unless forced.
scutil --dns
List services:
networksetup -listallnetworkservices
Assume VPN is named “VPN”.
Set DNS:
sudo networksetup -setdnsservers "VPN" 10.8.0.1
sudo networksetup -setdnsservers Wi-Fi empty
sudo dscacheutil -flushcache
sudo killall -HUP mDNSResponder
Many VPNs do not tunnel IPv6.
sudo sysctl -w net.ipv6.conf.all.disable_ipv6=1
Disable-NetAdapterBinding -Name "Ethernet" -ComponentID ms_tcpip6
networksetup -setv6off Wi-Fi
After applying fixes:
Also verify:
dig example.com
Ensure DNS server shown is VPN internal.
A DNS leak defeats the core privacy promise of a VPN. It exposes:
The solution is straightforward:
Once configured correctly, your DNS resolution becomes fully encapsulated inside the encrypted tunnel — restoring actual anonymity rather than just encrypted transport.
If desired, I can also provide a hardened configuration checklist suitable for enterprise Linux deployments.