0

I am trying to setup my VPN connections of NordVPN such that I can use internet without VPN nameservers and internet with VPN. Code in /etc/resolv.conf setup by the official NordVPN instructions in the thread How to do these NordVPN changes for CyberSec in Debian? + my first line which allows me to use internet when not using VPN

nameserver 8.8.4.4
nameserver 103.86.99.99
nameserver 103.86.96.96

RuiFRibeiro's comment about the situation where he points out that my settings are creating DNS in turns.

This means you are using Google DNS in and out of VPN, and thus having DNS leaking outside of the VPN. Their DNS servers must be used while inside the VPN, and Google outside - in fact you may be using DNS in turns, more complicated, but you got the idea. Actually I have setup VPNs for use in our organization, and I intercept DNS requests, and it does not matter whichever DNS the client has configured. I am surprised both they do not do that, and also they do not provide clearer instructions.

Supported /etc/resolv.conf by NordVPN

This way, you cannot access internet without VPN, but you will have no leaks while using VPN.

nameserver 103.86.99.99
nameserver 103.86.96.96

Dynamic setting

Pseudocode

  1. If no openvpn active, use Google nameservers, etc 8.8.4.4.
  2. If openvpn active, use NordVPN nameservers such that the key method can be

    • you might change resolv.conf if calling a script to activate the VPN (RuiFRibeiro)
    • with iptables rules intercepting DNS when going the VPN route (RuiFRibeiro)
    • checking for the presence of a VPN connection/interface in a script piggybacking the dhcp client - - ugly hack (RuiFRibeiro)
    • ...

NordVPN answer acceptable by me

I received a few answers from them but accept only the following ones. I asked them a schedule when this bottleneck will be solved.

Currently Cybersec feature does not work with Linux machines as there will be internet connection only when connected to the VPN.

If you wish to have no leaks on your Linux machine while connected to the VPN and internet while not connected, use these DNS addresses.
These are our DNS servers: 162.242.211.137 and 78.46.223.24

We are sorry to inform you, that CyberSec for Linux is not in the priority list at the moment. ETA is unknown.

Future wishes for NordVPN

  1. Some binary blob to fix the issue but I want documentation what it does
  2. Use OpenVPN directly instead of IPesc or PPPT

OS: Debian 9

  • 1
    More up to the point. The first one takes precedence. When it fails, the others work, and normally only then. If you want to use the CyberSec functionality, you cannot have Google DNS as first while using the VPN; on the other hand, you should not have the NordVPN first when not using the VPN. Ideally, you should only have NordVPN DNSes there when using the VPN, and Google/yours all other times. – Rui F Ribeiro Jul 25 '17 at 18:50
  • 1
    I solved it intercepting DNS in the server side, you might change resolv.conf if calling a script to activate the VPN, or with iptables rules intercepting DNS when going the VPN route (in that we "Unix&Linux" can help with more data on your side). TBH, NordVPN should have a better grasp on this, I think. There is also the possibility of checking for the presence of a VPN connection/interface in a script piggybacking the dhcp client I think...which is an ugly hack. Ask first the NordVPN guys. – Rui F Ribeiro Jul 25 '17 at 18:52
  • 1
    I use also a VPN provider in my Mac and iPhone. I know for Linux they have got a package to install, probably because of those issues. The idea of installing a package of them on a Linux machine does not appeal to me, and besides, I moved to OpenBSD for personal use. – Rui F Ribeiro Jul 25 '17 at 18:59
  • 1
    Unfortunately it does not seem to add nothing new we have talked about except for "we do not support Linux". Having to use their DNS inside their VPN goes beyond having leaks however; they have blacklisting for malware/viruses at DNS level, and you wont take advantage of it if using Google services while inside the VPN. TBH, their answer is pretty common, unfortunately. – Rui F Ribeiro Jul 27 '17 at 10:01
  • 1
    I do not have a clear idea as I usually take care of it myself. My own personal provider gives you a binary "blob", and for people asking for manual configs, it provides a PPPT config instead of an IPsec one, so I wont be recommending it. – Rui F Ribeiro Jul 27 '17 at 12:37
0

No support exists for the feature in NordVPN for Linux at the moment. I hope this answer will be deprecated soon.

0

I asked them how to prevent DNS leakage, while connected with NordVPN. Their suggested method is described below. But, how set DNS for non-VPN connection, I cannot answer yet.

In terminal (ctrl+alt+t) become root (su), and renew the file resolv.conf:

rm -r /etc/resolv.conf
nano /etc/resolv.conf

When the text editor opens, please type in these lines:

nameserver 103.86.96.100
nameserver 103.86.99.100

Now you have to close and save the file (Ctrl+X && Y). Then continue typing in the terminal:

chattr +i /etc/resolv.conf
reboot now

Your computer will reboot and everything should work correctly. If you will ever need to change your DNS addresses, please open the terminal and type in the following:

su
chattr -i /etc/resolv.conf
nano /etc/resolv.conf 

Change DNS addresses, save and close the file.

chattr +i /etc/resolv.conf  

The command chattr +i shall prevent any unwanted changes to the concerning file.

Your question, how set DNS for non-VPN connection, I cannot answer yet.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.