I am using the great technique from How can I get my external IP address in a shell script? to find my public IP address:
dig +short myip.opendns.com @resolver1.opendns.com
I'm also using sshuttle as a proxy over ssh tunnel. It is started to forward traffic on all ports and IPs (including DNS requests) using the following command:
sshuttle --dns -vr usr@sshserver 0/0
After the proxy has started I visit https://canihazip.com/s to verify that my external IP has changed. It has, but when I run the dig command again, it reports the same external IP reported as before the proxy was started.
From the verbose output, sshuttle seems to be forwarding on other dig commands, and checking https://dnsleaktest.com only reveals the IP on the other end on my proxy, as expected. As far as I can tell sshuttle seems to be working.
Can anyone explain why the dig command reports my external IP before the proxy? My aim is make it seem to the opendns servers that the request is originating from my ssh server.
It's a bit over my head, but I had a quick look in Wireshark and when filtering for DNS traffic Wireshark doesn't see any DNS requests apart from the above DIG command. The command is bypassing the proxy.
I'm happy to use any of the other (less elegant) ways to find my external IP, but this makes me ask the question: what else is bypassing sshuttle?