I am using the great technique from How can I get my external IP address in a shell script? to find my public IP address:

dig +short myip.opendns.com @resolver1.opendns.com

I'm also using sshuttle as a proxy over ssh tunnel. It is started to forward traffic on all ports and IPs (including DNS requests) using the following command:

sshuttle --dns -vr usr@sshserver 0/0

After the proxy has started I visit https://canihazip.com/s to verify that my external IP has changed. It has, but when I run the dig command again, it reports the same external IP reported as before the proxy was started.

From the verbose output, sshuttle seems to be forwarding on other dig commands, and checking https://dnsleaktest.com only reveals the IP on the other end on my proxy, as expected. As far as I can tell sshuttle seems to be working.

Can anyone explain why the dig command reports my external IP before the proxy? My aim is make it seem to the opendns servers that the request is originating from my ssh server.

It's a bit over my head, but I had a quick look in Wireshark and when filtering for DNS traffic Wireshark doesn't see any DNS requests apart from the above DIG command. The command is bypassing the proxy.

I'm happy to use any of the other (less elegant) ways to find my external IP, but this makes me ask the question: what else is bypassing sshuttle?

  • Would you able to explain this better, or provide evidences? It sounds strange the same command producing different results. – Rui F Ribeiro Jun 12 '18 at 12:29
  • @RuiFRibeiro I'd added some clarity, does that help? The command is run before the proxy, then after, but both give me the same external IP. Despite icanhazip giving me different external IPs. Any specific evidence you are looking for? – alcafly Jun 13 '18 at 10:46
  • That explains it, it was not entirely clear the first command was done without using the proxy. – Rui F Ribeiro Jun 13 '18 at 11:16

The gateway has two external IP addresses. The NAT running on the gateway employs some kind of load balancing. It can be based on the destination IP or protocol type. If this is the case the source IP address of the DNS queries and HTTP packets will be different.

  • Sorry, I'm not sure what you mean. What gateway? How is dig leaking my "true" (un-tunnelled) IP? – alcafly Aug 6 '18 at 13:22
  • My bad, please ignore the response – Larytet Aug 12 '18 at 11:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.