I run a Ubuntu server where I have a split tunnel for VPN. Which means I have a "normal" connection to the internet for most of my services but also a tunneled connection that only a few services use. My server is in this context the client of the VPN.

I would like to know if I got DNS-leaks on the VPN tunnel. There is websites to test this but can't really use them from the terminal.

How should one solve this issue to be able to confirm if I have DNS-leaks or not?

  • What is the split tunnel? Is this the VPN server or is this server a VPN client? – Tomasz Dec 7 '18 at 21:59
  • @Tomasz I'm using the server as a client. Split tunnel = I have "normal" connection to the internet and some serverices/users has connection to internet only via VPN – Jesper.Lindberg Dec 7 '18 at 22:20

If you can set up a reverse SSH tunnel on that server, then you might use a remote web browser with those DNS leak web pages to at least partially test that server. You'd also need to set up a SOCKS 5 proxy on that server and configure your browser to use it on the remote end. There was once a sample script that came with the Perl package that provides Socks, which should be enough for this task. So you need this:

Internet    <-->            Server                        Laptop etc
                            SSH reverse tunnel    <-->    SSH
Internet        <-->        Socks proxy           <-->    Web browser

You could use wireshark on a separate system and man in the middle yourself. After which, you could look through the logs and see if any of the relevant leaks show up there. This would be simple and should be quite effective.


Another option is using iptables logging, sometimg like

iptables -A OUTPUT -d -j accept
iptables -A OUTPUT -j LOG

What I did:

ssh -X VPNuser@server

Then surf to a website for dns-leak test.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.