RT-AC5300 r36596 / DNS Leak PBR eibgrad / OpenVPN VPN Guest

Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Advanced Networking
Goto page 1, 2  Next
Author Message
elsuva
DD-WRT Novice


Joined: 20 Aug 2018
Posts: 9
Location: Buenos Aires, Argentina

PostPosted: Mon Aug 20, 2018 19:12    Post subject: RT-AC5300 r36596 / DNS Leak PBR eibgrad / OpenVPN VPN Guest Reply with quote
ASUS RT-AC5300 / DD-WRT v3.0-r36596 std (08/14/18) / WiFi - OpenVPN - VPN Guest Network / DNS Leak / PBR (Policy based Routing) / Startup Script from eibgrad (ticket #5690)

I have installed the DD-WRT v3.0-r36596 std (08/14/18) firmware (BrainSlayer build) on my ASUS RT-AC5300 (Broadcom BCM4709) router (that I bought from FlashRouters more than a year ago), setting up (resetting it before, after, etc.), the Basics, the WiFi, an ExpressVPN OpenVPN and a VPN Guest Network.

As it is well known (I suppose), there are problems with filling the PBR (Policy based Routing) field, using the Web Interface, on the Services->VPN page.

Without filling the PBR the VPN traffic uses the ExpressVPN DNS servers, without any DNS Leak (by the way, strangely, I am not able to ping the www.netflix.com site).

As soon as I fill (and apply - even rebotting everything) the PBR field, everything goes wrong and is not possible to browse a lot of sites...

Using the Startup Script written by eibgrad (ticket #5690), things start to go right, but the VPN traffic does not use the ExpressVPN DNS servers, it uses the Static DNS 1 server, set by me (Setup->Basic Setup page) for the local traffic.

For me, using the Static DNS 1 server for the VPN traffic, shoud be consider a DNS Leak (by the way, in this case, I am able to ping and browse the www.netflix.com site, but not to stream from it - maybe, detecting the DNS leaks, they suppose I am using a VPN).

Unless a member from the forum ask me to create a new ticket, I do not think it will be a useful idea to do that.

I think I will have to wait for a new BS build... Anyway, I will try the v3.0-r36070 kongac (Kong) build (2018-05-31) to see if I am able to find better results...

Regards,
Ernesto.

P.S.: this is my first forum message... sorry for my English... it is not my mother tongue.
Sponsor
grc
DD-WRT User


Joined: 11 Jul 2018
Posts: 66

PostPosted: Mon Aug 20, 2018 20:40    Post subject: Reply with quote
look at the solution from eibgrad with second instance of Dnsmasq for VPN traffic in this thread:
https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=288986&postdays=0&postorder=asc&start=0

to prevent VPN server from pushing DNS use -- pull-filter ignore "dhcp-option DNS" -- in OpenVPN client additional config

for me it works flawlessly
eibgrad
DD-WRT Guru


Joined: 18 Sep 2010
Posts: 8034

PostPosted: Tue Aug 21, 2018 1:22    Post subject: Reply with quote
If you have SFE (Shortcut Forwarding Engine) enabled on the Setup page (not all routers have this option), disable it. It is known to have compatibility issues w/ PBR.

Also, Brainslayer handles the DNS server(s) pushed from the OpenVPN provider differently than Kong.

https://svn.dd-wrt.com/ticket/6320

In the case of Brainslayer, unless YOU install those static DNS servers as static DNS entries, any DNS options pushed from the OpenVPN provider are ignore. In order for those pushed DNS servers to be automatically processed and cause DNSMasq to be reconfigured to use them, you *must* use the Kong builds.
elsuva
DD-WRT Novice


Joined: 20 Aug 2018
Posts: 9
Location: Buenos Aires, Argentina

PostPosted: Tue Aug 21, 2018 2:29    Post subject: Reply with quote
Thank you for the answers!

I am having SFE disabled (I knew that there were some problems with it and the PBR).

I want that the VPN traffic uses the DNS servers from my OpenVPN provider (ExpressVPN)... that would be no DNS leaks for me. Therefore, I will try the v3.0-r36070 kongac (Kong) build (2018-05-31)...

I will write about the results.

Regards,
Ernesto.
grc
DD-WRT User


Joined: 11 Jul 2018
Posts: 66

PostPosted: Tue Aug 21, 2018 5:27    Post subject: Reply with quote
thank you eibgrad for clarifying this. I appreciate your work very much.

eibgrad wrote:
you *must* use the Kong builds.


but in this case ISP's traffic must use pushed DNS too (e.g. 10.4.0.1 which is accessible only over tunnel) - a kind of DNSleak.
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 3646
Location: Netherlands

PostPosted: Tue Aug 21, 2018 8:24    Post subject: Reply with quote
I am using Kong's build (and a lot of @eibgrad's recommended settings and scripts) but even with Kong's build there can be a DNS leak. If your WAN interface is set to automatic the ISP DNS server is automatically added to the DNS server list. It is on the bottom of the list but if other DNS servers are slow then it can respond.
The easiest method is to enable "Query Strict Order" on the Services page, however this is of course not fool proof (@Eibgrad will not approve Smile ) (I am using this method, lazy as I am)

Perhaps a better option is to use the no-resolv directive added in the DNSMasq options followed with the public DNS servers of your VPN Provider i.e.
Code:
no-resolv
server=208.67.222.123
server=208.67.220.123


But this still sends the DNS traffic through the WAN interface although always to the right DNS server.

I know @EIbgrad has an advanced PBR script which also routes DNS traffic through the VPN tunnel, if i am not mistaken.

If you do really need that he will point you in the right direction

_________________
Routers:Netgear R7800, Netgear R6400v1, Netgear R6400v2, Linksys EA6900 (XvortexCFE), Linksys E2000 (converted WRT320N), WRT54GS v1.
Install guide Linksys EA6900: http://www.dd-wrt.com/phpBB2/viewtopic.php?t=291230
Simple PBR (Policy Based Routing) script: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318662
Install guide R6400v2:http://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
OpenVPN server setup guide:
https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318795
Install guide R7800: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
elsuva
DD-WRT Novice


Joined: 20 Aug 2018
Posts: 9
Location: Buenos Aires, Argentina

PostPosted: Tue Aug 21, 2018 21:32    Post subject: Reply with quote
First of all... thank you for all your replies!

Having the purpose of being sure that I have explained well this issue, I will add the following:

When I have up and running an OpenVPN without using any PBR, my VPN traffic (only) use one of the DNS Servers from my VPN provider (ExpressVPN in my case)… BUT… when I use the PBR… it starts to use one of the static DNS Servers I filled on the Setup -> Basic Setup of the Web GUI! Not a DNS server from my VPN provider!

This is (when I use PBR) what I think is a DNS Leak… (and, maybe consider a bug).

Let me give you some more data… first of all, I tell you that I started trying different Static DNS servers… finally choosing the following OpenNIC DNS Servers (filling the three Static DNS fields on the Setup -> Basic Setup page):
172.98.193.42
162.248.241.94
128.52.130.209

The following results confirm what I am telling you… using the ExpressVPN Internet test pages…

WHEN... I have up and running the OpenVPN WITHOUT USING any PBR, these are the results…

"What is my IP address location?
Protection green ExpressVPN Connected
You’re connected to: USA - New Jersey - 3
ExpressVPN IP address: xxx.xxx.xxx.xxx (Sorry, but I do not want to make public the IP #)
IP address secure: The websites you visit cannot use your IP address to identify you."

"DNS Leak Test
Protection green ExpressVPN Connected
You’re connected to: USA - New Jersey - 3
All DNS requests are going through ExpressVPN's encrypted, private servers. No DNS leaks detected. You’re using ExpressVPN’s secure DNS servers.
IP address: xxx.xxx.xxx.yyy (Sorry, but I do not want to make public the IP #) Provider: ExpressVPN Country: USA - New Jersey - 3".

"WebRTC Leak Test
Protection green ExpressVPN Connected
You’re connected to: USA - New Jersey - 3
Your browser is not leaking your IP address to the websites you visit. No WebRTC leak detected. ExpressVPN is protecting you from WebRTC leaks.
IP address: 192.168.11.100 Type: Local Status: No leak
IP address: xxx.xxx.xxx.xxx (Sorry, I do not want to make public the IP #) Type: Public IPv4 (ExpressVPN) Status: No leak".

BUT WHEN... I have up and running the OpenVPN USING the PBR, these are the results…

"What is my IP address location?
Protection green ExpressVPN Connected
You’re connected to: USA - New Jersey - 3
ExpressVPN IP address: zzz.zzz.zzz.zzz (Sorry, I do not want to make public the IP #)
IP address secure: The websites you visit cannot use your IP address to identify you."

"DNS Leak Test
Protection yellow ExpressVPN Connected
You’re connected to: USA - New Jersey - 3
DNS requests exposed! Whoever runs your DNS servers can log every website you visit.
IP address: 172.98.193.42 (THIS IS THE IP # OF MY FIRST OpenNIC DNS SERVER!!!) Provider: Centrilogic Country: United States".

"WebRTC Leak Test
Protection green ExpressVPN Connected
You’re connected to: USA - New Jersey - 3
Your browser is not leaking your IP address to the websites you visit. No WebRTC leak detected. ExpressVPN is protecting you from WebRTC leaks.
IP address: 192.168.11.100 Type: Local Status: No leak
IP address: zzz.zzz.zzz.zzz (Sorry, I do not want to make public the IP #) Type: Public IPv4 (ExpressVPN) Status: No leak".

For me... it is clear that my DNS requests are being routing to my first OpenNIC DNS Server and not to an ExpressVPN’s secure DNS Server when I use PBR!!!

I think that the correct DD-WRT firmware behaviour should be that the VPN traffic should use the ExpressVPN's secure DNS Server with or without using the PBR.

The Kongac builds (in particular the v3.0-r36070 kongac (Kong) build (2018-05-31)), how do they behave with the PBR filled?

Regards,
Ernesto.
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 3646
Location: Netherlands

PostPosted: Thu Aug 23, 2018 7:25    Post subject: Reply with quote
What you are experiencing has been extensively documented by @Eibgrad et al.

There are basically two prombless:
1. Which DNS server is used:
ExpressVPN pushes its DNS servers to you, but firmware from BS does not use them, Kong's firmware does use them those pushed DNS servers are set on the top of the list before the statically set DNS servers.
(you can use Winscp or telnet to go to your router and look in the /tmp directory for resolv.dnsmasq where the DNS servers are stored)

But as DNSMasq normally takes the DNS server which is the quickest it can use the ones from your static DNS unless you enable strict order (this is not a full proof solution). Furthermore if you are using a dynamically configured WAN the ISP DNS server is added to the list of DNS servers and that would be your ISP's (a bug). So even with strict order set eventually, (if all DNS servers before that fail) your ISP's DNS server can be used.

To counter that use the no-resolv directive and set the express VPN servers (they have to be publicly available) see my earlier posting.

The second problem is that the DNS query uses the WAN interface and not the VPN if PBR is active, so with no-resolv etc, DNS queries are send to the right DNS server but over the internet so can theoretically be intercepted, and if you are a high level target by the government I would consider that a DNS leak.

If you do not want that then use one of @eibgrad's advanced PBR scripts, that can route DNS queries via the VPN.

This has all been extensively researched and documented by @Eibgrad, so you should not have to do all that testing (although it can be fun Smile )

_________________
Routers:Netgear R7800, Netgear R6400v1, Netgear R6400v2, Linksys EA6900 (XvortexCFE), Linksys E2000 (converted WRT320N), WRT54GS v1.
Install guide Linksys EA6900: http://www.dd-wrt.com/phpBB2/viewtopic.php?t=291230
Simple PBR (Policy Based Routing) script: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318662
Install guide R6400v2:http://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
OpenVPN server setup guide:
https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318795
Install guide R7800: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
elsuva
DD-WRT Novice


Joined: 20 Aug 2018
Posts: 9
Location: Buenos Aires, Argentina

PostPosted: Fri Aug 24, 2018 14:53    Post subject: Reply with quote
Thank you!

Anyway I have tried the v3.0-r36070 kongac (Kong) build (2018-05-31)) before reading your reply...

For the record...The behaviour is exactly the same...

"When I have up and running an OpenVPN without using any PBR, my VPN traffic (only) use one of the DNS Servers from my VPN provider (ExpressVPN in my case)… BUT… when I use the PBR… it starts to use one of the static DNS Servers I filled on the Setup -> Basic Setup of the Web GUI! Not a DNS server from my VPN provider!"

Nevertheless, the Kong version do not need the Startup Script written by eibgrad (ticket #5690).

Regards,
Ernesto.
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 3646
Location: Netherlands

PostPosted: Fri Aug 24, 2018 15:59    Post subject: Reply with quote
That is possible if the Express VPN servers are not publicly available, but only through the tunnel
Or you do not have "strict order" enabled

After changing anything be sure to reboot.

The DNS servers can be found in /tmp/resolv.dnsmasq, use winscp or telnet to your router and do
cat /tmp/resolv.dnsmasq

But as said the following added to the DNSMasq options will not read the resolv.dnsmasq and use only the server=

Code:
no-resolv
server= 209.244.0.3 #level3
server= 209.244.0.4 #level3


At least that is how it is supposed to work and instead of the level3 servers you can set the Express VPN servers if they are publicly available

Be sure to reboot Smile

Oh and if you are testing from within your network, check if routers higher up do not have the "Forced DNS Redirection" enabled (I once heard that BT has this so that you always used their DNS servers, and then the only way is to use the VPN tunnel)

And if yo want to use the tunnel and PBR use one of @eibgrad's advanced scripts

_________________
Routers:Netgear R7800, Netgear R6400v1, Netgear R6400v2, Linksys EA6900 (XvortexCFE), Linksys E2000 (converted WRT320N), WRT54GS v1.
Install guide Linksys EA6900: http://www.dd-wrt.com/phpBB2/viewtopic.php?t=291230
Simple PBR (Policy Based Routing) script: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318662
Install guide R6400v2:http://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
OpenVPN server setup guide:
https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318795
Install guide R7800: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
grc
DD-WRT User


Joined: 11 Jul 2018
Posts: 66

PostPosted: Fri Aug 24, 2018 16:21    Post subject: Reply with quote
do you have something in "additional dnsmasq options" field on Services page?
elsuva
DD-WRT Novice


Joined: 20 Aug 2018
Posts: 9
Location: Buenos Aires, Argentina

PostPosted: Fri Aug 24, 2018 16:42    Post subject: Reply with quote
interface=tun1
elsuva
DD-WRT Novice


Joined: 20 Aug 2018
Posts: 9
Location: Buenos Aires, Argentina

PostPosted: Fri Aug 24, 2018 20:58    Post subject: Reply with quote
Answering egc...

The ExpressVPN DNS servers are not publicly available.
I do have "strict order" enabled.
I always reboot everything after changes.
I do not have higher up routers.
I do not know if eibgrad has an advanced script to achieve similar DNS traffic with and without using PBR. If he has one, I am ready to try it.

Regards,
Ernesto.
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 3646
Location: Netherlands

PostPosted: Sat Aug 25, 2018 8:40    Post subject: Reply with quote
Well the fact that Express VPN servers are not publicly available means that you can not use them when using PBR.
So either use other DNS servers you trust and set them in static DNS with Enable "Query DNS in strict order" or better use the following in DNSMAsq options
Code:
no-resolv
server=[IP address of trusted DNS server]
server=[IP address of trusted DNS server]


Or use @Eibgrad's advanced script: https://pastebin.com/nC27ETsp
Note:
You need storage.g. USB stick
The script handles everything, so do not use PBR in the GUI, disable NAT loopback, and QOS does not work

Normally @Eibgrad himself will advise you, he is our real expert, but I think he is on holiday (at least I hope, he deserves it, he is one of the most helpfull and knowledgeable forum members)

_________________
Routers:Netgear R7800, Netgear R6400v1, Netgear R6400v2, Linksys EA6900 (XvortexCFE), Linksys E2000 (converted WRT320N), WRT54GS v1.
Install guide Linksys EA6900: http://www.dd-wrt.com/phpBB2/viewtopic.php?t=291230
Simple PBR (Policy Based Routing) script: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318662
Install guide R6400v2:http://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
OpenVPN server setup guide:
https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318795
Install guide R7800: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
elsuva
DD-WRT Novice


Joined: 20 Aug 2018
Posts: 9
Location: Buenos Aires, Argentina

PostPosted: Sat Aug 25, 2018 14:12    Post subject: Reply with quote
Thank you egc!
Goto page 1, 2  Next Display posts from previous:    Page 1 of 2
Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Advanced Networking All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You cannot download files in this forum