Lets say i'm using a vpn that have a DNS leak (and it shows my ISP ip for example), then I use the tor browser to browse the clear net (even HTTP sites, not only HTTPS) over that VPN.
Does ISP know what you are browsing?
Thanks.
1 Answer
Tor browser does not use regular dns, instead, it queries DNS through exit nodes using a custom cell.
Ref: https://tor.stackexchange.com/a/26/17825
Tor clients do not, in general, directly do DNS requests. When you open a connection through the tor network you usually ask your client (on its socks ports) to connect you to a hostname and port, say www.example.com:80.
Your tor client, once it has created a circuit, will send that hostname and port to the exit node in its RELAY_BEGIN cell.
The exit node will then do a DNS resolve and open a TCP connection to the target. Once that's established it will tell your client that the connection is open, and for informational purposes will also tell your client what address that hostname resolved to.
Tor, in addition to that, has some sort of "remote DNS resolve" protocol built in. This support allows clients to query for certain resource types, like IPv4 or IPv6 addresses. Here too, the exit node does the actual DNS packet sending and receiving and just relays the answer to the client.
No UDP packets are actually ever routed from the client.
