1

How do I know if my applications are leaking DNS and what are the methods preventing Tor DNS leaks?

This question is not about all traffic as asked here, and not about testing it, but it's specific for preventing DNS leaks.

Improve this question
2
  • This question is not about all traffic as asked here, and not about testing it, but it's specific for preventing DNS leaks. The other is just about redirecting all traffic via proxy, which may be differ from preventing just DNS leaks.
    – kenorb
    Commented May 20, 2016 at 8:48
  • I shared a DNS leak problem I had when using OpenVPN and solutions to prevent it (setting custom DNS servers and using a firewall): askubuntu.com/questions/761684/… These tips can be applied for Tor also. I think I did not have DNS leaks when using Tor browser because it is a customized Firefox that is using Tor as a proxy and tunneling DNS by default with network.proxy.socks_remote_dns.
    – baptx
    Commented Jan 14, 2018 at 15:46

2 Answers 2

Reset to default
2

Related question: How can I test an application for proxy leaks? (duplicate?)

Viewing the traffic can tell you if they have leaked, nothing short of thorough code review can tell you if it ever will leak. The fact that nothing has gone wrong should not be taken as an indication that nothing will go wrong. For example, you might find that there are weird edge cases that you almost never use which do result in taking a strange code-path that skips your proxy settings. There are quite a few patches that Tor Browser applies to Firefox to ensure "Proxy Obedience".

Since large and complex code bases are infeasible for a personal effort to audit (and even if you did audit them now, who knows what they'd do next release), you should consider using a restrictive set of packetfilter rules, to ensure that traffic that does not leave through Tor is not allowed to leave at all, that it "fails closed". You can see how this might be approached by looking at how tails currently sets up it's iptables rules through ferm.conf

You should also consider not using apps that haven't been through any kind of robust testing for privacy and anonymity implications. Worse than a DNS leak might be applications leaking identifying information as part of their normal functionality and no amount of packet filtering or isolating proxies will solve that problem.

(Considering only accidental leaks to be in scope here, not a malicious attempt to subvert anti-leaking measures...that question is a deep dark rabbithole)

Improve this answer
2

I do recommend to use an anonymizing routing box and make a tcpdump running on it's internal interface where your device/PC is connected. Every leak will be hard routed to/through Tor via firewall or local DNS server, but you will see what leaks and where to. I'm using this method when evaluating mobile devices

Improve this answer

Not the answer you're looking for? Browse other questions tagged .