Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

DNS leak with 3.17.3 #343

Closed
ph202107 opened this issue Mar 30, 2024 · 27 comments
Closed

DNS leak with 3.17.3 #343

ph202107 opened this issue Mar 30, 2024 · 27 comments
Assignees
@paulams
Labels
bug Something isn't working

Comments

@ph202107
Copy link

ph202107 commented Mar 30, 2024 •
edited
Loading

Hi! Version 3.17.2 is working fine but I seem to have a DNS leak with 3.17.3. I'm using Linux Mint 21.3 (based on Ubuntu 22.04) on bare metal, and have tested with Custom-DNS enabled (Cloudflare) and disabled. I tested with IPv6 disabled in grub, and tested with IPv6 disabled in sysctl.conf. The problem persists after reconnecting the VPN and after rebooting the computer.

Steps to reproduce:

  • connect to VPN
  • visit https://dnscheck.tools/ or https://ipleak.net/
  • Nord (or Cloudflare) DNS servers are detected, along with my ISP DNS servers
  • my ISP DNS servers show both IPv4 and IPv6 addresses, Nord shows IPv4 addresses
  • the site https://test-ipv6.com/ states: "Your DNS server (possibly run by your ISP) appears to have IPv6 Internet access."

When using version 3.17.2 everything works as expected. Only Nord IPv4 DNS addresses are detected on https://dnscheck.tools/ and on https://test-ipv6.com/ it states: "Your DNS server (possibly run by your ISP) appears to have no access to the IPv6 Internet, or is not configured to use it."

With IPv6 disabled in grub (GRUB_CMDLINE_LINUX_DEFAULT="ipv6.disable=1")

$ nordvpn --version
NordVPN Version 3.17.3

$ nordvpn settings
Technology: NORDLYNX
Firewall: enabled
Firewall Mark: 0xe1f1
Routing: enabled
Analytics: enabled
Kill Switch: enabled
Threat Protection Lite: disabled
Notify: disabled
Auto-connect: disabled
IPv6: disabled
Meshnet: disabled
DNS: disabled
LAN Discovery: disabled
Allowlisted subnets:
	192.168.1.0/24
	
$ nordvpn status
Status: Connected
Hostname: us6883.nordvpn.com
IP: 89.187.182.96
Country: United States
City: Chicago
Current technology: NORDLYNX
Current protocol: UDP
Transfer: 0.64 MiB received, 223.27 KiB sent
Uptime: 5 minutes 49 seconds

Mar 29 20:56:11 hp nordvpnd[19704]: 2024/03/29 20:56:11 [Info] Setting the routing rules up
Mar 29 20:56:11 hp nordvpnd[19704]: 2024/03/29 20:56:11 [Info] starting network configuration
Mar 29 20:56:11 hp nordvpnd[19704]: 2024/03/29 20:56:11 [Info] setting dns to 103.86.96.100 103.86.99.100
Mar 29 20:56:11 hp nordvpnd[19704]: 2024/03/29 20:56:11 [Info] set dns for interface [nordlynx] using: resolved
Mar 29 20:56:11 hp nordvpnd[19704]: 2024/03/29 20:56:11 [Info] IPv6 module is not enabled
Mar 29 20:56:11 hp nordvpnd[19704]: 2024/03/29 20:56:11 [Info] IPv6 module is not enabled
Mar 29 20:56:11 hp nordvpnd[19704]: 2024/03/29 20:56:11 POST_CONNECT system info:
Mar 29 20:56:11 hp nordvpnd[19704]: Routes for ipv4:

$ cat /sys/module/ipv6/parameters/disable
1

$ cat /proc/sys/net/ipv6/conf/all/disable_ipv6
cat: /proc/sys/net/ipv6/conf/all/disable_ipv6: No such file or directory

$ cat /etc/resolv.conf
nameserver 127.0.0.53
options edns0 trust-ad
search .

Commands from previous issue if these will help: #243

$ ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
2: eno1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether c8:d3:ff:a3:00:50 brd ff:ff:ff:ff:ff:ff
    altname enp0s31f6
    inet 192.168.1.199/24 brd 192.168.1.255 scope global dynamic noprefixroute eno1
       valid_lft 83848sec preferred_lft 83848sec
4: nordlynx: <POINTOPOINT,UP,LOWER_UP> mtu 1420 qdisc noqueue state UNKNOWN group default qlen 1000
    link/none 
    inet 10.5.0.2/32 scope global nordlynx
       valid_lft forever preferred_lft forever

$ sudo iptables -S
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-A INPUT -s 192.168.1.0/24 -i eno1 -m comment --comment nordvpn -j ACCEPT
-A INPUT -i eno1 -m connmark --mark 0xe1f1 -m comment --comment nordvpn -j ACCEPT
-A INPUT -i eno1 -m comment --comment nordvpn -j DROP
-A OUTPUT -d 192.168.1.0/24 -o eno1 -m comment --comment nordvpn -j ACCEPT
-A OUTPUT -o eno1 -m mark --mark 0xe1f1 -m comment --comment nordvpn -j CONNMARK --save-mark --nfmask 0xffffffff --ctmask 0xffffffff
-A OUTPUT -o eno1 -m connmark --mark 0xe1f1 -m comment --comment nordvpn -j ACCEPT
-A OUTPUT -o eno1 -m comment --comment nordvpn -j DROP

$ sudo ip6tables -S
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-A INPUT -i eno1 -m connmark --mark 0xe1f1 -m comment --comment nordvpn -j ACCEPT
-A INPUT -i eno1 -m comment --comment nordvpn -j DROP
-A INPUT -p udp -m multiport --dports 4000,5353 -j ACCEPT
-A INPUT -p tcp -m multiport --dports 4000 -j ACCEPT
-A INPUT -p udp -m multiport --dports 5353 -j ACCEPT
-A OUTPUT -o eno1 -m mark --mark 0xe1f1 -m comment --comment nordvpn -j CONNMARK --save-mark --nfmask 0xffffffff --ctmask 0xffffffff
-A OUTPUT -o eno1 -m connmark --mark 0xe1f1 -m comment --comment nordvpn -j ACCEPT
-A OUTPUT -o eno1 -m comment --comment nordvpn -j DROP

$ ip route show table all
default dev nordlynx table 205 scope link 
default via 192.168.1.254 dev eno1 proto dhcp metric 20100 
169.254.0.0/16 dev eno1 scope link metric 1000 
192.168.1.0/24 dev eno1 proto kernel scope link src 192.168.1.199 metric 100 
local 10.5.0.2 dev nordlynx table local proto kernel scope host src 10.5.0.2 
local 127.0.0.0/8 dev lo table local proto kernel scope host src 127.0.0.1 
local 127.0.0.1 dev lo table local proto kernel scope host src 127.0.0.1 
broadcast 127.255.255.255 dev lo table local proto kernel scope link src 127.0.0.1 
local 192.168.1.199 dev eno1 table local proto kernel scope host src 192.168.1.199 
broadcast 192.168.1.255 dev eno1 table local proto kernel scope link src 192.168.1.199 

$ ip -6 route show table all

$ ip rule
0:	from all lookup local
32764:	from all lookup main suppress_prefixlength 0
32765:	not from all fwmark 0xe1f1 lookup 205
32766:	from all lookup main
32767:	from all lookup default

$ ip -6 rule
RTNETLINK answers: Address family not supported by protocol
Dump terminated

$ sysctl -a 2> /dev/null | grep disable_ipv6

$ nmcli dev show | grep -E 'DNS|DEVICE'
GENERAL.DEVICE:                         eno1
IP4.DNS[1]:                             192.168.1.254
IP4.DNS[2]:                             <ISP DNS>
GENERAL.DEVICE:                         nordlynx
GENERAL.DEVICE:                         lo

Please let me know if more information is required. I will continue to use 3.17.2 for now. Thanks!
@ph202107
Copy link
Author

I've been able to test with a second Linux Mint 21.3 computer (bare metal) and can reproduce the same issue. 3.17.2 is working OK but 3.17.3 appears to have a DNS leak, with the website https://dnscheck.tools/ detecting my ISP DNS servers

I also tested on a Ubuntu 22.04 virtual machine. I have the VPN connected on the VM and disconnected on the host, IPv6 is disabled in grub. I could not reproduce the same issue, both 3.17.2 and 3.17.3 seem to be working OK.

@tm4ig
Copy link

tm4ig commented Mar 30, 2024

I confirm, after upgrade nordvpn to 3.17.3 (on ubuntu 22.04) DNS leak appears

@s-n-g
Copy link

s-n-g commented Mar 31, 2024

Confirmed, on manjaro and mx linux
Downgraded to 3.17.2

@groverj3
Copy link

Confirmed on manjaro using the most recent AUR, which is based on the current Ubuntu .deb package.

Downgraded to 3.17.2 as well.

@SolitudeX13
Copy link

Confirmed on Arch using the latest AUR version based on the .deb package from upstream source.
Downgraded to 3.17.2 to resolve problem

@jrichard326
Copy link

Confirmed on fully updated Manjaro xfce Unstable. Downgraded from 3.17.3-1 to 3.17.2-1 as 3.17.2 does not exhibit this behavior. I am using nordlynx (wireguard) and systemd-resolved as DNS resolver.

Version 3.17.3 shows via dns leaktest both nord DNS and my default DNS settings via my router configuration.

@groverj3
Copy link

Also confirmed on Ubuntu 22.04.

@Bazza70
Copy link

Bazza70 commented Mar 31, 2024

Cannot reproduce on Mint 21.3 running 3.17.3. However, I am forcing all traffic thru Nordlynx via UFW rules. No idea if that should make a difference.

With Nordlynx enabled and killswitch disabled:

sudo ufw default deny incoming
sudo ufw default deny outgoing
sudo ufw allow out on nordlynx from any to any

@paulams
Copy link

paulams commented Apr 2, 2024

Thank your for reporting the issue! We are looking into it.

@paulams paulams self-assigned this Apr 2, 2024
@MyXelf
Copy link

MyXelf commented Apr 3, 2024

Confirming in KDE Neon 22.04 as well.

I guess the issue is related to the fact that NordVPN is not using its own declared DNS Servers. After establishing the VPN it keeps using the "locally" declared DNS for the resolution.

Reverting to 3.17.2 works as expected.

@mariusSincovici mariusSincovici added the bug Something isn't working label Apr 3, 2024
@mariusSincovici
Copy link
Contributor

We've identified the problem and we'll try to release an app update as soon as possible.

Until the release, there are some possible workarounds for this:

  1. disable LAN access or remove LAN IP range from Allowlisted subnets.
  2. If LAN access is needed then best solution would be to downgrade to 3.17.2 for the moment.

@jfbourdeau
Copy link

sorry for that noobie question : how to downgrade to 3.17.2 on Manjaro linux ? I tried sudo manjaro-downgrade nordvpn-bin but it didn't worked.

@s-n-g
Copy link

s-n-g commented Apr 4, 2024

Download this: aur-e4dbfacf758c41a3514702d25779ececc18f1bf9.tar.gz

Extract it in a dir
get in it and

makepkg -si

@jfbourdeau
Copy link

jfbourdeau commented Apr 4, 2024 •
edited
Loading

tks !
I went into this folder and ran the command and got this
ERROR: PKGBUILD does not exist
https://i.imgur.com/FFeGNA0.png

Noobie mistake I guess
I didn't downloaded your file though.... only the one from github

@s-n-g
Copy link

s-n-g commented Apr 4, 2024

ok, whatever works 😉

@mariusSincovici
Copy link
Contributor

version 3.17.4 is released, please update and let us know in case you still have any issues.
Thanks

@s-n-g
Copy link

s-n-g commented Apr 5, 2024

Not updated yet?

https://github.com/NordSecurity/nordvpn-linux/releases

@s-n-g
Copy link

s-n-g commented Apr 5, 2024

Just updated to 0.17.4 on a mint box and I can confirm it is fixed!
Waiting for other distros to catch up...

Thanks for the update!

@mariusSincovici
Copy link
Contributor

released now also on the github.

@jrichard326
Copy link

Screenshot_2024-04-05_06-42-39
3.17.4-1 fixed the issue here. Thank you.

@fhdk
Copy link

fhdk commented Apr 5, 2024 •
edited
Loading

If you setup your ArchLinux based system using systemd-resolved there is no DNS leak.

https://wiki.archlinux.org/title/NordVPN#Setting_systemd-resolved_as_DNS_resolver
https://forum.manjaro.org/t/help-downgrading-an-aur-package/159354/8
https://forum.manjaro.org/t/root-tip-nordvpn-on-manjaro/81016

@jfbourdeau
Copy link

I will wait for the new version to be available in AUR (for my manjaro installation).
I tried to follow some git clone package install instructions without success (I am not good at that)

@fhdk
Copy link

fhdk commented Apr 5, 2024 •
edited
Loading

@jrichard326 what is so special with your system?

I don't have leaking using systemd-resolved

 $ inxi -S
System:
  Host: tiger Kernel: 6.6.25-1-MANJARO arch: x86_64 bits: 64
  Desktop: KDE Plasma v: 6.0.3 Distro: Manjaro Linux

 $ nordvpn --version
NordVPN Version 3.17.3

 $ nordvpn status
Status: Connected
Hostname: dk242.nordvpn.com
IP: 37.120.145.83
Country: Denmark
City: Copenhagen
Current technology: NORDLYNX
Current protocol: UDP
Transfer: 98.40 MiB received, 7.85 MiB sent
Uptime: 59 minutes 53 seconds

 $ nordvpn settings
Technology: NORDLYNX
Firewall: enabled
Firewall Mark: 0xe1f1
Routing: enabled
Analytics: enabled
Kill Switch: disabled
Threat Protection Lite: disabled
Notify: enabled
Auto-connect: disabled
IPv6: disabled
Meshnet: disabled
DNS: disabled
LAN Discovery: disabled

 $ curl https://ipv4.ipleak.net/json/
{
    "as_number": 136787,
    "isp_name": "TEFINCOM S.A.",
    "country_code": "DK",
    "country_name": "Denmark",
    "region_code": "84",
    "region_name": "Capital Region",
    "continent_code": "EU",
    "continent_name": "Europe",
    "city_name": "Copenhagen",
    "postal_code": null,
    "postal_confidence": null,
    "latitude": 55.6802,
    "longitude": 12.5892,
    "accuracy_radius": 20,
    "time_zone": "Europe\/Copenhagen",
    "metro_code": null,
    "level": "min",
    "cache": 1712319773,
    "ip": "45.10.153.168",
    "reverse": "",
    "query_text": "45.10.153.168",
    "query_type": "myip",
    "query_date": 1712319773
}

@jrichard326
Copy link

jrichard326 commented Apr 5, 2024 via email

@fhdk
Copy link

fhdk commented Apr 5, 2024 •
edited
Loading

Yours;sudo ln -sf /run/systemd/resolve/resolv.conf /etc/resolv.conf
Mine:sudo ln -sf /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf

Hmm - as I recall it the latter is in the guide as it should be - in my experience the correct - I will check immediately

I am calm again - the guide used the latter - but I recall that in the Arch Wiki on systemd-resolved has a reference to the first - I recall badly.

@MyXelf
Copy link

MyXelf commented Apr 5, 2024

On 3.17.3 the issue will only present if you have LAN Traffice enabled or have any whitelisted networks.

About to install 3.17.4 on KDE Neon 22.04 ... Result: Fixed!

Thanks!

@ph202107
Copy link
Author

ph202107 commented Apr 6, 2024

3.17.4 tested and working, no problems found. Thank You!

@ph202107 ph202107 closed this as completed Apr 6, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@paulams paulams

Labels
bug Something isn't working
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests