Date: Sun, 19 Apr 2015 01:40:53 -0700 From: Yuri <yuri@rawbw.com> To: Rui Paulo <rpaulo@me.com>, freebsd-net@freebsd.org Subject: Re: resolvconf(8) always leaves original DNS server in the list, allowing DNS requests to leak Message-ID: <55336A15.3050905@rawbw.com> In-Reply-To: <4525101.OcnIUfWoXM@akita> References: <5532F439.8070506@rawbw.com> <4525101.OcnIUfWoXM@akita>
next in thread | previous in thread | raw e-mail | index | archive | help
On 04/19/2015 00:30, Rui Paulo wrote:
> What you want requires scoped routing and scoped DNS, meaning that the network
> stack must have knowledge of what domain names a specific VPN DNS server
> resolves. The resolv.conf file is completely unsuitable for this purpose.
>
> The solution you offer is just a hack to avoid the "leak" of DNS domain names
> and doesn't really solve the bigger problem. What if the VPN DNS server
> doesn't resolve google.com?
Actually, resolvconf does support DNS scoping, at least roughly. It has
"-p" (private) flag, and in such case it only resolves domains listed in
resolv.conf. And scoped routing is supported by OpenVPN.
There is the distinction between the corporate VPN, and personal
("home") use VPN. Usually DNS in the latter one is resolving everything.
Such VPN is designed to be exclusive and to protect privacy. This is the
one I am mostly talking about. The current resolvconf works okay in the
case of the corporate VPN. In such case "-p" flag and the list of
corporate domains should be used.
Yuri
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?55336A15.3050905>