Network Manager DNS Caching Without DNS Leaks Using systemd-resolved
The default DNS caching method in NetworkManager is dnsmasq. It works well enough for most people but has a serious design bug that causes DNS leaks when using VPN through NetworkManager .
How does this happen? NetworkManager uses dbus to send dnsmasq a new list of nameservers when connecting to VPN. Instead of discarding the current list, like say, 192.168.0.1, or whatever your ISP gave you, it adds the new nameservers to its rotation.
For example, if your nameserver was previously pointing at your router, like 192.168.0.1, and your VPN's nameserver is 10.0.0.1, after connecting to your VPN, you will send half of your requests to 192.168.0.1, and the other half to 10.0.0.1. This is a huge security failure can leak self-incriminating DNS requests to a public DNS server, especially when one is using VPN to research sensitive topics.
To fix these DNS leaks but also preserve the DNS caching dnsmasq is typically used for, you can use systemd-resolved. In it's default configuration, it listens to requests on 127.0.0.53 and caches most nameservers for about 5 minutes maximum. The good part is when NetworkManager gives systemd-resolved a new list of nameservers, it erases the previous ones from rotation, preventing DNS leaks outside the VPN itself.
How to set up:
1a. Enable and start systemd-resolved.
You can first start and enable systemd-resolved to run at start with the following commands:
:: Code ::# systemctl enable systemd-resolved.service
# systemctl start systemd-resolved.service
1b. Install nss-resolve module
If you're running Debian or Ubuntu, make sure the nss-resolve module is installed.
:: Code ::# apt-get install libnss-resolve:amd64 libnss-resolve:i386
Or if you're system is only one architecture, simply install libnss-resolve.
1c. Configure /etc/nsswitch.conf
Edit /etc/nsswitch.conf, and make sure the following line is before dns on the hosts line.
If you need a more visual example, freedesktop.org explains what you need to do: www.freedesktop.org/software/systemd/man/nss-resolve.html
2. Update NetworkManager.conf
Edit /etc/NetworkManager/NetworkManager.conf, and update the dns= line to dns=systemd-resolved. If your configuration is empty (as is on new distributions), you can simply add the following:
:: Code ::[main]
3. Restart NetworkManager.
You can issue a restart, but I found that that sometime causes the plasma NM icon to disappear. Stopping, waiting, then starting tends to avoid that problem.
:: Code ::# systemctl stop NetworkManager.service
# systemctl start NetworkManager.service
You're done! Enjoy DNS caching through VPN without DNS leaks.
Why do DNS queries fail randomly and succeed after some persistence? Probably because you might be running a mixed network that has DNSSEC support, while some DNS servers in your rotation do not. For example, if your router is providing DNS caching, but you're also falling back to a Google DNS like 22.214.171.124. The short term fix is to turn off DNSSEC.
Edit /etc/systemd/resolved.conf, uncomment or add the line for DNSSEC, and set it equal to no. It should be, DNSSEC=no
Back to top
All times are GMT - 8 Hours