The default DNS caching method in NetworkManager is dnsmasq. It works well enough for most people but has a serious design bug that causes DNS leaks when using VPN through NetworkManager [1].

How does this happen? NetworkManager uses dbus to send dnsmasq a new list of nameservers when connecting to VPN. Instead of discarding the current list, like say, 192.168.0.1, or whatever your ISP gave you, it adds the new nameservers to its rotation.

For example, if your nameserver was previously pointing at your router, like 192.168.0.1, and your VPN's nameserver is 10.0.0.1, after connecting to your VPN, you will send half of your requests to 192.168.0.1, and the other half to 10.0.0.1. This is a huge security failure can leak self-incriminating DNS requests to a public DNS server, especially when one is using VPN to research sensitive topics.

To fix these DNS leaks but also preserve the DNS caching dnsmasq is typically used for, you can use systemd-resolved. In it's default configuration, it listens to requests on 127.0.0.53 and caches most nameservers for about 5 minutes maximum. The good part is when NetworkManager gives systemd-resolved a new list of nameservers, it erases the previous ones from rotation, preventing DNS leaks outside the VPN itself.

How to set up:

1a. Enable and start systemd-resolved.

You can first start and enable systemd-resolved to run at start with the following commands:


1b. Install nss-resolve module

If you're running Debian or Ubuntu, make sure the nss-resolve module is installed.



Or if you're system is only one architecture, simply install libnss-resolve.

1c. Configure /etc/nsswitch.conf

Edit /etc/nsswitch.conf, and make sure the following line is before dns on the hosts line.

resolve [!UNAVAIL=return]

If you need a more visual example, freedesktop.org explains what you need to do: www.freedesktop.org/software/systemd/man/nss-resolve.html

2. Update NetworkManager.conf

Edit /etc/NetworkManager/NetworkManager.conf, and update the dns= line to dns=systemd-resolved. If your configuration is empty (as is on new distributions), you can simply add the following:



3. Restart NetworkManager.

You can issue a restart, but I found that that sometime causes the plasma NM icon to disappear. Stopping, waiting, then starting tends to avoid that problem.



You're done! Enjoy DNS caching through VPN without DNS leaks.

FAQ

Why do DNS queries fail randomly and succeed after some persistence? Probably because you might be running a mixed network that has DNSSEC support, while some DNS servers in your rotation do not. For example, if your router is providing DNS caching, but you're also falling back to a Google DNS like 8.8.8.8. The short term fix is to turn off DNSSEC.

Edit /etc/systemd/resolved.conf, uncomment or add the line for DNSSEC, and set it equal to no. It should be, DNSSEC=no

[1] bugs.launchpad.net/ubuntu/+source/network-manager/+bug/1671606
Back to top