As you may have seen, Mullvad is reporting a VPN leak affecting, as far as I understand, all Android versions.
I know mullvad is planning to release an update, but it only updates 1 out of 2 leaks.
Can anyone please confirm this also affects GrapheneOS?
Is there anything else people should be doing?
https://www.mullvad.net/en/blog/2024/5/3/dns-traffic-can-leak-outside-the-vpn-tunnel-on-android/
This is the DNS leak I found in the context of GrapheneOS a few weeks ago.
Configuring private DNS in Android settings plus VPN can help solve the problem?
Stewart
is this correct?
Is using built-in IPSec / IKEv2 VPN client the best mitigation as of now?
Or what else we can practically do to prevent DNS leaks?
For WiFi you can try using IP-based VPN app (such as official WireGuard app) or built-in IPSec / IKEv2 with non-routable DNS address, such as 0.0.0.0, 127.0.0.1, or using public blackhole servers - 192.175.48.1, 192.175.48.6, and 192.175.48.42. For mobile network - no idea...
You can also use router rules and/or router rules + local DNS server.
RethinkDNS may also do the trick because it can use built-in encrypted DNS, but I don't know if does so outside VPN tunnels.
DeletedUser115 There aren't known issues with the built-in VPN support. There are only known issues with VPN apps and we haven't yet determined if the apps can be doing something to prevent all of it themselves.
OpenSource-Ghost Thanks! Is DNS configured in the Owner profile applies to all user profiles?
GrapheneOS Thank you, that's good to know the built-in VPN client is not affected.
GrapheneOS So as I understand this issue only occurs when a disconnect happens from the VPN side exposing the DNS. But wouldn't graphene's own "always on VPN" service prevent the leak since it waits for the VPN to re-connect before releasing traffic? (assuming the user has "always on VPN" turned... on)
PenPusher No, unfortunately, that is the issue. Even when "always on VPN" and "block connections not going over VPN" are enabled, DNS will leak in rare circumstances. The issue is apparently very hard to fix due to how DNS is implemented in relation to app based VPNs, but the GrapheneOS developers are working on a solution.
If you use the built-in VPN support instead of a VPN app, no leak will ever happen. The official Wireguard VPN app seemed to be more robust than some VPN provider specific ones, if you need to use Wireguard.
mmmm I tried to setup a native IPSec / IKEv2 client with Proton VPN but couldn't make it work. If you succeed, please post your settings, thank you 🌷
