DNS Leak Case Study: A Stand-In VPN Client Sends 81 Queries to the Home Router While It Reconnects
A stand-in VPN client sent 81 DNS queries to the home router while it reconnected, every one outside the tunnel. Lab caught it in VPN Works 0.2.0. VPN Works now runs tunnels of its own, and the lessons went straight into its WireGuard path.
Lab was a test bench for VPN apps: run one in a private network, keep a probe sending traffic, and break things on a timetable. In this case the VPN server fell silent for five seconds, and two stand-in clients went through the same outage. One had a fault planted on purpose: while it reconnected, it pointed its DNS at the home router. Lab’s observers counted 81 queries arriving at the router’s resolver, every name the probe looked up while the client reconnected. Its kill switch held everything else, and the correct client leaked nothing.
A leak like that tells anyone on the local network, the café’s Wi-Fi or the hotel’s, which names the user looks up, while the VPN app shows a green light.
The Same Lessons, Built In
VPN Works 0.4.0 runs WireGuard tunnels itself, so it had to get DNS right from the start:
Lookups go through the tunnel. vpnw sends them to the DNS servers in the WireGuard config, inside the tunnel. There’s no system resolver in the path.
No quiet fallback. A config without a DNS server is refused, unless you ask for lookups on your own machine with --dns local. That decision is made once, out loud, never in the middle of a reconnect.
A DNS server the tunnel would drop is refused. If the config’s DNS server is outside the tunnel’s AllowedIPs, every lookup would vanish. vpnw refuses the config at the start instead.
No tunnel, no program. Before the program starts, vpnw waits for a handshake. If the tunnel isn’t up, the program never runs, so there’s no window where it could go around it.
The tests check that the DNS server inside a test tunnel sees the lookups, which shows they went through it.
Lab’s Next Job
Lab comes back as the test every tunnel must pass before it ships, built in or from a plugin: a peer that falls silent, a lost handshake, a route pushed by a hostile network. Lab