SVI/netbird
1
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-07-27 16:32:34 -04:00
Code Issues 3.0k Packages Projects Releases 10 Wiki Activity

Windows client DNS leak #1548

New Issue
Open
opened 2025-11-20 05:32:37 -05:00 by saavagebueno · 13 comments
saavagebueno commented 2025-11-20 05:32:37 -05:00
Owner
Copy Link

Originally created by @boardlord1 on GitHub (Jan 10, 2025).

Describe the problem

I've noticed that the Windows Netbird client suffers from DNS leak. I'm self-hosting Netbird in am Ubuntu Server VM behind nginx, and I also run a cli client on the same machine as a routing peer into my home LAN (and also as an exit peer).

My DNS server, Adguard home listens on my home router at 192.168.7.1:53, with Cloudflare and Quad9 as upstream resolvers.

When I connect with the Android client or from a Linux machine all is well - I only see my upstream resolvers come up on browserleaks.com. However, I connect with the Windows client, I see the resolvers of the network I'm connected to.

Isn't this because to Netbird use netmask 128.0.0.0?

Netbird status log
Peers detail:

 samsung-jetbird.netbird.selfhosted:
  NetBird IP: 100.126.117.117
  Public key: 5ieyO9Z1EjWIgF6gIefM2bZ9mxJjqR9E8IAfEfA7tFk=
  Status: Disconnected
  -- detail --
  Connection type:
  ICE candidate (Local/Remote): -/-
  ICE candidate endpoints (Local/Remote): -/-
  Relay server address:
  Last connection update: -
  Last WireGuard handshake: -
  Transfer status (received/sent) 0 B/0 B
  Quantum resistance: false
  Routes: -
  Networks: -
  Latency: 0s

 openwrt-ligetter.netbird.selfhosted:
  NetBird IP: 100.126.129.15
  Public key: bvIh3WRnvEz/gQNMz8FQQc8DgT2ypXSr/HxAZyMZnwo=
  Status: Connected
  -- detail --
  Connection type: P2P
  ICE candidate (Local/Remote): host/srflx
  ICE candidate endpoints (Local/Remote): 192.168.47.1:51825/198.51.100.0:51820
  Relay server address: rels://nb.anon-XMJBI.domain:443
  Last connection update: 5 seconds ago
  Last WireGuard handshake: -
  Transfer status (received/sent) 148 B/388 B
  Quantum resistance: false
  Routes: 192.168.5.0/24
  Networks: 192.168.5.0/24
  Latency: 11.9858ms

 samsung-netbird.netbird.selfhosted:
  NetBird IP: 100.126.169.113
  Public key: 2UO/tW8YZcQIp6VKDNdftRb+ZS3YqVadjrGv1pKxFQQ=
  Status: Disconnected
  -- detail --
  Connection type:
  ICE candidate (Local/Remote): -/-
  ICE candidate endpoints (Local/Remote): -/-
  Relay server address:
  Last connection update: -
  Last WireGuard handshake: -
  Transfer status (received/sent) 0 B/0 B
  Quantum resistance: false
  Routes: -
  Networks: -
  Latency: 0s

 netbird-vm-cli-client.netbird.selfhosted:
  NetBird IP: 100.126.220.138
  Public key: OaaNsK+ZQA0ninoQS1vWIgpPwgYyr5q23CjM3ozWrVU=
  Status: Connected
  -- detail --
  Connection type: Relayed
  ICE candidate (Local/Remote): -/-
  ICE candidate endpoints (Local/Remote): -/-
  Relay server address: rels://nb.anon-XMJBI.domain:443
  Last connection update: 6 seconds ago
  Last WireGuard handshake: 1 second ago
  Transfer status (received/sent) 3.7 KiB/21.5 KiB
  Quantum resistance: false
  Routes: 0.0.0.0/0, 192.168.7.0/24, 192.168.9.0/24
  Networks: 0.0.0.0/0, 192.168.7.0/24, 192.168.9.0/24
  Latency: 0s

 netbird-vm-docker-node.netbird.selfhosted:
  NetBird IP: 100.126.237.210
  Public key: 5UCfvdijK/2wNW+gwnpNPg+9Ul6+1T8sjG027jyz2wE=
  Status: Disconnected
  -- detail --
  Connection type:
  ICE candidate (Local/Remote): -/-
  ICE candidate endpoints (Local/Remote): -/-
  Relay server address:
  Last connection update: -
  Last WireGuard handshake: -
  Transfer status (received/sent) 0 B/0 B
  Quantum resistance: false
  Routes: -
  Networks: -
  Latency: 0s

OS: windows/amd64
Daemon version: 0.35.2
CLI version: 0.35.2
Management: Connected to https://nb.anon-XMJBI.domain:443
Signal: Connected to https://nb.anon-XMJBI.domain:443
Relays:
  [stun:turn.anon-XMJBI.domain:3478] is Available
  [turn:turn.anon-XMJBI.domain:3478?transport=udp] is Available
  [rels://nb.anon-XMJBI.domain:443] is Available
Nameservers:
  [192.168.7.1:53] for [.] is Available
FQDN: adam-zenbook-1.netbird.selfhosted
NetBird IP: 100.126.31.1/16
Interface type: Userspace
Quantum resistance: false
Routes: -
Networks: -
Peers count: 2/5 Connected

Windows route print

===========================================================================
Interface List
 15...........................WireSock Virtual Adapter
 43...........................WireGuard Tunnel
 14...16 ac 60 56 87 d3 ......Microsoft Wi-Fi Direct Virtual Adapter
 12...16 ac 60 56 97 c3 ......Microsoft Wi-Fi Direct Virtual Adapter #2
 19...14 ac 60 56 a7 f3 ......MediaTek Wi-Fi 6E MT7922 (RZ616) 160MHz PCIe Adapter
  5...00 50 56 c0 00 01 ......VMware Virtual Ethernet Adapter for VMnet1
  4...00 50 56 c0 00 08 ......VMware Virtual Ethernet Adapter for VMnet8
 18...14 ac 60 56 a7 f4 ......Bluetooth Device (Personal Area Network)
  1...........................Software Loopback Interface 1
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0     192.168.68.1   192.168.68.244     30
          0.0.0.0        128.0.0.0         On-link      100.126.31.1      6
      "My WAN IP"  255.255.255.255     192.168.68.1   192.168.68.244     31
      100.126.0.0      255.255.0.0         On-link      100.126.31.1    261
     100.126.31.1  255.255.255.255         On-link      100.126.31.1    261
  100.126.255.255  255.255.255.255         On-link      100.126.31.1    261
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    331
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    331
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    331
  127.255.255.255  255.255.255.255         On-link      100.126.31.1    261
        128.0.0.0        128.0.0.0         On-link      100.126.31.1      6
      192.168.5.0    255.255.255.0         On-link      100.126.31.1      6
    192.168.5.255  255.255.255.255         On-link      100.126.31.1    261
      192.168.7.0    255.255.255.0         On-link      100.126.31.1      6
    192.168.7.255  255.255.255.255         On-link      100.126.31.1    261
      192.168.9.0    255.255.255.0         On-link      100.126.31.1      6
    192.168.9.255  255.255.255.255         On-link      100.126.31.1    261
     192.168.17.0    255.255.255.0         On-link      192.168.17.1    291
     192.168.17.1  255.255.255.255         On-link      192.168.17.1    291
   192.168.17.255  255.255.255.255         On-link      192.168.17.1    291
     192.168.47.0    255.255.255.0         On-link      192.168.47.1    291
     192.168.47.1  255.255.255.255         On-link      192.168.47.1    291
   192.168.47.255  255.255.255.255         On-link      192.168.47.1    291
     192.168.68.0    255.255.255.0         On-link    192.168.68.244    286
   192.168.68.244  255.255.255.255         On-link    192.168.68.244    286
   192.168.68.255  255.255.255.255         On-link    192.168.68.244    286
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    331
        224.0.0.0        240.0.0.0         On-link      192.168.47.1    291
        224.0.0.0        240.0.0.0         On-link      192.168.17.1    291
        224.0.0.0        240.0.0.0         On-link    192.168.68.244    286
        224.0.0.0        240.0.0.0         On-link      100.126.31.1    261
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    331
  255.255.255.255  255.255.255.255         On-link      192.168.47.1    291
  255.255.255.255  255.255.255.255         On-link      192.168.17.1    291
  255.255.255.255  255.255.255.255         On-link    192.168.68.244    286
  255.255.255.255  255.255.255.255         On-link      100.126.31.1    261
===========================================================================
Persistent Routes:
  None

IPv6 Route Table
===========================================================================
Active Routes:
 If Metric Network Destination      Gateway
 43      6 ::/1                     On-link
  1    331 ::1/128                  On-link
 43      6 8000::/1                 On-link
  5    291 fe80::/64                On-link
  4    291 fe80::/64                On-link
  4    291 fe80::42b5:e70e:9b90:f630/128
                                    On-link
  5    291 fe80::6f24:5c0c:c019:2a1a/128
                                    On-link
  1    331 ff00::/8                 On-link
  5    291 ff00::/8                 On-link
  4    291 ff00::/8                 On-link
 43    261 ff00::/8                 On-link
===========================================================================
Persistent Routes:
  None

Expected behavior

Just like with Linux and Android, no DNS leaks.

Originally created by @boardlord1 on GitHub (Jan 10, 2025). **Describe the problem** I've noticed that the Windows Netbird client suffers from DNS leak. I'm self-hosting Netbird in am Ubuntu Server VM behind nginx, and I also run a cli client on the same machine as a routing peer into my home LAN (and also as an exit peer). My DNS server, Adguard home listens on my home router at 192.168.7.1:53, with Cloudflare and Quad9 as upstream resolvers. When I connect with the Android client or from a Linux machine all is well - I only see my upstream resolvers come up on browserleaks.com. However, I connect with the Windows client, I see the resolvers of the network I'm connected to. Isn't this because to Netbird use netmask 128.0.0.0? **Netbird status log** Peers detail: ``` samsung-jetbird.netbird.selfhosted: NetBird IP: 100.126.117.117 Public key: 5ieyO9Z1EjWIgF6gIefM2bZ9mxJjqR9E8IAfEfA7tFk= Status: Disconnected -- detail -- Connection type: ICE candidate (Local/Remote): -/- ICE candidate endpoints (Local/Remote): -/- Relay server address: Last connection update: - Last WireGuard handshake: - Transfer status (received/sent) 0 B/0 B Quantum resistance: false Routes: - Networks: - Latency: 0s openwrt-ligetter.netbird.selfhosted: NetBird IP: 100.126.129.15 Public key: bvIh3WRnvEz/gQNMz8FQQc8DgT2ypXSr/HxAZyMZnwo= Status: Connected -- detail -- Connection type: P2P ICE candidate (Local/Remote): host/srflx ICE candidate endpoints (Local/Remote): 192.168.47.1:51825/198.51.100.0:51820 Relay server address: rels://nb.anon-XMJBI.domain:443 Last connection update: 5 seconds ago Last WireGuard handshake: - Transfer status (received/sent) 148 B/388 B Quantum resistance: false Routes: 192.168.5.0/24 Networks: 192.168.5.0/24 Latency: 11.9858ms samsung-netbird.netbird.selfhosted: NetBird IP: 100.126.169.113 Public key: 2UO/tW8YZcQIp6VKDNdftRb+ZS3YqVadjrGv1pKxFQQ= Status: Disconnected -- detail -- Connection type: ICE candidate (Local/Remote): -/- ICE candidate endpoints (Local/Remote): -/- Relay server address: Last connection update: - Last WireGuard handshake: - Transfer status (received/sent) 0 B/0 B Quantum resistance: false Routes: - Networks: - Latency: 0s netbird-vm-cli-client.netbird.selfhosted: NetBird IP: 100.126.220.138 Public key: OaaNsK+ZQA0ninoQS1vWIgpPwgYyr5q23CjM3ozWrVU= Status: Connected -- detail -- Connection type: Relayed ICE candidate (Local/Remote): -/- ICE candidate endpoints (Local/Remote): -/- Relay server address: rels://nb.anon-XMJBI.domain:443 Last connection update: 6 seconds ago Last WireGuard handshake: 1 second ago Transfer status (received/sent) 3.7 KiB/21.5 KiB Quantum resistance: false Routes: 0.0.0.0/0, 192.168.7.0/24, 192.168.9.0/24 Networks: 0.0.0.0/0, 192.168.7.0/24, 192.168.9.0/24 Latency: 0s netbird-vm-docker-node.netbird.selfhosted: NetBird IP: 100.126.237.210 Public key: 5UCfvdijK/2wNW+gwnpNPg+9Ul6+1T8sjG027jyz2wE= Status: Disconnected -- detail -- Connection type: ICE candidate (Local/Remote): -/- ICE candidate endpoints (Local/Remote): -/- Relay server address: Last connection update: - Last WireGuard handshake: - Transfer status (received/sent) 0 B/0 B Quantum resistance: false Routes: - Networks: - Latency: 0s OS: windows/amd64 Daemon version: 0.35.2 CLI version: 0.35.2 Management: Connected to https://nb.anon-XMJBI.domain:443 Signal: Connected to https://nb.anon-XMJBI.domain:443 Relays: [stun:turn.anon-XMJBI.domain:3478] is Available [turn:turn.anon-XMJBI.domain:3478?transport=udp] is Available [rels://nb.anon-XMJBI.domain:443] is Available Nameservers: [192.168.7.1:53] for [.] is Available FQDN: adam-zenbook-1.netbird.selfhosted NetBird IP: 100.126.31.1/16 Interface type: Userspace Quantum resistance: false Routes: - Networks: - Peers count: 2/5 Connected ``` **Windows route print** ``` =========================================================================== Interface List 15...........................WireSock Virtual Adapter 43...........................WireGuard Tunnel 14...16 ac 60 56 87 d3 ......Microsoft Wi-Fi Direct Virtual Adapter 12...16 ac 60 56 97 c3 ......Microsoft Wi-Fi Direct Virtual Adapter #2 19...14 ac 60 56 a7 f3 ......MediaTek Wi-Fi 6E MT7922 (RZ616) 160MHz PCIe Adapter 5...00 50 56 c0 00 01 ......VMware Virtual Ethernet Adapter for VMnet1 4...00 50 56 c0 00 08 ......VMware Virtual Ethernet Adapter for VMnet8 18...14 ac 60 56 a7 f4 ......Bluetooth Device (Personal Area Network) 1...........................Software Loopback Interface 1 =========================================================================== IPv4 Route Table =========================================================================== Active Routes: Network Destination Netmask Gateway Interface Metric 0.0.0.0 0.0.0.0 192.168.68.1 192.168.68.244 30 0.0.0.0 128.0.0.0 On-link 100.126.31.1 6 "My WAN IP" 255.255.255.255 192.168.68.1 192.168.68.244 31 100.126.0.0 255.255.0.0 On-link 100.126.31.1 261 100.126.31.1 255.255.255.255 On-link 100.126.31.1 261 100.126.255.255 255.255.255.255 On-link 100.126.31.1 261 127.0.0.0 255.0.0.0 On-link 127.0.0.1 331 127.0.0.1 255.255.255.255 On-link 127.0.0.1 331 127.255.255.255 255.255.255.255 On-link 127.0.0.1 331 127.255.255.255 255.255.255.255 On-link 100.126.31.1 261 128.0.0.0 128.0.0.0 On-link 100.126.31.1 6 192.168.5.0 255.255.255.0 On-link 100.126.31.1 6 192.168.5.255 255.255.255.255 On-link 100.126.31.1 261 192.168.7.0 255.255.255.0 On-link 100.126.31.1 6 192.168.7.255 255.255.255.255 On-link 100.126.31.1 261 192.168.9.0 255.255.255.0 On-link 100.126.31.1 6 192.168.9.255 255.255.255.255 On-link 100.126.31.1 261 192.168.17.0 255.255.255.0 On-link 192.168.17.1 291 192.168.17.1 255.255.255.255 On-link 192.168.17.1 291 192.168.17.255 255.255.255.255 On-link 192.168.17.1 291 192.168.47.0 255.255.255.0 On-link 192.168.47.1 291 192.168.47.1 255.255.255.255 On-link 192.168.47.1 291 192.168.47.255 255.255.255.255 On-link 192.168.47.1 291 192.168.68.0 255.255.255.0 On-link 192.168.68.244 286 192.168.68.244 255.255.255.255 On-link 192.168.68.244 286 192.168.68.255 255.255.255.255 On-link 192.168.68.244 286 224.0.0.0 240.0.0.0 On-link 127.0.0.1 331 224.0.0.0 240.0.0.0 On-link 192.168.47.1 291 224.0.0.0 240.0.0.0 On-link 192.168.17.1 291 224.0.0.0 240.0.0.0 On-link 192.168.68.244 286 224.0.0.0 240.0.0.0 On-link 100.126.31.1 261 255.255.255.255 255.255.255.255 On-link 127.0.0.1 331 255.255.255.255 255.255.255.255 On-link 192.168.47.1 291 255.255.255.255 255.255.255.255 On-link 192.168.17.1 291 255.255.255.255 255.255.255.255 On-link 192.168.68.244 286 255.255.255.255 255.255.255.255 On-link 100.126.31.1 261 =========================================================================== Persistent Routes: None IPv6 Route Table =========================================================================== Active Routes: If Metric Network Destination Gateway 43 6 ::/1 On-link 1 331 ::1/128 On-link 43 6 8000::/1 On-link 5 291 fe80::/64 On-link 4 291 fe80::/64 On-link 4 291 fe80::42b5:e70e:9b90:f630/128 On-link 5 291 fe80::6f24:5c0c:c019:2a1a/128 On-link 1 331 ff00::/8 On-link 5 291 ff00::/8 On-link 4 291 ff00::/8 On-link 43 261 ff00::/8 On-link =========================================================================== Persistent Routes: None ``` **Expected behavior** Just like with Linux and Android, no DNS leaks.
saavagebueno added the feature-requestclientwindowsdns labels 2025-11-20 05:32:37 -05:00
saavagebueno commented 2025-11-20 05:32:38 -05:00
Author
Owner
Copy Link

@lixmal commented on GitHub (Jan 10, 2025):

I believe you suffer from a feature called Smart Multi-homed Name Resolution (SMHNR). You could try disabling it.

How did you arrive at the conclusion that it has something to do with the route?

@lixmal commented on GitHub (Jan 10, 2025): I believe you suffer from a feature called Smart Multi-homed Name Resolution (SMHNR). You could [try disabling it](https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-admx-dnsclient#dns_smartmultihomednameresolution). How did you arrive at the conclusion that it has something to do with the route?
saavagebueno commented 2025-11-20 05:32:38 -05:00
Author
Owner
Copy Link

@boardlord1 commented on GitHub (Jan 10, 2025):

Thanks for getting! Looked at that setting in Group Policy and it was not set (which meant it's off), but for good measure I disabled it, but unfortunately the result was the same.

The reason I thought the issue might be connected to the route is that If I use Wireguard, route two looks like this:

0.0.0.0 0.0.0.0 On-link My-Wireguart-client-IP 6

Whereas with Netbird it's 0.0.0.0 128.0.0.0..... But, there are more routes configured with Netbird in the routing table, so I might be mistaken :) I just know that with plain Wireguard only the correct resolvers are used. What's also pointing to a Windows client issue is that on my Android phone there is no DNS leak when connected to my Netbird network with the official client.

@boardlord1 commented on GitHub (Jan 10, 2025): Thanks for getting! Looked at that setting in Group Policy and it was not set (which meant it's off), but for good measure I disabled it, but unfortunately the result was the same. The reason I thought the issue might be connected to the route is that If I use Wireguard, route two looks like this: `0.0.0.0 0.0.0.0 On-link My-Wireguart-client-IP 6` Whereas with Netbird it's 0.0.0.0 128.0.0.0..... But, there are more routes configured with Netbird in the routing table, so I might be mistaken :) I just know that with plain Wireguard only the correct resolvers are used. What's also pointing to a Windows client issue is that on my Android phone there is no DNS leak when connected to my Netbird network with the official client.
saavagebueno commented 2025-11-20 05:32:39 -05:00
Author
Owner
Copy Link

@lixmal commented on GitHub (Jan 10, 2025):

There's another part to complete the 0.0.0.0/0

128.0.0.0 128.0.0.0 On-link 100.126.31.1 6

I just know that with plain Wireguard only the correct resolvers are used. What's also pointing to a Windows client issue is that on my Android phone there is no DNS leak when connected to my Netbird network with the official client.

Vanilla wireguard firewalls off the other DNS servers, but only if there's only a single peer and it has a /0 route. We currently don't do this.

https://github.com/WireGuard/wireguard-windows/blob/master/docs/netquirk.md

@lixmal commented on GitHub (Jan 10, 2025): There's another part to complete the 0.0.0.0/0 ` 128.0.0.0 128.0.0.0 On-link 100.126.31.1 6` >I just know that with plain Wireguard only the correct resolvers are used. What's also pointing to a Windows client issue is that on my Android phone there is no DNS leak when connected to my Netbird network with the official client. Vanilla wireguard firewalls off the other DNS servers, but only if there's only a single peer and it has a /0 route. We currently don't do this. https://github.com/WireGuard/wireguard-windows/blob/master/docs/netquirk.md
saavagebueno commented 2025-11-20 05:32:39 -05:00
Author
Owner
Copy Link

@boardlord1 commented on GitHub (Jan 10, 2025):

Oh, thanks lixmal for the explanation! In this case, what can I do? I don't want to risk having my DNS queries going through a resolver of a random network I'm connected to.

EDIT: reading this article, the VPN client has to explicitly deal with this (like OpenVPN, explained in the article).
https://medium.com/@ValdikSS/beware-of-windows-10-dns-resolver-and-dns-leaks-5bc5bfb4e3f1

@boardlord1 commented on GitHub (Jan 10, 2025): Oh, thanks lixmal for the explanation! In this case, what can I do? I don't want to risk having my DNS queries going through a resolver of a random network I'm connected to. EDIT: reading this article, the VPN client has to explicitly deal with this (like OpenVPN, explained in the article). `https://medium.com/@ValdikSS/beware-of-windows-10-dns-resolver-and-dns-leaks-5bc5bfb4e3f1`
saavagebueno commented 2025-11-20 05:32:39 -05:00
Author
Owner
Copy Link

@boardlord1 commented on GitHub (Jan 15, 2025):

@lixmal would you have a suggestion here on what I could do?

@boardlord1 commented on GitHub (Jan 15, 2025): @lixmal would you have a suggestion here on what I could do?
saavagebueno commented 2025-11-20 05:32:39 -05:00
Author
Owner
Copy Link

@boardlord1 commented on GitHub (Jan 17, 2025):

I've updated to 0.36.2 today and it seems there's no leak anymore :)

EDIT: false alarm, got the leak again.

@boardlord1 commented on GitHub (Jan 17, 2025): I've updated to 0.36.2 today and it seems there's no leak anymore :) EDIT: false alarm, got the leak again.
saavagebueno commented 2025-11-20 05:32:39 -05:00
Author
Owner
Copy Link

@vitormfgoncalves commented on GitHub (Jan 27, 2025):

I can confirm. It also happens on linux.

In my config, I have only my internal DNS that have many blacklisted domains (for security reasons).
When connected, those blacklisted domains are still avaliable but shouldn't.

It falls back to the system DNS when fails to resolve those domains in my internal DNS.
This do not happen on Android.

I'm on version 0.36.3 (Windows 11 and Linux Debian 12)

@vitormfgoncalves commented on GitHub (Jan 27, 2025): I can confirm. It also happens on linux. In my config, I have only my internal DNS that have many blacklisted domains (for security reasons). When connected, those blacklisted domains are still avaliable but shouldn't. It falls back to the system DNS when fails to resolve those domains in my internal DNS. This do not happen on Android. I'm on version 0.36.3 (Windows 11 and Linux Debian 12)
saavagebueno commented 2025-11-20 05:32:39 -05:00
Author
Owner
Copy Link

@boardlord1 commented on GitHub (Feb 13, 2025):

Any movement on this? Have the devs been able to replicate? This makes it impossible for me to use desktop client...

@boardlord1 commented on GitHub (Feb 13, 2025): Any movement on this? Have the devs been able to replicate? This makes it impossible for me to use desktop client...
saavagebueno commented 2025-11-20 05:32:39 -05:00
Author
Owner
Copy Link

@boardlord1 commented on GitHub (Mar 18, 2025):

Bump, this is still an issue on latest release

@boardlord1 commented on GitHub (Mar 18, 2025): Bump, this is still an issue on latest release
saavagebueno commented 2025-11-20 05:32:40 -05:00
Author
Owner
Copy Link

@nazarewk commented on GitHub (Mar 18, 2025):

I might be wrong, but I don't think Netbird itself is doing anything special in terms of ensuring that it is the only DNS server usable.

For starters, it must be able to resolve the *.netbird.io to establish a connection. This requires usage of the network-provided DNS unless we have our own Netbird-hosted fallback server for those domains enforced client side.

To prevent further DNS leaks I am pretty sure we would need to implement it for every specific host separately.

I can confirm. It also happens on linux.

Yeah, linux is using systemd-resolved when available which, in turn, provides no guarantees whatsoever as to which configured server resolves the queries.

Should we consider this a feature request instead?

If/until it is implemented your best bet would be to configure the operating system to prevent DNS leaks on your own. If you succeed we would be very happy to learn how you achieved it.

@nazarewk commented on GitHub (Mar 18, 2025): I might be wrong, but I don't think Netbird itself is doing anything special in terms of ensuring that it is the only DNS server usable. For starters, it must be able to resolve the `*.netbird.io` to establish a connection. This requires usage of the network-provided DNS unless we have our own Netbird-hosted fallback server for those domains enforced client side. To prevent further DNS leaks I am pretty sure we would need to implement it for every specific host separately. --- > I can confirm. It also happens on linux. Yeah, linux is using `systemd-resolved` when available which, in turn, provides no guarantees whatsoever as to which configured server resolves the queries. --- Should we consider this a feature request instead? If/until it is implemented your best bet would be to configure the operating system to prevent DNS leaks on your own. If you succeed we would be very happy to learn how you achieved it.
saavagebueno commented 2025-11-20 05:32:40 -05:00
Author
Owner
Copy Link

@boardlord1 commented on GitHub (Mar 18, 2025):

I'd want to have this feature so that NB mirrors what WireGuard and Tailscale does - that EVERYTHING goes through the tunnel once it's up and running.

Because, there is a chance that some requests would not go through the established NB tunnel - as can be seen when you do a DNS leak test.

@boardlord1 commented on GitHub (Mar 18, 2025): I'd want to have this feature so that NB mirrors what WireGuard and Tailscale does - that EVERYTHING goes through the tunnel once it's up and running. Because, there is a chance that some requests would not go through the established NB tunnel - as can be seen when you do a DNS leak test.
saavagebueno commented 2025-11-20 05:32:40 -05:00
Author
Owner
Copy Link

@boardlord1 commented on GitHub (Jun 21, 2025):

Any news on this issue? It's valid with client v0.48.0...

@boardlord1 commented on GitHub (Jun 21, 2025): Any news on this issue? It's valid with client v0.48.0...
saavagebueno commented 2025-11-20 05:32:40 -05:00
Author
Owner
Copy Link

@kalipso-cyber commented on GitHub (Jul 15, 2025):

I'm seeing the same happen on my macOS device with client v0.50.3. This user is also experiencing it on their Android device.

I'd expect that, once a VPN tunnel is established and the DNS server specified in the Netbird configuration is reachable, it would be exclusively used for all DNS queries. What are the reasons for using the client-configured DNS server as well?

@kalipso-cyber commented on GitHub (Jul 15, 2025): I'm seeing the same happen on my macOS device with client v0.50.3. [This user](https://github.com/netbirdio/netbird/issues/3452) is also experiencing it on their Android device. I'd expect that, once a VPN tunnel is established and the DNS server specified in the Netbird configuration is reachable, it would be exclusively used for all DNS queries. What are the reasons for using the client-configured DNS server as well?
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
2021 Q4
2022 Q1
2022 Q1
accessibility
acl
agent
agent
Android
Android
api
authentik
automation
azure
battery-usage
bug
cache
client
client-ui
cloud
cloud-only
cloudflare
community
compatibility
config-idp
config-issue
connection
contribution
coturn
cross-vpn
dashboard
data-usage
distribution
dns
docker
documentation
duplicate
enhancement
enhancement
event-stream
feature-request
freebsd
getting-started
go
good first issue
gui
help wanted
home-assistant
idp
inconsistency
integration
integrations
ios
ipv6
jwt
k8s
keycloak
linux
login
macos
management-service
missing-docs
mobile
moved-internal
needs-review
netbird-ui
networking
new-platform
nginx
notification
okta
openwrt
packaging
peer-management
peer-management
peer-management
performance
postgres
posture-checks
psk
pull-request
Mirrored from GitHub Pull Request
 question
refactor
relay
release
rfc
routes
security
security-related
self-hosting
server
signal
sleep-issue
ssh
ssl
status
store
synology
system-compatibility-issue
test-suite
third-party-integration
triage
triage-needed
troubleshooting
UX
waiting-feedback
windows
wontfix
zitadel
No Label client dns feature-request windows
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: SVI/netbird#1548
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?