How can I route all DNS requests through my VPS to prevent DNS leaks? (欢迎中文）

[TommyYOyoyo]

I've established a connection between my VPS (GCP VM) and my computer using xray-reality-xtls-rprx-vision protocol, but I noticed in the past days (using ipleak.net) that my DNS requests are being leaked. As a result, all my ISPs were exposed.

How can I make sure that all my DNS requests are properly routed through my VPS?

Information on my setup:

VPS: Google Cloud Platform Compute Engine (Tokyo) - Debian 12
Xray GUI: V2RayXS
OS: MacOS
Config generated with reality-ezpz

My current config.json:

{
  "routing" : {
    "name" : "all_to_main",
    "domainStrategy" : "AsIs",
    "rules" : [
      {
        "type" : "field",
        "outboundTag" : "RealityEZPZ",
        "port" : "0-65535"
      }
    ]
  },
  "inbounds" : [
    {
      "listen" : "127.0.0.1",
      "protocol" : "socks",
      "settings" : {
        "ip" : "127.0.0.1",
        "auth" : "noauth",
        "udp" : false
      },
      "tag" : "socksinbound",
      "port" : 1081
    },
    {
      "listen" : "127.0.0.1",
      "protocol" : "http",
      "settings" : {
        "timeout" : 0
      },
      "tag" : "httpinbound",
      "port" : 8001
    }
  ],
  "dns" : {
    "servers" : [
      "1.1.1.1",
      "1.0.0.1",
      "8.8.8.8",
      "8.8.4.4"
    ]
  },
  "log" : {
    "error" : "\/var\/folders\/51\/1pgrz5295dg1b15vht_4rft00000gn\/T\/cenmrev.v2rayx.log\/error.log",
    "loglevel" : "warning",
    "access" : "\/var\/folders\/51\/1pgrz5295dg1b15vht_4rft00000gn\/T\/cenmrev.v2rayx.log\/access.log"
  },
  "outbounds" : [
    {
      "sendThrough" : "0.0.0.0",
      "mux" : {
        "enabled" : false,
        "concurrency" : 8
      },
      "protocol" : "vless",
      "settings" : {
        "vnext" : [
          {
            "address" : "<MY VM'S IP>",
            "users" : [
              {
                "flow" : "xtls-rprx-vision",
                "id" : "de4f3554-55ef-4541-b9e5-dff6f681fc26",
                "alterId" : 64,
                "security" : "none",
                "level" : 0,
                "encryption" : "none"
              }
            ],
            "port" : 443
          }
        ]
      },
      "tag" : "RealityEZPZ",
      "streamSettings" : {
        "realitySettings" : {
          "serverName" : "www.google.com",
          "publicKey" : "KB8W-E1Db4xd9vbc2QeQCnjYLRT56Kr2BWHULau-Rg8",
          "shortId" : "17ac78d51fdbd893",
          "show" : false,
          "spiderX" : "",
          "fingerprint" : "chrome"
        },
        "network" : "tcp",
        "wsSettings" : {
          "path" : "",
          "headers" : {

          }
        },
        "quicSettings" : {
          "key" : "",
          "header" : {
            "type" : "none"
          },
          "security" : "none"
        },
        "tlsSettings" : {
          "allowInsecure" : false,
          "alpn" : [
            "http\/1.1"
          ],
          "serverName" : "www.google.com",
          "allowInsecureCiphers" : false
        },
        "xtlsSettings" : {
          "serverName" : "www.google.com",
          "allowInsecure" : false,
          "alpn" : [
            "http\/1.1"
          ]
        },
        "httpSettings" : {
          "path" : ""
        },
        "kcpSettings" : {
          "header" : {
            "type" : "none"
          },
          "mtu" : 1350,
          "congestion" : false,
          "tti" : 20,
          "uplinkCapacity" : 5,
          "writeBufferSize" : 1,
          "readBufferSize" : 1,
          "seed" : "",
          "downlinkCapacity" : 20
        },
        "tcpSettings" : {
          "header" : {
            "type" : "none"
          }
        },
        "security" : "reality",
        "grpcSettings" : {
          "serviceName" : "",
          "multiMode" : false
        }
      }
    }
  ]
}

[TommyYOyoyo]

It turned out that only FireFox is leaking my DNS and the issues were its enabled DNS-over-HTTP setting and uBlock Origin "uncloak canonical names" option. After turning both off my ISPs seem to become only Google and Cloudflare, which I set on my V2RayXS configurations.

To further ensure that every application on my laptop respects the DNS settings, I used dnsmasq to forward every DNS request through it to my desired DNS (Google/Cloudflare).

[TommyYOyoyo]

What's your setting for network.proxy.type and network.proxy.socks_remote_dns in about:config in Firefox?

5 and false

Fortunately it stopped leaking my DNS after turning both DNS-over-HTTP and Uncloak-canonical-names off.
Currently (not leaking DNS) my cnameUncloakProxied is set to false.

[uuonda]

Well, it appears your system handles your proxy settings (type == 5) and that may interfere with uBlock's cnameUncloakProxied. Also you are not forcing remote DNS resolution in Firefox. I don't know how your system configured but while you might no longer leak your local DNS resolvers to third parties you might still leak your DNS requests to your ISP.

[TommyYOyoyo]

Well, it appears your system handles your proxy settings (type == 5) and that may interfere with uBlock's cnameUncloakProxied. Also you are not forcing remote DNS resolution in Firefox. I don't know how your system configured but while you might no longer leak your local DNS resolvers to third parties you might still leak your DNS requests to your ISP.

To address further DNS leak issues I've used dnsmasq to route all requests through 127.0.0.1 in order to forward all request through my desired hosts (1.1.1.1/8.8.8.8/1.0.0.1/8.8.4.4). I also enabled WARP+ on my VPS for all outbound traffic. Do you think these methods are sufficient to prevent any DNS leak to my ISP?

I've tested with various websites (ipleak.net, dnsleaktest.com, doileak.com and browserleaks.com) and all my IP address seem to belong to Cloudflare only, which I've set it to.

[uuonda]

I'm no expert but unless dnsmasq forwards all requests to DoH/DoT servers or uses your proxy to access 1.1.1.1 your ISP would be able to snoop on your DNS requests. Ideally, you should be doing remote DNS resolution that is supported by SOCKS inbound but it also must be supported by your system and/or your apps (like socks_remote_dns in Firefox).

[TommyYOyoyo]

I'm no expert but unless dnsmasq forwards all requests to DoH/DoT servers or uses your proxy to access 1.1.1.1 your ISP would be able to snoop on your DNS requests. Ideally, you should be doing remote DNS resolution that is supported by SOCKS inbound but it also must be supported by your system and/or your apps (like socks_remote_dns in Firefox).

Thanks, my proxy indeed uses Socks inbound, and I use my proxy to access to 1.1.1.1 (which seems supports DoH/DoT). My dnsmasq also forwards any request from any app to Cloudflare's DNS, so it should not leak DNS, I think.