Dabbling with Tor. Getting DNS leaks?

[rubix 0]

On Ubuntu LTS, decided to dabble with Tor over AirVPN. Using Tor Browser Bundle 4.0.2.

 

AirVPN connection tested with ipleak.net and dnsleaktest.com. IP address and Detected DNS Address match. No leak.

 

Then launched TBB. Says I'm using Tor IP, but DNS address matches my ISP's, not AirVPN's.

 

Is this due to a failure to configure AirVPN properly or Tor Browser Bundle? Thank you.

[InactiveUser 188]

All of Tor Browser's DNS requests are supposed to go through a Tor exit node - not AirVPN's DNS server! There is a browser setting in about:config

 

network.proxy.socks_remote_dns
 

 

which must be set to "true" (that's Tor Browser's default, so if you didn't change it, no need to do anything.)

If you changed that setting to false, DNS requests would be sent to your system instead (but Tor Browser would notice this and warn you with a crossed onion logo).
Even if that's what happened, you shouldn't see your ISP's DNS server, but AirVPN's.

One possible scenario I can think of:
The Tor exit node happened to use the same DNS server.

Here is what you should do - in this order. Don't skip steps:

1. Connect to AirVPN and verify that your other (non-Tor) browsers don't leak DNS
2. Remove Tor Browser, download a new copy
3. Verify that Tor Browser doesn't leak DNS (exit nodes use all kinds of different DNS servers - you often see "Google Business" or OpenDNS)
4. Click the Tor button, get a "New Identity" (Tor Browser will restart)
5. Repeat DNS leak test in Tor Browser. Different exit nodes usually use different DNS servers, so you should see changing DNS addresses in your leak test, not only one and the same all the time. Repeat steps 4 and 5 a few times, you will see changes eventually.

6. If you verify that there's indeed a problem with vanilla Tor Browser somewhere in steps 2 through 5, and only then, you should contact the Tor support people directly (IRC or email):

https://www.torproject.org/about/contact.html.en#support

I highly doubt it though, I'm sure it's something else, maybe just odd luck that some exit node used the same (or a similar-looking) DNS server as your ISP.

[iwih2gk 93]

I use TOR over Air all the time.  I don't take chances and I handle total control myself.  First I connect using Air "Eddie", then I enable UFW to ONLY allow tun0 in and out of the machine.  tun0 is obviously Air's dns and my TBB (TOR) runs through tun0 to the net.  I have never seen anything but Air's dns and I have hit the tunnel from every angle I can think of to verify its solid.

[rubix 0]

I am an idiot. My network is set up to use the same, common DNS servers, not my ISP's. Misinterpreted what I saw. Selecting "New Identity" results in properly updating DNS server lists.

 

Thank you for the responses.