Custom Plaintext address being ignored

[kingofhteseas]

When setting the DNS_PLAINTEXT_ADDRESS to a different address than 1.1.1.1 it does not pick up the change and still shows 1.1.1.1. Using Docker Compose. Doesn't matter if DOT is off or on.

version: "3.7"
services:
  gluetun:
    image: qmcgaw/gluetun
    container_name: gluetun
    cap_add:
      - NET_ADMIN
    network_mode: bridge
    ports:
      - 2202:2202/tcp # ubooquityConsole
      - 2203:2203/tcp # ubooquityAdmin
    # command:
    volumes:
      - /docker/gluetun:/gluetun
    environment:
      - FIREWALL_OUTBOUND_SUBNETS=192.168.1.0/24
      - OPENVPN_USER=<redacted>
      - OPENVPN_PASSWORD=<redacted>
      - VPNSP=private internet access
      - DOT=off
      - DNA_PLAINTEXT_ADDRESS=194.242.2.2
      - TZ=America/New_York
    restart: always

[kingofhteseas]

im dumb

[kingofhteseas]

No worries at all!!

I had "DNA_PLAINTEXT_ADDRESS" instead of "DNS" lol
Thanks for that info!

I am using the PIA DNS found here: https://www.privateinternetaccess.com/helpdesk/kb/articles/next-generation-dns-custom-configuration

I was finally able to get the shadowsock working and was able to connect and test. Almost all DNS leak sites show I am good to go. One showed it bounced through some Cloudflare endpoints but think that is just because I was using Chrome.

[qdm12]

Haha alright well that's a dumb mistake indeed. I guess I'm dumb too since I didn't spot it 😆 Anyways!

Interesting they have their own DNS, although again, since PIA merged with Kape, I would not give them my DNS traffic data 😄 Well I would not give my entire DNS traffic data to anyone anyway (I split the DNS traffic to different public servers). So unless you need it for Netflix etc., I would recommend to keep DNS over TLS and use 2-3 providers with -e DOT_PROVIDERS=cloudflare,google,quad9 for example. As that DNS thing, I'm 51% sure they record the DNS traffic data 😄

[kingofhteseas]

Yeah i read/heard about the merger. I haven't seen or heard of any big issues or changes yet. I am hoping Mullvad introduces Windows 10 split tunneling soon.

Whats the reason of splitting the DNS to different public servers instead of a private one?

[qdm12]

Split tunneling per application is nice indeed. You can do split tunneling with wireguard by ip address but not by application unfortunately.

The reason is that you split your fingerprint in 3, so it's harder for them to have meaning from your data. And I don't think there is such private DNS as long as you don't manage every single bit of the DNS server (which isn't easy AFAIK). As in DNS servers are here but they could very well eavesdrop on you for whatever reason now or later.

Currently Unbound still favors the closest DNS, so it doesn't work that well for gluetun to split things uniformly. I am coding qmcgaw/dns:v2.0.0-beta currently which will be used in gluetun when out of beta. I have it running on my network, where each DNS request is cycled through the DNS servers available, so it's really a proper split.

Anyway excitement ahead I guess 😄

[kingofhteseas]

Ah okay!!! Thats a great explanation and im excited for whats to come! :)