DNS leak showing IPv6 addresses despite IPv6 being disabled on OS level

VPN
1

Hello,

I’m configuring a headless Debian server with ProtonVPN. All of the usual parts (connectivity, logging in, tun0) are working as expected. However, despite turning off IPv6 system-wide I see that dnsleak is showing me a possible leak.

I disabled IPv6 as described here: How to manually block IPv6 on Linux | Proton VPN
The change persists after a reboot, as expected.

The Proton docs recommend using https://dnsleaktest.com/ to do the leak test. Alas, this won’t work on a headless system. I’m using this script instead.

The results show me that I’m “leaking” from DataCamp to DataCamp, so from Proton to Proton. This is not the issue. I’m seeing however DNS servers with IPv6 addressing, which is really puzzling. What’s also puzzling is that sometimes the test returns no leak (showing IPv4 addresses only) and a while later it reports a possible leak (showing the IPv6 addresses along IPv4 ones).

For reference, I used the CLI part of this tutorial: How to manually configure OpenVPN for Proton VPN in Linux | Proton VPN.

My possible answers:

  1. The system is making IPv6 requests despite having this disabled (how?);
  2. This is normal for GitHub - macvk/dnsleaktest: An open source script tests VPN connection for DNS Leak. and it’s displaying IPv6 because… ?
  3. One IP is pointing to multiple servers (as seen here: https://www.reddit.com/r/ProtonVPN/comments/1e3s3eb/i_tested_the_dns_leak_again/ld9xv7a/ )
  4. Something I overlooked?

Thanks in advance!

2

DNS leak test shows the outbound IP address of the DNS server that you are using. The IPv6 address in the leak test thus tells that your DNS server is using IPv6 for resolving requests. This has nothing to do with your local system or your local network or your VPN.

3

turning off IPv6 system-wide

Generally a very bad idea these days. If you really don’t want to do IPv6, there are more proper ways to do that, e.g. generally disabling stuff that would lead to global routable native IPv6 IPs, but generally don’t disable link local, ::1 localhost, etc. - that way madness lies and you’ll generally be facing a constant uphill battle.

What’s all this worry about “leaking” DNS? If you’re gonna be on 'da Internet, you’re gonna have IP(s), and, oh my gosh, there might be associated DNS. Whoopty doo. And, if you’re going to be resolving Internet DNS, you’re going to be resolving that somewhere.