dns leak using PIA VPN [SOLVED]

timminybo · 2026-07-26 20:01:03

-------------
Summary:
-------------

I have a DNS leak while using PrivateInternetAccess (PIA) VPN using Wireguard.

I don't use the PIA app. Instead I use a set of bash scripts from here: https://helpdesk.privateinternetaccess. … -for-Linux

The github page for the scripts is here: https://github.com/pia-foss/manual-connections

The actual command I use to initiate the VPN is this:

sudo PIA_USER=pxxxxxxx PIA_PASS=xxxxxxxxxxx VPN_PROTOCOL=wireguard DIP_TOKEN=none PIA_PF=false DISABLE_IPV6=yes PIA_DNS=true MAX_LATENCY=0.2 AUTOCONNECT=false ./run_setup.sh

To check for leaks, I primarily use https://github.com/macvk/dnsleaktest/bl … eaktest.sh but also https://dnsleak.com for confirmation.

----------------
Background:
----------------

I use the same script and command (see above) on two different computers on my home network.

machine1: headless torrenting/fileserver. runs fedora 44 with NetworkManager and openresolv.
no dns leaks

machine2: main machine. streaming/browsing. runs arch linux with X11 and sway. uses systemd-networkd with opensresolv.
dns leaks

I disable ipv6 on both machines using kernel parameters.
I also disable ipv6 in my router.
I have no static DNS servers set in my router.

-----------------
| machine1-|
--------------- |
----------------- -----------------
| router |-------| dsl modem |-----> Internet
----------------- ----------------
------------- |
| machine2-|
-------------

machine2 (dns leaks)
-------------

I currently have DHCP server disabled on my router but I have tried enabling it and still experienced leaks.

I have substituted a different router and tried with and without DHCP sever enabled on it and still experienced leaks.

I have tried both routers with and without DHCP server enabled with systemd-networkd, systemd-resolved, openresolv and NetworkManager, systemd-resolved, openresolv and still experienced leaks. When using NetworkManager, I disabled systemd-networkd.

(I don't think the router has anything to do with it since machine1 and machine2 both use it and only machine2 leaks).

implemented "Endpoint with changing ip" per https://wiki.archlinux.org/title/WireGu … hanging_IP
result: still leaks.
action: disabled it

ran sudo resolvectl reset-server-features after the various changes.
result: still leaks.

ran sudo resolvectl flush-caches after the various changes.
result: still leaks.

I'm currently using the symlink to the stub for /etc/resolv.conf but I have also tried /etc/resolv.conf as a regular file two different ways:
version1: nameserver <192.168.1.1> #ip for router
version2: nameserver <10.0.0.243> #PIA VPN DNS
results: still leaks
action: reverted to symlink to stub

I'm not a networking expert. I've read a lot of wiki pages and forum posts but I don't know what else to try.
I first noticed the leak about a week ago and have been experimenting since.
I've been using this VPN setup (PIA VPN scripts + systemd-networkd + openresolv) for about 2 years. I believe I verified it was leak free at the time but that was a long time ago for my memory. I fully expect the cause is user error of some sort.

I can post the output of any relevant commands if helpful.

Any suggestions are appreciated. (Thanks for reading to the end).

Last edited by timminybo (Yesterday 20:07:58)

seth · Yesterday 07:12:13

https://wiki.archlinux.org/title/Privat … #DNS_Leaks

uses systemd-networkd with opensresolv.

ran sudo resolvectl

I was under the impression that networkd mandates resolved… either way, try to switch to NM w/ openresolv or https://wiki.archlinux.org/title/Networ … NS_servers and make sure resolved isn't running ("resolvectl status" complains about unknown unit)

What DNS servers does eg drill or dig report is being used?
Also "getent ahosts archlinux.org" but you'll have to wireshark its inquiry (at least idk how to make getent print the traffic)

Several browsers might be configured to use alternative DNS options like DOH which could spoil this.

-thc · Yesterday 07:27:27

If you use the "wg-quick" method for connecting to wireguard VPNs you have to set up a working openresolv subsystem (which you are aware of).

As seth already wrote - if you would've ever tried a clean NetworManager/openresolv setup on machine 2 it should have worked. BTW: NetworkManager/systemd-resolved also works great with WireGuard because NM natively supports WireGuard and no scripts/wg-quick/openresolv is needed.

As seth mentioned systemd-resolved is the recommended DNS management for systemd-networkd - but openresolv is it's own DNS management in this regard and they are in conflict. You may have to remove openresolv and install systemd-openresolv - see https://wiki.archlinux.org/title/System … NS_servers

Last edited by -thc (Yesterday 07:33:49)

timminybo · Yesterday 20:06:37

Thank you seth and -thc. When the experts say NetworkManager + openresolv should work, that was a big help. I tried it again.

short story:
I think I've got it working and believe there are no DNS leaks when using NetworkManager + openresolv + Wireguard.

long story:
I suspect when I previously tried NM + openresolv, I may not have disabled systemd-resolved every time. And I think the reason I didn't is because
https://wiki.archlinux.org/title/NetworkManager#1.1
in the blue box says,

"If systemd-resolved is not started, an error message will start flooding your logs. See #Unit dbus-org.freedesktop.resolve1.service not found for more info."

So maybe I misinterpreted what this is saying but I thought it meant I needed to have systemd-resolved running.

Today I installed the networkmanager package and disabled systemd-networkd and systemd-resolved and enabled NetworkManager.

I think I rebooted at this point because when I disabled networkd and resolved, I got messages saying their triggering units were still active (various sockets). I figured a reboot would clear those out.

After the reboot, I tried to connect using the PIA VPN script command I referenced previously, and I got an error:

resolvconf: signature mismatch: /etc/resolv.conf
resolvconf: run
`resolvconf -u`
to update

So I ran

sudo resolvconf -u

then checked to see that /etc/resolv.conf changed the nameserver to 10.0.0.243, it did.

I re-ran the PIA VPN script command and got a new error:

Could not authenticate with the login credentials provided!

I know the credentials are good. I closely re-read the
https://wiki.archlinux.org/title/NetworkManager

and noticed this in
https://wiki.archlinux.org/title/NetworkManager#1.5

in the blue box

Note
To have fully functioning DNS resolution when using VPN, you should set up conditional forwarding.
These plug-ins may not have a documented command line interface, or may not work at all without an applet running. This is not an issue if you are using a regular desktop environment; if you are not, you should run #nm-applet while configuring or activating the connection so that you get the necessary dialogues.

The conditional forwarding, https://wiki.archlinux.org/title/Networ … forwarding, introduces a new-to-me tool, dnsmasq, so I skipped that for now.

Since I don't use a desktop environment (i use i3 in X11), I installed the network-manager-applet package.
I then had to add the tray module to my polybar configuration. I think I had to click on the applet and then on wired connection to first get a connection.
Maybe the connection was made automatically. Maybe I had to re-run

sudo resolvconf -u

(can't remember). Then I re-ran the PIA VPN script command and it worked normally and connected to the PIA VPN server I selected.

When I ran the

dnsleaktest.sh -i pia

command, it showed no leaks. When I checked the dnsleak.com test for confirmation, it showed there may be leaks. But, the results were different than when the dnsleaktest.sh also showed leaks. The results showed only servers in the country I connected to with the VPN and there were no entries for my ISP. When I leaked before, my ISP was in the list maybe 8 times and only 1 or 2 servers that weren't my ISP. Other browser leak tests are consistent. So I think I have no DNS leaks.

This raises the question how NetworkManager + openresolv + Wireguard are working on machine1, the headless Fedora machine with no graphical environment and no nm-applet installed. Maybe there is something different about a Fedora installation compared to an Arch installation.

seth,
with the PIA VPN running dig archlinux.org now shows the server to be 10.0.0.43 (UDP)
which is correct according to
https://helpdesk.privateinternetaccess. … igurations
and matches the nameserver in /etc/resolv.conf

I'll have to add wireshark to my list of linux things to learn. It is not in my skill set right now.

Point taken about DOH in the browser. I use librewolf and I think it is not enabled by default (at least in mine it isn't enabled).

-thc,
I use

sudo wg-quick down pia

to bring the connection down if necessary once it has been initiated with the command I referenced. I've then used

sudo wg-quick up pia

to bring it back up.
Sounds like you might be saying if I rebooted, I could re-establish the last used PIA VPN Wireguard connection with

sudo wg-quick up pia

. I tried it. After a reboot, I had to issue

sudo resolvconf -u

before running

sudo wg-quick up pia

, but then it worked. Nice.

I'll also have to try NetworkManager + systemd-resolved + Wireguard. Are you saying that the scripts I've been using aren't necessary at all with this approach, that I just need the Wireguard configuration file they create (or is created by any means)? Since openresolv contains the wg-quick tools, and openresolv and systemd-resolved can't both be installed, if someone uses NetworkManager + systemd-resolved + Wireguard, what is the equivalent to

wq-quick down pia

and

wg-quick up pia

commands? To switch servers, is the Wireguard configuration file manually edited?

.
.
.

Re-reading my original post, I noticed I left out a few sentences I intended to include that describe how the PIA VPN scripts work. I added them below for completeness.

The PIA VPN bash scripts I'm using automate the process of connecting to the PIA VPN tunnel. The runsetup.sh queries the server list (since servers are taken down and are added frequently), ranks them in order of latency, lets you choose whether to connect to the server with the lowest latency or select whichever server you prefer, and lets you choose OpenVPN implementation or Wireguard. You can pre-select all of that and more using environment variables (see the command I use above).

I can mark this issue as solved. I'm not sure openresolv is working as it should. When I issue

sudo wg-quick down pia

, /etc/resolv.conf has no nameserver and I can't connect to anything. If I then click on the nm-applet and on Wired Connection, then my router gets entered in /etc/resolv.conf as the nameserver and I can connect to a website. Maybe this is intended but when using systemd-networkd + systemd-resolved, if the

sudo wg-quick down pia

command was used, the nameserver in /etc/resolv.conf was automatically switched back to the router.

I'll consider replacing openresolv with systemd-openresolv as -thc mentioned. Maybe that will have an effect.

Thank you seth and -thc for responding and immediately zeroing in on the problem.

Arch Linux

#1 2026-07-26 20:01:03

dns leak using PIA VPN [SOLVED]

#2 Yesterday 07:12:13

Re: dns leak using PIA VPN [SOLVED]

#3 Yesterday 07:27:27

Re: dns leak using PIA VPN [SOLVED]

#4 Yesterday 20:06:37

Re: dns leak using PIA VPN [SOLVED]

Board footer