Prevent DNS Leaks with VPN: A Complete Guide Using the Fanqiang Repository

To prevent DNS leaks with a VPN, you must force all DNS queries through the encrypted tunnel by enabling SOCKS5 proxy DNS, setting external resolvers like 8.8.8.8, and configuring system-wide proxy modes in your client.

The fanqiang repository by bannedbook is a comprehensive collection of guides and scripts for building VPN and proxy solutions using V2Ray, Shadowsocks, and other tools. According to the source code analysis, the repository emphasizes that preventing DNS leaks with VPN configurations requires specific client settings to ensure DNS traffic never reaches your local ISP or censorship firewalls. This article extracts the exact configuration steps and file paths from the repository's documentation to help you secure your DNS queries.

Why DNS Leaks Compromise Your VPN Privacy

When you connect to a VPN without DNS leak protection, your operating system may continue sending DNS queries to your ISP's resolvers instead of through the encrypted tunnel. This exposes your browsing destinations to network monitors and defeats the privacy purpose of the VPN. The fanqiang documentation repeatedly warns that unprotected DNS traffic allows the Great Firewall and similar systems to see which domains you attempt to reach, even when your data payload is encrypted.

Step-by-Step Configuration to Prevent DNS Leaks with VPN

Enable SOCKS5 Proxy DNS in Your Client

The first critical step documented in windows/Windows版V2ray客户端安装配置指南.md (line 10) is enabling the "use SOCKS v5 to proxy DNS" option in your client settings. For V2Ray, Shadowsocks, and similar SOCKS5-based tools, this setting forces the client to intercept all DNS lookup requests and route them through the VPN tunnel rather than sending them directly to the system's default resolver.

Configure External DNS Resolvers

Replace your ISP's DNS servers with trustworthy external resolvers. As noted in macos/V2rayX.md (line 149), the guides recommend using Google's public DNS (8.8.8.8, 8.8.4.4) or Cloudflare's 1.1.1.1. Configuring these in your VPN client prevents the operating system from falling back to locally assigned DNS servers if the VPN connection hiccups.

Activate System-Wide Proxy Mode

Tools like V2rayN on Windows can automatically configure the system proxy settings to ensure all applications—including the OS resolver—route traffic through the VPN. According to windows/V2RayN.md (lines 46-48), enabling the automatic system proxy setting ensures that DNS resolution requests are captured at the system level and forwarded through your configured proxy.

Implement Routing Rules for Domestic Traffic

V2Ray's routing configuration allows you to send domestic traffic directly while forcing foreign DNS lookups through the VPN. The routing section in v2ss/Windows版V2ray客户端安装配置指南.md (lines 120-138) demonstrates using geoip:cn and geosite:cn rules with the direct tag. This split-routing approach ensures Chinese domains resolve locally (avoiding leaks for domestic sites) while international domains use the encrypted tunnel.

Use PAC or Global Mode Strategically

Many client applications like ClashX and V2rayX provide PAC (Proxy Auto-Config) mode that only forwards DNS requests for blocked domains through the VPN. As described in macos/V2rayX.md (lines 110-115), selecting PAC mode versus global mode lets you control which DNS queries travel through the tunnel based on domain rules.

Verify Your Configuration

After configuration, test your setup by running nslookup for an external domain. The repository advises checking that the resolver IP matches your configured VPN DNS server (8.8.8.8, Cloudflare, etc.) rather than your ISP's IP. If queries resolve to your ISP's address, the leak persists and requires rechecking the proxy DNS settings.

Practical Configuration Examples

V2Ray Client JSON Configuration

This configuration from v2ss/Windows版V2ray客户端安装配置指南.md forces DNS through the proxy while routing domestic traffic directly:

{
  "dns": {
    "servers": [
      "8.8.8.8",
      "8.8.4.4"
    ]
  },
  "inbounds": [
    {
      "port": 1080,
      "protocol": "socks",
      "settings": {
        "auth": "noauth"
      },
      "sniffing": {
        "enabled": true,
        "destOverride": ["http","tls"]
      }
    }
  ],
  "outbounds": [
    {
      "protocol": "vmess",
      "settings": { }
    },
    {
      "protocol": "freedom",
      "tag": "direct"
    }
  ],
  "routing": {
    "rules": [
      { "type":"field","outboundTag":"direct","domain":["geosite:cn"] },
      { "type":"field","outboundTag":"direct","ip":["geoip:cn","geoip:private"] }
    ]
  }
}

Windows V2rayN System Proxy Setup

Enable automatic system proxy using the command documented in windows/V2rayN.md:

@echo off
REM Enable automatic system proxy for V2rayN
v2rayN.exe /set-proxy auto
REM Verify proxy is set
netsh winhttp show proxy

macOS V2rayX DNS Configuration

Set DNS servers via command line as referenced in macos/V2rayX.md (line 149):

# Assuming V2rayX is already running

defaults write com.Cenmrev.V2rayX DNS "8.8.8.8,8.8.4.4"
killall V2rayX && open -a V2rayX

Android v2rayNG DNS Settings

Configure DNS over the VPN in Android clients as shown in android/v2free.md (line 94):

// In v2rayNG settings UI → Advanced → DNS
dnsServers = "8.8.8.8,8.8.4.4";
proxyDNS = true;   // “Use SOCKS5 proxy for DNS”

Summary

• Enable SOCKS5 proxy DNS in your V2Ray or Shadowsocks client to force DNS queries through the encrypted tunnel.
• Set external DNS servers (8.8.8.8/8.8.4.4 or 1.1.1.1) in your client configuration to bypass ISP resolvers.
• Activate system-wide proxy mode to ensure the OS resolver routes traffic through the VPN.
• Implement split routing using geoip:cn and geosite:cn rules to handle domestic traffic locally while protecting international DNS queries.
• Test your setup using nslookup to verify the resolver IP matches your VPN's DNS configuration.
• Clear system DNS caches after enabling the VPN to prevent stale unprotected records, particularly on Android and iOS devices.

Frequently Asked Questions

What is a DNS leak and why does it happen when using a VPN?

A DNS leak occurs when your device sends domain name resolution requests to your Internet Service Provider's DNS servers instead of through the VPN's encrypted tunnel. This happens because operating systems often maintain default DNS settings that bypass VPN connections, or because the VPN client lacks proper DNS proxy configuration. When leaked, your ISP can see which websites you visit despite your traffic being encrypted.

How can I test if my VPN is leaking DNS queries?

Run the nslookup command for an external domain (such as google.com) and examine which DNS server responds. According to the fanqiang repository guidance, if the response shows your ISP's DNS server IP address rather than the VPN-configured resolver (8.8.8.8, 8.8.4.4, or 1.1.1.1), your DNS queries are leaking outside the tunnel.

Should I use Google DNS or Cloudflare DNS with my VPN?

Both are acceptable according to the fanqiang documentation. The repository specifically recommends Google's public DNS (8.8.8.8, 8.8.4.4) in macos/V2rayX.md and mentions Cloudflare DNS (1.1.1.1) in v2ss/V2Ray之TLS+WebSocket+Nginx+CDN配置方法.md. Choose based on latency and availability, but ensure the DNS servers are set explicitly in your VPN client configuration to prevent fallback to ISP resolvers.

Does using PAC mode prevent DNS leaks better than global mode?

PAC mode prevents DNS leaks for the specific domains routed through the proxy, while allowing domestic domains to resolve locally. As documented in macos/V2rayX.md, PAC mode is effective for preventing leaks on blocked sites while maintaining direct resolution for local sites. Global mode forces all DNS queries through the VPN, providing maximum protection but potentially slower resolution for domestic content.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}