A DNS leak is a security flaw where your internet requests bypass your VPN’s encrypted tunnel, exposing the websites you visit to your Internet Service Provider (ISP) or third parties. It defeats the primary privacy purpose of using a VPN.
How it works
The Domain Name System (DNS) is essentially the internet’s phonebook. Whenever you type a URL like google.com into your browser, your device sends a request to a DNS server to translate that domain into a numerical IP address so it can connect.
- Without a VPN: These requests are handled by your ISP’s default DNS servers, meaning they can log every site you visit.
- With a VPN: These requests should be securely routed through the VPN’s own private, encrypted servers.
- The Leak: If your connection experiences a DNS leak, your VPN successfully hides your browsing content and IP address, but your DNS requests “spill out” of the encrypted tunnel and are sent directly to your ISP.
How to Detect and Fix a DNS Leak
It is highly recommended to periodically check if your connection is secure by running a diagnostic test.
- Test Your Connection: You can use a free web-based tool such as the DNS Leak Test or the Control D DNS Leak Test. These will display the IP and location of the servers answering your requests. If your ISP’s name shows up instead of your VPN provider, your DNS is leaking.
- Fix the Leak: Ensure your VPN’s “DNS Leak Protection” and “Kill Switch” settings are toggled on in the application preferences. If the problem persists, consider disabling IPv6 on your device or switching the VPN protocol (e.g., from WireGuard to OpenVPN) within the app.
Test your connection: DNS Leak Test (DNS leaktest.com)
Test your connection: DNS Leak Test (Bash.ws)
OpenVPN v2.3.9+
As of OpenVPN version 2.3.9, it is possible to prevent DNS leaks by specifying a directive in the configuration file (OVPN or CONF file extension). Edit the configuration file for the server that you are connecting to and add the following on a new line. For more information, see the OpenVPN manual. OpenVPN Manual.
Manhattan Aero 4K TV Streamer with Freely
To run a DNS leak test on your Manhattan Aero Freely box, open the box’s web browser and navigate to a testing website like DNSLeaktest.com or bash.ws. If the test displays your actual ISP or location instead of your VPN provider, your private data is leaking.- There are no VPN apps currently available on the Manhattam Aero at present.
- You can set the VPN DNS server from Automatic to Manual Configuration, under Settings, Network, Nework Configuration. This option may allow DNS Leaks.
- For best results, use a router with a VPN option and activate the Kill VPN switch for your VPN.
- Open the Browser: Locate and open the web browser app on your Freely box.
- Access the Tool: Type dnsleaktest.com or bash.ws/dns into the address bar.
- Run the Check: Most sites will automatically begin checking. Choose “Standard Test” on DNSLeaktest.com for a quick check.
Interpret the Results:
- Secure (No Leak): The results should show your VPN provider’s name and the location of the VPN server you connected to.
- Leaking: If the results show your actual broadband provider (e.g., BT, Sky, Virgin Media) or your local geographic area, your DNS queries are bypassing the VPN.
Channels with known DNS Leak issues:
- U&Dave
- U&Davejavu
U&Drama- U&Eden
- U&Yesterday
- S4C (working on BBC iPlayer)
- Talking Pictures
Apps with known DNS Leak issues:
- STV Player
- Pluto TV
- Rakuten TV
How to Fix a DNS Leak on the Manhattan Aero
To stop DNS leaks on your Manhattan Aero streaming box while using a travel router (e.g., GL.iNet) to connect to Freely, you need to force all DNS traffic exclusively through your VPN’s tunnel.
Here are the best router settings to apply in your router’s admin panel:
- Override DNS: Toggle on “Override DNS Settings of All Clients”. This forces the Manhattan box to use your VPN’s secure DNS rather than defaulting back to your ISP.
- Block Non-VPN Traffic: Ensure your VPN (e.g., WireGuard or OpenVPN) has “Block non-VPN traffic” (Kill Switch) enabled. This prevents any requests from bypassing the tunnel if the VPN connection briefly drops.
- DNS Mode: Set the DNS Mode to “Automatic” to let the VPN tunnel dictate your DNS routing, or manually assign the specific DNS IP provided by your VPN service.
- Disable IPv6: Disable IPv6 in your router’s WAN and LAN settings. Because many VPNs only cover IPv4, leaving IPv6 active can cause DNS requests to leak through your ISP.
- Disable Rebind Protection Check: If your router has a “DNS Rebinding Protection” feature, disable it or check “Allow custom DNS to Override VPN” (depending on your firmware) so your DNS queries resolve directly to your VPN server.
To verify your changes, you can use the built-in browser on your Manhattan device or a connected PC to run a check on DNSLeaktest.com.
To stop DNS leaks on a router operating as an OpenVPN Client, you must prevent the router from handing your local Internet Service Provider’s (ISP) DNS servers directly to your Manhattan Aero box.
Unlike travel routers, some routers do not feature a single “Force VPN DNS” or “Override DNS” toggle. Instead, you must manually isolate the WAN and LAN DNS settings to patch the leak.
- Hardcode Your VPN’s DNS in LAN Settings
By default, the router forwards its WAN (ISP) DNS to local devices. Hardcoding a secure, leak-free DNS server at the local network layer forces the Manhattan box to use it instead.
- Log into your router’s web interface at tplinkwifi.net
- Navigate to Advanced > Network > LAN Settings.
- Locate the DNS Server fields.
- Enter your VPN provider’s specific DNS server addresses.
- Note: If your VPN provider does not list static DNS IPs, use generic, privacy-respecting alternatives like 9.9.9.9 (Quad9) or 1.1.1.1 (Cloudflare).
- Click Save.
- Disable IPv6 Completely
OpenVPN profiles handled by routers often leak queries over IPv6 because the OpenVPN client tunnel primarily wraps IPv4 traffic.
- Go to Advanced > IPv6.
- Toggle the main IPv6 switch to OFF.
- Click Save.
- Bind the Manhattan Aero to the VPN Client
Ensure that your Manhattan device is explicitly routed through the active OpenVPN profile, leaving no room for a split-tunnel bypass.
- Navigate to Advanced > VPN Client.
- In the Device List section at the bottom, click Add.
- Select your Manhattan Aero device from the list of connected clients.
- Ensure its slider toggle is explicitly enabled to pass traffic directly through the OpenVPN profile.
- Edit the .ovpn File (If Leaks Persist)
If your Manhattan box still reports a DNS leak via DNSLeaktest.com, the OpenVPN configuration file itself isn’t forcing the routing block correctly. You can fix this manually:
- Open your VPN provider’s .ovpn file on a computer using a text editor like Notepad.
- Add the following blocks on their own new lines at the bottom of the text:
- block-outside-dns
- redirect-gateway def1
Save the file, delete your old VPN profile from the TP-Link interface, and upload this modified .ovpn profile under Advanced > VPN Client > Server List.