DNS and leaks

Your DNS stays in the tunnel

Every website visit starts with a DNS lookup — turning a name like example.com into an address. If those lookups went to your internet provider, it could see which sites you visit even though the traffic itself is encrypted.

Your Ghostunnel configuration's DNS line points to a resolver running on the Ghostunnel server itself, at an address inside the tunnel (for example 10.200.0.1). Your lookups travel through the encrypted tunnel and are answered by our server — your network and internet provider don't see them. We don't log them.

A few older servers don't run their own resolver; their configurations use Google Public DNS (8.8.8.8) instead, still sent through the tunnel. You can check the DNS line in your configuration on the tunnel's page.

All traffic goes through the tunnel

The configuration's AllowedIPs = 0.0.0.0/0, ::/0 sends all of your device's IPv4 and IPv6 traffic into the tunnel, so nothing quietly bypasses it while the tunnel is on.

Checking for leaks

With the tunnel on, visit a DNS leak test site. It should show the country of your Ghostunnel location, not your internet provider. If it shows your provider:

• Make sure the tunnel is switched on in the WireGuard app.
• On Linux, check wg-quick applied the DNS setting — see Set up on Linux.
• Turn off other VPN or "secure DNS" apps that may override the setting.