Network

VPN without DNS leaks

Keep locked Firewall stays closed. The leak people hit is DNS: the tunnel is up, queries still go to a global resolver or browser DoH. Stock’s rule is the standard — follow it.

  1. Proton VPN: WireGuard, not a random Flatpak

    Proton: ujust install-proton option 2. IVPN: ujust install-ivpn. Mullvad: ujust install-mullvad. Then keep system DNS. No unverified Flathub VPN apps.

  2. Other VPNs: Flatpak only if it exists

    Verified Flathub first. Grant only the network/device it needs in Flatseal. WireGuard in NetworkManager is fine. Random Electron VPN + brew is not the standard.

  3. Keep system DNS on the VPN

    Their selector:

    ujust dns-selector

    If you use a VPN: choose the system default resolver, not a custom Unbound/DoT path that bypasses the tunnel. They also document ujust dns-selector resolver resolved so systemd-resolved can take the VPN’s DNS. Especially skip setting Trivalent DNS-over-HTTPS in that case.

  4. Do not open the firewall “for the VPN”

    A well-packaged VPN uses the existing stack. If a vendor asks you to disable firewalld or SELinux, use another vendor.

From the vendor list (watched and healed twice a day). ujust install-vendor NAME or Setup → Strict apps. Group: vpn-dns.

Probe: ujust check-vendor-installers. New app = stanza in vendor-installers.json, not a one-off tutorial fork.

Canonical write-up: their post-install (DNS + VPN warning). Overlay does not replace that.