How-to use ProtonVPN DNS server

[ilGimmy]

Hi, I setup a small docker container with ProtonVPN.
I'm using a pretty standard configuration:

---
services:
  gluetun:
    image: qmcgaw/gluetun
    container_name: gluetun
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun:/dev/net/tun
    ports:
      - 8888:8888/tcp # HTTP proxy
      - 8388:8388/tcp # Shadowsocks
      - 8388:8388/udp # Shadowsocks
      - 8080:8080
      - 3000:3000
      - 3001:3001
    volumes:
      - ./gluetun:/gluetun
    environment:
      # See https://github.com/qdm12/gluetun-wiki/tree/main/setup#setup
      - VPN_SERVICE_PROVIDER=protonvpn
      - VPN_TYPE=wireguard
      - WIREGUARD_PRIVATE_KEY=redacted
      - SERVER_COUNTRIES=Switzerland
      # Timezone for accurate log times
      - TZ=Europe/Rome
      # Server list updater
      # See https://github.com/qdm12/gluetun-wiki/blob/main/setup/servers.md#update-the-vpn-servers-list
      - UPDATER_PERIOD=12h
      - VPN_PORT_FORWARDING=on
      - VPN_PORT_FORWARDING_UP_COMMAND=/bin/sh -c '/usr/bin/wget -O- --retry-connrefused --post-data "json={\"listen_port\":{{PORTS}}}" http://127.0.0.1:8080/api/v2/app/setPreferences 2>&1'
      - DOT=off

I disabled DOT because I'd like to use ProtonVPN DNS server to pass DNS leak tests; but I cannot find them listed.
I was able to figure out that I can "compute" the DNS address from tun0 address; e.g. given this configuration

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:10.2.0.2  P-t-P:10.2.0.2  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP  MTU:1320  Metric:1
          RX packets:40332 errors:0 dropped:0 overruns:0 frame:0
          TX packets:134499 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:4344928 (4.1 MiB)  TX bytes:171332888 (163.3 MiB)

I see I can use 10.2.0.1 as DNS and pass DNS leak tests.

I was thinking about a script to get tun0 address, replace last triplet and echo it to /etc/resolv.conf; is there a better approach?

[ilGimmy]

Mmm...maybe I'm overthinking... 10.2.0.2 is the IP address of wireguard interface

--- redacted ---
|   └── Wireguard settings:
|       ├── Private key: redacted
|       ├── Interface addresses:
|       |   └── 10.2.0.2/32
|       ├── Allowed IPs:
|       |   ├── 0.0.0.0/0
|       |   └── ::/0
|       └── Network interface: tun0
|           └── MTU: 1320
--- redacted ---

can I assume it's always the same?
Can I tell gluetun/wireguard to set itself as DNS?

[ilGimmy]

Okay, I was definitely missing a point. The DNS is specified in the wireguard configuration download from ProtonVPN.
So I can just set it in gluetun configuration.

To recap:

1. download the configuration file from ProtonVPN
2. from this file, mark PrivateKey and DNS address
3. copy them to gluetun configuration file

---
services:
  gluetun:
    image: qmcgaw/gluetun
    container_name: gluetun
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun:/dev/net/tun
    ports:
      - 8888:8888/tcp # HTTP proxy
      - 8388:8388/tcp # Shadowsocks
      - 8388:8388/udp # Shadowsocks
      # - "add any port you want to open"
    volumes:
      - ./gluetun:/gluetun
    environment:
      # See https://github.com/qdm12/gluetun-wiki/tree/main/setup#setup
      - VPN_SERVICE_PROVIDER=protonvpn
      - VPN_TYPE=wireguard
      - WIREGUARD_PRIVATE_KEY="private key rom ProtonVPN wireguard config file"
      - SERVER_COUNTRIES="country of your choice"
      # Timezone for accurate log times
      - TZ="your timezone"
      # Server list updater
      # See https://github.com/qdm12/gluetun-wiki/blob/main/setup/servers.md#update-the-vpn-servers-list
      - UPDATER_PERIOD=
      - VPN_PORT_FORWARDING=on
      - VPN_PORT_FORWARDING_UP_COMMAND=/bin/sh -c '/usr/bin/wget -O- --retry-connrefused --post-data "json={\"listen_port\":{{PORTS}}}" http://127.0.0.1:8080/api/v2/app/setPreferences 2>&1'
      - DOT=off
      - DNS_ADDRESS="dns address from ProtonVPN wireguard config file"

[hokkar]

Tested using vpnleaktester.com, it's open-source and runs client-side only."