Re: Have you ever disabled IPv6 for privacy (to prevent IP leaks)?

Note that there is a directive for configs that blocks IPv6 altogether.
  block-ipv6 ; block IPv6 traffic to prevent IPv6 leaks
We have to worry about DNS leaks, but there are directives for that too.
 block-outside-dns ; force DNS queries to stay inside the VPN TAP interface 
Unfortunately, specifically stating the DNS server in the tunnel failed.
  ; dhcp-option DNS 1.1.1.1 ; set primary DNS to Cloudflare inside the tunnel
  ; dhcp-option DNS 9.9.9.9 ; set secondary DNS to Quad9 for secure fallback
The volunteer VPN servers I use don't seem to accept those DNS directives.

But those directives should work on more professional OpenVPN servers.
I only use the thousands of free openvpn servers from around the world.

These are the commands I add to every one of hundreds of free config files.
Notice the DNS-related commands are brand new, to keep DNS inside the tunnel.

  auth-nocache ; prevent caching of auth credentials in memory
  auth-retry nointeract ; retry silently using stored username/password
  auth-user-pass C:\\data\\vpn\\userpass.txt ; login file path
  block-ipv6 ; block IPv6 traffic to prevent IPv6 leaks
  block-outside-dns ; force DNS queries to stay inside the VPN TAP interface 
  ; NB block-outside-dns breaks OS DNS if the VPN's DNS server is dead
  ; dhcp-option DNS 1.1.1.1 ; set primary DNS to Cloudflare inside the tunnel
  ; dhcp-option DNS 9.9.9.9 ; set secondary DNS to Quad9 for secure fallback
  connect-retry-max 20 ; increase max reconnect attempts (default=8)
  connect-retry 5 ; shorten delay between reconnect attempts
  connect-timeout 30 ; time before initial connect attempt times out
  data-ciphers AES-256-GCM:AES-128-GCM:AES-128-CBC ; required by vpngate.net
  explicit-exit-notify 2 ; send disconnect notice to UDP servers
  float ; accept server IP changes during session
  hand-window 180 ; extend TLS handshake window (default=60)
  inactive 3600 ; allow long idle periods before timeout (default=off)
  ip-win32 adaptive ; choose best Windows IP/DNS routing method
  keepalive 10 60 ; ping every 10s, restart after 60s silence
  mssfix 1400 ; adjust TCP MSS to reduce fragmentation
  tun-mtu 1400 ; set tunnel MTU to avoid packet fragmentation
  ; pull-filter ignore "redirect-gateway" ; prevent server from setting gateway
  pull-filter accept "redirect-gateway" ; accept the vpn server routing changes
  pull ; accept configuration pushed by the VPN server
  replay-window 128 ; enlarge replay protection packet window
  route-delay 10 ; delay route setup to avoid race conditions
  server-poll-timeout 120 ; wait longer for server PUSH reply (default=2)
  tls-timeout 180 ; extend TLS negotiation timeout (default=60)
  verb 4 ; moderate verbosity, show key events without packet spam

During testing, on Windows, I made use of the old curlit shortcut:
 Win+R > curlit
 Which calls curlit.exe which is defined only in the Windows Registry
  HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\curlit.exe
  Default=C:\path-to\curlit.lnk
 Where the TARGET of that curlit.lnk shortcut does the IP check.
  Target=%comspec% /k echo "C:\data\sys\pgm\lnk\curlit.lnk $MYIP" & %Windir%\System32\curl.exe icanhazip.com
 NB: There is no command called "curlit.exe"; that's a unique reg keyword.

I tried to make it fancier with curlvpn but that errored out on Windows:
 TARGET=%comspec% /k echo "curlvpn: forcing curl through VPN TAP adapter" & %Windir%\System32\curl.exe --interface Ethernet --dns-servers 1.1.1.1,9.9.9.9 icanhazip.com
I'm sure that curl syntax would work if curl were compiled differently.
 "curlvpn: forcing curl through VPN TAP adapter"
 curl: option --dns-servers: the installed libcurl version does not support this
 curl: try 'curl --help' for more information
 
But I like my commands to work universally so I changed it to 
 Win+R > curldns
 Which calls curldns.exe which is defined only in the Windows Registry
  HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\curldns.exe
  Default=C:\path-to\curldns.lnk
 Where the TARGET of that curldns.lnk shortcut does the IP check.
  %comspec% /k echo "C:\data\sys\pgm\lnk\curldns.lnk $MYIP" & echo curldns & nslookup icanhazip.com & powershell -Command "Resolve-DnsName icanhazip.com" & curl icanhazip.com
 NB: There is no command called "curldns.exe"; that's just a reg keyword.

I post it here so that others, at least on Windows, can instantly replicate
this shortcut efficiency to make sure their VPN DNS remains in the tunnel.
-- 
I strive to add technical value, if possible, with every post to Usenet.