Arch Linux User Repository

This package is the CLI package provided by Surfshark. It is different to the GUI package. Please only flag this as out of date if Surfshark update the CLI package.

Is there a way to add the following to the installer as Surfshark does not support IPv6?

This is what I did to switch IPv6 automatically on and off when connecting to a VPN through the Network Manager:

Create a script in /etc/NetworkManager/dispatcher.d:

$ sudo vi /etc/NetworkManager/dispatcher.d/99vpn-ipv6-switch Add the following content into the file (modify the contents for your requirements):

#!/bin/sh
# Network Manager Dispatcher Hook:
# enables/disables ipv6 on vpn-down/vpn-up respectively
#
# Copyright (c) 2017 ooknosi
# Apache License 2.0

# Args
INTERFACE="$1"
ACTION="$2"

case $ACTION in
    vpn-up)
    # vpn connected; disable ipv6
    sysctl -w net.ipv6.conf.all.disable_ipv6=1
    ### UNCOMMENT AND EDIT BELOW IF NECESSARY
    ## add pi-hole nameserver
    #echo -n "nameserver 192.168.1.1" | /sbin/resolvconf -a "tun0.openvpn"
    ### UNCOMMENT AND EDIT ABOVE IF NECESSARY
    ;;

    vpn-down)
    # vpn disconnected; enable ipv6
    sysctl -w net.ipv6.conf.all.disable_ipv6=0
    ### UNCOMMENT AND EDIT BELOW IF NECESSARY
    ## remove pi-hole nameserver
    #/sbin/resolvconf -d "tun0.openvpn"
    ### UNCOMMENT AND EDIT ABOVE IF NECESSARY
    ;;
esac

exit 0

Make the script executable:

$ sudo chmod 755 /etc/NetworkManager/dispatcher.d/99vpn-ipv6-switch

Just installing yay -S openvpn-update-resolv-conf-git alongside this package has it working fine.

As @emorice pointed out, /etc/openvpn/update-resolv-conf is expected by surfshark and the simplest way is just to add it as a dependency in PKGBUILD:

depends=(glibc openvpn openvpn-update-resolv-conf-git)

Surfshark leak test showed a DNS leak to Cloudflare due to a Firefox setting. Check:

• Preferences > General > Network Settings > Enable DNS over HTTPS (Use Provider - Cloudflare Default)

Ensure the option is not selected (unchecked).

Helpful information:

sudo cat /var/log/surfshark-vpn.log

@19Salvaju29ro95 I wished to visit a website with another country's IP but the website detected it and told me that this content is blocked in my country. I can't remember anymore which website it was exactly.

@archnoon Sorry, how do you know that you have DNS leaks? I have done various tests on the internet and it tells me that I have no leaks, but I have no script and I have not installed systemd-resolved

@emorice You are clearly more knowledgeable in achieving this than I am. Could you please point me to a step-by-step guide on how to fix this problem?

@archnoon no, what you're referring to is a configuration step for using systemd-resolved that is not specific to surfshark.

What I mean is that it is necessary to have a script at /etc/openvpn/update-resolv-conf: this script will be called during surfshark startup (edit: more precisely, this path will be given to openvpn through the up and down options of the openvpn configuration file that the surfshark binary generates on the fly and then called by the openvpn client), and the ips of the surfshark dns servers will be given to this script which is then responsible for forwarding this information to your dns configuration.

Two examples of such scripts are given in the wiki:

• one that updates your config by calling the resolvconf tool, which should be the one you need if you keep your config in /etc/resolv.conf, and have for instance openresolv installed to manage it. Since resolvectl has a resolvconf emulation, it could also work if you use systemd-resolved but I am not convinced it does.

• one that updates your config by talking to systemd-resolved over dbus, which is the prefered way if you use systemd-resolved and thus have your dns configuration kept in the daemon's memory instead of /etc/resolv.conf. This is what I use.

The point of symlinking is that the path /etc/openvpn/update-resolv-conf is, I think, hardcoded in surfshark, meaning that if the script is installed somewhere else (which was my case since I used the AUR package for the the systemd script), you need to symlink it under this path to have it called.

Finally, this only does half of the work: ensuring your dns config knows about the surfshark dns servers. You may also want to remove or block somehow your default dns servers to make sure they are not called as backups, which would also cause a leak.

@emorice Do you mean by symlinking the following command? ln -sf /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf If yes, do I understsand you correctly that installing and enabling systemd-resolved and this linking solves the entire issue?

I had and solved some dns leaks issues too. Inspecting and tracing the surfshark-vpn binary shows that it calls a script whose path is hardcoded as /etc/openvpn/update-resolv-conf. In debian*, which is the target system for this binary, it is always included as part of the openvpn package However on arch, it is a custom script that users chose to install or not, and wherever they want, or to use an alternative: https://wiki.archlinux.org/index.php/OpenVPN#DNS and is not included by default. Surfshark expects to find such a script and calls it with the dns servers to be set up in environment variables, so some handler must be installed and set up under this path. In my case, I use systemd-resolved, installing and symlinking update-systemd-resolved did the trick.

i'm getting the same leaks!! :( as you @ohobbs72