Adguard on Brume 3 with custom VPN settings

Router
1

Hi all!

I just picked up the Brume 3 to tinker with (and for its VPN tunneling power) and am both very impressed with it and somewhat overwhelmed with features (in a good way!).

I managed to get all set up without any issue and have uploaded a custom VPN config to the device (which its handling beautifully at about 95% of raw speed) - but I had a question about Adguard.

I think I understand that enabling this instead of opting to use the VPNs adblock config is reasonable and allows me extra control over what traffic I can see which is great, I just want to double check that there’s no privacy considerations with its using the Adguard DNS instead of the DNS used by the VPN config itself? I’ve done a DNS leak test and it seems fine (everything comes up as cloudflare, and my IP address is set to Proton server’s address) - but am I missing anything with respect to privacy here?

Thank you!

2

Hello,

Configuring a custom DNS server in AdGuard won't raise any privacy concerns, as long as you trust the DNS provider you're using.

Basically, as long as your local DNS (like ISP DNS servers) don't show up in the result of the DNS leak test, you're good to go, no leaks there.

4

Just to add on, I think I’ve partially solved why my desktop and wireless device (both routed through VPN on brume 3) were showing partially different DNS servers (cloudflare/adguard and datacamp) - likely because I was accessing the DNS leak test through my browswer which was using DNS over Oblivious HTTP (confimed as when I set this to default in the browser the DNS leak test showed only datacamp).

I’m still not sure why earlier though my wireless device was showing google DNS queries while the brume 3 was set to Allow Custom DNS to Override VPN DNS unless somehow my android browser DNS setting was overriding that used by the router?

5

Bear with me, I suddenly feel like a big noob!

Here’s my setup for clarity:

Internet > Brume 3

-Brume 3 wired to: 1. Router (set to AP mode) and 2. Desktop
-Brume 3 is acting as a VPN client and the VPN is set to ‘All Targets’ while allowing exceptions on a case by case basis
-Adguard home is setup and states it covers all the devices on the home network.
-DNS settings with adguard home on Brume 3 state that DNS server settings will not work because AdGuard Home is being used. “AdGuard Home is enabled and this router will use the DNS server provided by AdGuard Home as the custom DNS server. The DNS server settings will not work.”

That said, despite the last point, if Allow Custom DNS to Override VPN DNS is set in DNS settings (which shouldn’t work per the DNS settings page statement) then the devices through the access point (router in AP mode) show DNS queries through Google:

image
image2410×1080 329 KB

while the desktop wired directly to the brume 3 (no AP) show only cloudflare.

With all settings under the Brume 3 DNS set to off, I get my desktop showing all cloudflare (same as above), and my wireless devices using the VPN DNS (datacamp).

So I guess I’m a little confused.

What I want is to use either the VPNs DNS or Adguard DNS (which I assume is cloudflare?) - and I’m not sure why Allow Custom DNS to Override VPN DNS was set to on in the first place (as I’ve not entered a custom DNS manually) and/or why it is showing queries from google/WoodyNet.

In my VPN settings I have “Route all traffic through the VPN by default, except for the explicitly chosen devices. Useful for gaming consoles or local services.”

Sorry if this is confusing, I guess that reflects my own confusion!

Thanks in advance.

6

I just want to add to this.

The DNS settings page does indeed become restricted when adguard home is enabled but the toggle options are still functional including to route VPN DNS, you can toggle this on so that adguard home can serve as the DNS for the VPN traffic too or toggle it off so it hits the VPN providers DNS.

If you toggle adguard home off via the applications menu you will see the DNS settings, I believe the message you are seeing when adguard home is enabled is just mentioning that those settings are no longer available, is that right @bruce - maybe it will be better for the gui to show the original settings section but grey it out with the tooltip so it's doesn't seem like the toggle switches are also not applicable.

Your computer might be showing Cloudflare because the browser is using HTTPS (DoH) in its browser settings. Firefox for example has: Default Protection - Firefox decides when to use secure DNS to protect your privacy. I find this can mess with results. You can disable it from the Firefox settings, settings > DNS over HTTPS then toggle to off. This will then always use your DNS.

What I want is to use either the VPNs DNS or Adguard DNS (which I assume is cloudflare?)

The reason you might be seeing woodynet (quad9) and Google DNS is because adguard home is calling them in your config. You can login to adguard home settings and check your DNS upstream to see what adguard is using / you can also change them. I think it's quad9 by default (woodynet) inside adguard home. It can be any dns provider you want to set it as.

If you turn off: Allow Custom DNS to Override VPN DNS

and route your clients via the 3rd party VPN tunnel you will find the DNS should be hitting the VPN provider.

Toggle on: Override DNS Settings of All Clients

This will help force clients that try and use their own DNS regardless.

Also if you can, I would enable/toggle on: AdGuard Home Handle Client Requests

By doing so you can then see each device in the logs which helps, for example. If you enable Allow Custom DNS to Override VPN DNS you would see the devices that are going via VPN hitting your adguard home logs, when you toggle off you will see no such entries. You also get the ability to create clients inside adguard home and set per device rules, individual DNS for each device, custom block rules etc.

The one thing I found myself needing to do is go to each device and ensure that any browser DoT or DoH settings are off, like I mentioned above with the default Firefox HTTPS DNS settings. @bruce is there a way in which can force / refuse browser DoT and DoH with some firewall rules to prevent internet access without hitting the brume first?

1 Like
7

Hi J2zero,

Thank you for taking the time to respond, and for responding so clearly. You appear to be correct in your assumptions.

I am using Firefox (or rather, Waterfox - one of its derivatives) and I did have it set to use its default protetion which was its own secure DNS - which as it turns out appears to be through cloudflare as turning that to ‘off’ changes it to my VPN’s DNS.

RE the GUI and the message about DNS settings being disregarded if AdGuard was set to on, yes that is as you say what I thought given the messaging, I see now that turning it off opens up the DNS settings that were previously hidden otherwise.

I got into the upstream AdGuard settings and it appears it defaults to both Google and Quad 9:

image
image2014×392 28.2 KB

I’ve changed this to remove Google DNS (8.8.8.8) and replaced with Quad 9s fallback for my secondary (149.112.112.112). My VPN doesn’t offer a public DNS address as per my research they use an internal DNS - so I guess my choices are either to trust Quad 9 (I do more than Google that’s for sure) or turn off “Allow Custom DNS to Override VPN DNS” in the Brume settings to ensure it hits the VPN’s internal DNS.

I can confirm that turning on both Allow Custom DNS to Override VPN DNS… and Override DNS Settings of All Clients appear to now use only the Quad 9 (Woodynet) DNS resolver now that I’ve changed in the AdGuard Settings removing Google, while as you’ve suggested, turning off “Allow Custom DNS to Override VPN DNS”, in combination with my changing the default DoH settings to ‘off’ in the browser now appears to use the VPNs DNS exclusively (whatever that might be).

I have additionally done as you’ve suggested and turned on “allow AdGuard Home Handle Client Requests” which seems to imply I’ll be able to see all the querired domains regardless of whether I’m using the VPN dns or those set in the AdGuard upstream settings.

In short, you seem to have been spot on about everything. Thanks for your thorough suggestions and explanations. I’ll keep my eye on it to see if everything remains consistent, but this has been a big help!

Edit: I’ve also added the IPV6 addresses for Quad 9 to the Adguard DNS settings as they were not there previously. It now looks like this:

9.9.9.9
149.112.112.112
2620:fe::fe
2620:fe::9

8

No worries. Glad I could help.

That's not entirely true. You won't be able to see any logs inside adguard home for VPN clients (3rd party VPN provider) if you have disabled the override VPN DNS settings (you will still see regular DNS queries just not any queries from client's you have told to go via VPN as they will bypass adguard home / your router), regardless of having “Handle Client Requests” enabled. If you want to see both regular and VPN DNS queries in the logs then the “Allow Custom DNS to Override VPN DNS” must be toggled on.

The client request logs can only appear inside adguard home if your DNS is pointing to your Brume / adguard home instance. All regular traffic would automatically be routing via adguard home so they appear. VPN traffic hits the VPN DNS (if override custom DNS is off) so it never hits adguard home to log. The handle client request will help though when you are using adguard home, be it for regular clients or if you choose to override the VPN DNS as each client will report their IP in the logs along with the sites they are visiting. Without having the “Handle Client Requests” on you would just see the main router making all the request and lose the other benefits I mentioned earlier.

In my personal setup I stick with the VPN providers default DNS (toggled off) I know I won't get any adguard benefits for my VPN clients (external 3rd party VPN) but I also know that if the tunnel isn't up and running then the DNS will fail, because like you my VPN provider uses internal DNS IP rather than public, so it can only be hit via their tunnel rather than possibly leak.

By default (older firmware) glinet made ALL DNS queries via adguard home to use the VPN tunnel (if active) regardless if certain clients were exempt. In later firmware versions this logic changed and now adguard home respects which client is going via VPN or not and successfully queried the DNS over WAN (clear isp connection) or VPN tunnel.

A quick visual way you can test if your adguard home is behaving is by setting your VPN to a different country, set the custom override VPN DNS to on and do the ipleak test again. Do one with a client that's going via the VPN and one that's not. You should see the same quad9 results (because they are going via adguard home) but this time each result should have different country flags (as long as your not using neighbouring countries which could potentially use similar DNS servers) again, I keep my VPN off my adguard home (custom DNS over VPN: off) as I just prefer the separation. As for the ipv6 I just left that out as I'm unsure if that could potentially have leaks.

Oh and just so you know. If you setup the Brume to have wireguard or openvpn server then they too also have DNS settings. By default they use a public external DNS but you can also change the config files of them to match your Brume IP which will then use your router DNS settings, be it the default DNS settings or your adguard home settings if you are running it. That toggle about overriding VPN DNS only applies to commercial VPN providers (3rd party VPNs) so if you want to remote home via VPN / wireguard for example you might want to set the DNS to your router so they too will benefit from adguard home rather than using external DNS.

9

Thanks for the instructions and clarification. I’m going to test this out when I get back from work tonight (10 hour days right now so I haven’t had a chance).

In the mean time, am I correct in thinking then that if I did switch to a VPN provider with an external DNS, I could add that upstream in Adguard, toggle override VPN DNS settings, and then have full adguard logs while protecting against DNS leaks as both my VPN and DNS settings would be set to the VPN? Is there any benefit you can think of from using Adugard VPN itself?

Thanks for the final tip on the server as well, I appreciate it.

10

Hello,

When AdGuard Home is enabled, the DNS Server Settings section is hidden because it is managed by the AdGuard Home.

However, you can still configure the three options below, and they will work as expected.

Bruce_2026-08-04_14-43-51
Bruce_2026-08-04_14-43-51786×311 12.1 KB

Since DoT and DoH traffic is encrypted, we can't intercept or redirect it via specific ports. If your client has encrypted DNS enabled, the DNS leak test will naturally show the encrypted DNS provider you've configured on your device—this is actually the expected behavior. The router can only intercept and redirect DNS queries if your client is set to use the router's IP or a standard, unencrypted UDP DNS (like 8.8.8.8).

11

Hello,

Just a quick heads-up: even if your router's DNS server (including AdGuard Home) isn't using the VPN's DNS, you're still safe from leaks as long as a DNS leak test shows your traffic exiting through the VPN's gateway rather than your ISP's.

Your proposed setup is totally fine, though.

As for AdGuard Home, it’ll capture full logs regardless of whether it’s using the VPN’s DNS, as long as your clients are pointing to the router’s IP for DNS (meaning they aren't using encrypted DNS like DoH/DoT).

Regarding AdGuard VPN, it seems they only support IPSec protocol, not WireGuard or OpenVPN.
We’ve got a guide on the forum for this—take a look and see if that helps!

12

@bruce I think that's where some confusion lies. Because the warning tooltip is above the toggles

“The DNS server settings will not work” because we can't already see the settings that it's referring to / won't work then what is the point in that tooltip? It looks like it's referring to the toggles directly below. After all, those settings that we can toggle are DNS settings??

It would make sense if the tooltip existed because the DNS server settings it's referring to were visible, if the settings it is refering to are hidden then surely it leads to people believing it's the settings that are on display? Maybe remove the tooltip altogether since the settings are hidden or reword the tooltip and have the settings it's referring to disabled and visable to prevent any confusion.

13

I totally agree with your point.

I am going to pass this feedback along to our PM team and push for some improvements to this page. Thanks for bringing this up!