Flint 3 4.8.1 VPN+AdguardHome+NextDNS= IP LEAK

[Max3]

I just received my Flint 3 and I decided to try 4.8.1 beta.
I turned ON a VPN tunnel (tried OPVPN and Wireguard - I currently use Proton) and I enabled Adguard Home using NextDNS as Upstream DNS servers (tried H3, Quic, TLS).
Doing some dns leak tests on Browserleaks and Dnsleaktest everything seems fine BUT one thing bothers me: on NextDNS logs I see that my requests are from my WAN (my real IP) instead of my VPN Tunnel.

Tried this even on my Flint 2 with 4.8.0 beta and I had the same IP leak on NextDNS.

Then I tried reverting to 4.7.14 and everything is working as expected: on my NextDNS logs I see my VPN Tunnel address instead of my real IP...

[bruce]

Hi,

To be short, I tested it on Flint 3 v4.8.1 firmware and it didn't reproduce this issue. Please let me know what features you enable and configure, or say how to reproduce?

1. Enable WireGuard Client using Proton VPN
   

   

2. Enable ADG and set my Next DNS as the only upstream DNS server. The screenshot is DoT (TLS).
   

   
   
   
   

3. Check the Next DNS Log that the source IP is from the Proton VPN server (my profile), and no DNS leakage is found
   

   
   
   
   
   
   
   

[Max3]

That's the right settings.
However, My LAN1 port is set to WAN and I have a multi-WAN setup in failover mode.
EDIT: In Adguard Home I've chosen "parallel requests" instead of "load balancing", try also using H3 and QUIC please, as they seems the cause of the leak.

[bruce]

Well, I will test again.

Edit, looks like to reproduce, will further check to confirm.

Edit2, R&D found the h3 does not support, will further check.
Is it possible to temporarily remove h3, and use https, quic, and tls?

[Max3]

From what I've experienced H3 and QUIC basically makes the leak to appear instantly.
But it also happens even using TSL, with the only difference that it seems it requires more connection time to appear.

[Max3]

So, after further testing, the issue is really easy replicable on my side with both Flint 3 and Flint 2.
Any protocols cause leaks in Adguard Home with HTTPS being the less affected (requires more connection time and has less leaks).
Basically Adguard Home is totally unreliable in this state...

[bruce]

Thanks for the update!

Yes, we have also reproduced this issue on other router models, R&D will fix this issue and sync it to SDK for all models.

R&D has update the codes for resolve the issue, and the next version will be reorganized.
The test firmware is doing DNS stress tests.

Thank you again for your test!

[Max3]

Amazing, thank you!