Recently I’ve upgraded from v4.8.2 (op24) to v4.9.0 due to multiple kernel panic. As all the settings required to be reconfigured, can someone advise me how to configure in such a way that when I do a nslookup that’s specified in VPN gets resolved (e.g domain aaa.bbb.cc is specified in VPN Tunnel 1, if I were to do a nslookup it’ll be resolved)?
My current setup is such a way that Adguard is listening to port 53 and my router DNS port 5353 (otherwise adguard will reflect all clients are 127.0.0.1 instead of the actual local ip address).
Thanks!
Hi
Unfortunately, the domain list in VPN Policy cannot work together with either AdGuard Home → AdGuard Home Handle Client Requests or when AdGuard Home is configured to listen on port 53.
If you don't mind AdGuard Home seeing all client source addresses as 127.0.0.1, you can restore AdGuard Home's listening port to the default 3053 and adjust the settings as shown below to make the VPN Policy domain list work correctly:
Network - DNS:
Enable the “Allow Custom DNS to override VPN DNS” option so that all LAN clients can use AdGuard Home filtering.
Application - AdGuard Home:
As mentioned earlier, we need to disable “AdGuard Home Handle Client Requests.”
Hi Will, the reason I would want to see other than 127.0.0.1 is to see who is accessing what and who gets blocked.
e.g I would want to ban access to roblox.com but allow certain local IP address to access specified in the custom filtering rules. I don’t think this would be possible if all the IPs are seen coming from 127.0.0.1, correct me if I’m wrong.
Thanks again for your attention.
In this case, there isn't a good solution at the moment.
Displaying the actual client IP addresses in AdGuard Home (instead of 127.0.0.1) is currently incompatible with the VPN Policy domain list feature.
This is because:
- For AdGuard Home to display the actual client IP address, LAN clients must send their DNS requests directly to AdGuard Home, bypassing dnsmasq.
- The VPN Policy domain list relies on dnsmasq to function.
- If dnsmasq forwards the LAN DNS requests to AdGuard Home, then AdGuard Home will only see the requests as originating from 127.0.0.1.
We'll discuss this further with our development team to see whether there's a way to address this limitation in a future release.
Hi Will, pardon my ignorance if I my understanding is incorrect. What I had in mine was that if VPN is in used, it will bypass Adguard altogether, would this be more feasible? So let’s say if I were to bypass GL.iNet panel altogther and configure using VPN Policy Routing through luci with this same concept (ie VPN bypass adguard), you reckoned it will still not work?
Thanks!
Hi
We think the simpler and more convenient long-term approach would be to have AdGuard Home automatically add the resolved IP addresses of domains to the corresponding ipset.
In the meantime, you could also try using a third-party LuCI VPN Policy Routing application to see if it meets your needs. However, since we're not very familiar with those packages, we may not be able to provide much assistance with their configuration or troubleshooting.
