How do domain-based VPN exceptions work?

danielg · 2024-03-18T11:35:02.117Z

In firmware 4.x, how are domain-based VPN exceptions implemented, technically? Where do I find the exceptions in the file system?

alzhao · 2024-03-18T14:41:25.787Z

This seems difficult to answer. I don’t know untile I set up some policy and check what changed in the file system. But it should not be difficut to do so.

Do you want to modify settngs directly?

admon · 2024-03-18T14:53:55.787Z

danielg:

Where do I find the exceptions in the file system?

/etc/config/vpnpolicy

But I would recommend to utilize uci for changes here.

danielg · 2024-03-18T17:15:31.761Z

Did you mean LuCi? I looked in LuCi but couldn’t find the relevant section.

danielg · 2024-03-18T17:17:08.209Z

alzhao:

Do you want to modify settngs directly?

I am just trying to understand how domain exceptions work for local clients in order to better guess why they don’t work for tailscaled clients.

admon · 2024-03-18T17:22:21.002Z

No, I was talking about uci the OpenWrt configuration tool while using SSH.

danielg:

why they don’t work for tailscaled clients.

I guess because they don’t use the routers DNS?

danielg · 2024-03-18T19:46:29.262Z

admon:

I guess because they don’t use the routers DNS?

They do. Tailscale default setting is for devices to use the DNS of the exit node. I should be configured to be external, but I have done that already. It is set to Cloudflare in the GL firmware.

danielg · 2024-03-27T07:21:36.549Z

danielg:

how domain exceptions work for local clients

Could you explain how domain exceptions work for local clients and do you have an idea why they might not be working for tailscaled clients?

admon · 2024-03-27T07:46:05.237Z

They work by resolving the DNS entry using the local dnsmasq server on the router itself.
So as soon as a device is not requesting an DNS entry from the routers DNS server itself, they won’t work.

danielg · 2024-04-02T15:40:29.515Z

admon:

They work by resolving the DNS entry using the local dnsmasq server on the router itself.

Is this so even if I have configured DNS over TLS from Cloudflare on the router? I am not familiar with dnsmasq and how it is used in the GL firmware. Does it, like, forward DNS requests to whatever server is configured as the DNS server in the GL firmware, then apply the routing rule (exclusion or inclusion) on the IP obtained?

admon · 2024-04-02T15:41:20.066Z

danielg:

Does it, like, forward DNS requests to whatever server is configured as the DNS server in the GL firmware, then apply the routing rule (exclusion or inclusion) on the IP obtained?

Yep, that should be how it works since it even work with AGH enabled or DNS-over-TLS.