Issues accessing internet over cellular with Adguard and Tailscale

Router: GL.iNet GL-BE6500
Firmware: v4.8.7
Internet: via Virgin Media Hub 5 (in modem mode)
DNS: Adguard Home
DHCP or Static?: DHCP (some devices are reserved or static)

Hey folks!

I'm trying to permit access to my Truenas apps using local DNS rewrites (configured in Adguard Home), over my phone's cellular network using Tailscale.

With all settings as default, on my local wifi everything works great. But when I switch to cellular, I can't resolve local DNS records.

I found that I could fix this by setting the Adguard Home DNS port to 53, meaning I had to disable dnsmasq DNS (by setting its port to 0). By doing this, with the Tailscale client on device enabled, I was able to resolve local DNS records AND access public internet resources over cellular. But when I disable the Tailscale client on the device (or on devices without TS), public internet access no longer works (I only tested hitting google.com, but while I'm writing this it's occurred to me that perhaps I should try hitting public IPs directly? Will update the post after I've done that).

I have a diagram of my setup here, in case that's useful:

(I tried to be as comprehensive as possible but if I've missed anything, apologies in advance)

Does anyone here have a similar (working) setup? I'd really appreciate some advice.

Cheers,
- J

Hi

Could you clarify this further?
Do you mean that after disabling Tailscale on the router, you can’t access the internet, or are you referring to other devices running Tailscale, such as a Pixel 8?

Thanks for the reply!

I mean after disabling TS on the device, so the Pixel 8 in this case.

One alternative solution I found success with was by utilizing port forwarding rules to forward all traffic bound for port 53 in the tailscale zone to port 3053 on the device (input) interface. However this seems to massively slow down all internet traffic over the network, not sure why.

That sounds a bit unusual—it’s possible that Tailscale didn’t restore the DNS settings properly when it exited.
For further diagnosis, you may need to seek help from Tailscale if the issue can be reproduced consistently.


If you simply want other Tailscale nodes to use the AdGuard Home running on the BE6500 as their DNS server, you can refer to the following post: