MT3000, 4.8.1, VPN, DNS and routing

Router
1

Hello!

I have an MT3000 with a Wireguard tunnel, Global Tunnel and Kill Switch enabled. This works fine, clients get routed through the VPN.

After upgrading to 4.8.1, I’m observing the following:

  • opkg cannot access the network (“Failed to send request: Operation not permitted” is one of its messages that caught my attention).
  • My custom scripts running in the router cannot resolve DNS.
  • If I configure DoH in the router and set ‘Custom DNS overrides VPN DNS’, both opkg and my custom scripts are now able to access the Internet.
  • However, they are doing so directly through the uplink (ok for opkg, useless for my scripts – they are supposed to work with the tunnel’s other endpoint).

[UPD] This combination of observations seems to suggest that the DNS traffic originating in the router gets targeted to the VPN-advertised DNS, unless the “Custom DNS overrides VPN DNS” option is set, but the responses are not routed back.

In earlier firmware versions, all traffic originating in the router went through VPN. Can I get the same behaviour with 4.8.1? I am not using any cloud features or remote access to the router from the outside and will be ok with a solution that does not play well with those features. I do have “Services from GL.iNet Use VPN“ enabled.

Any suggestions will be greatly appreciated!

2

Hi

May we know why you want all traffic from the router itself to go through the VPN?

If you just want the network requests in your script to be routed through the VPN, this can usually be achieved by specifying the network interface in tools like curl, or by running the command with the specified group.

For example:

curl --interface wgclient1 example.com
sudo -g explict_vpn curl example.com

image
image956×1102 44.9 KB

4

My apologies for a long-delayed response, life interfered.

I did not know about the explict_vpn group and quick tests show that it is working for me. I’ll need to test things carefully, but it is looking very promising.

Many thanks!

1 Like
5

Another issue in my original post was with opkg; turns out a converse of the above helps:
sudo -g nonevpn opkg update

Interestingly, after succeeding once with nonevpn, it keeps working without it. Weird. I’ll keep an eye on it and post if find anything of interest.