# MT6000 DNS Leak with AGH and WG VPN **URL:** \ **Category:** VPN, DNS, Leaks\ **Created:** [February 11, 2025, 3:21am UTC](https://forum.gl-inet.com/t/mt6000-dns-leak-with-agh-and-wg-vpn/54339 "2025-02-11T03:21:29Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![misuzu](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/misuzu/32/14021_2.png) [@misuzu](https://forum.gl-inet.com/u/misuzu)\ **Post date:** [February 11, 2025, 3:21am UTC](https://forum.gl-inet.com/t/mt6000-dns-leak-with-agh-and-wg-vpn/54339/1 "2025-02-11T03:21:29Z")
I tried scouring the forums but I havent seen any fixes. Router: MT6000 Firmware: 4.7.0 OP24 Description: Im using WireGuard config from Windscribe with Global Proxy. My Adguardhome on the other hand, has my preferred DOH servers from Cloudflare, Google, and Quad9 with proper fall back addresses. Now, when I turn off the VPN and use AGH only, the DNS leak doesnt happen and when VPN is enabled, it does. I tried toggling AGH handle client request on and off but its the same result. VPN On (Rise Asia Technology Limited is my providers DNS) ![image](https://forum-static.gl-inet.com/original/3X/3/6/36000f2f463b9239b8d2eafb0bd718052196d35e.png) However, that address doesnt appear at all when VPN is off. ---
**Author:** ![misuzu](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/misuzu/32/14021_2.png) [@misuzu](https://forum.gl-inet.com/u/misuzu)\ **Post date:** [February 11, 2025, 3:35am UTC](https://forum.gl-inet.com/t/mt6000-dns-leak-with-agh-and-wg-vpn/54339/2 "2025-02-11T03:35:33Z")
I think I got the fix? Apparently using Quad9's DOH and DOT causes the leak. I tried commenting it out and did the tests again with Cloudflare and Google DOH and DOT active (parallel requests and optimistic caching enabled), the leak never happened again. Upstream DNS: ```auto https://dns.cloudflare.com/dns-query #https://dns.quad9.net/dns-query https://dns.google/dns-query tls://one.one.one.one #tls://dns.quad9.net tls://dns.google ``` ---
**Author:** ![teleney](https://forum-assets.gl-inet.com/letter_avatar_proxy/v4/letter/t/3be4f8/32.png) [@teleney](https://forum.gl-inet.com/u/teleney)\ **Post date:** [February 11, 2025, 9:01am UTC](https://forum.gl-inet.com/t/mt6000-dns-leak-with-agh-and-wg-vpn/54339/3 "2025-02-11T09:01:00Z")
Hi, This is the first time I have seen this. I guess the network in your area may have hijacked the Quad9 domain name. Perhaps you can try to manually resolve the nord9 domain name and use the obtained IP address to query the geographic location information for verification. ---
**Author:** ![misuzu](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/misuzu/32/14021_2.png) [@misuzu](https://forum.gl-inet.com/u/misuzu)\ **Post date:** [February 11, 2025, 9:59am UTC](https://forum.gl-inet.com/t/mt6000-dns-leak-with-agh-and-wg-vpn/54339/4 "2025-02-11T09:59:26Z")
Really weird right? And this will only happen when VPN is turned on. AGH as standalone doesn't have any problems with it. I will your proposed testing later. ---
**Author:** ![misuzu](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/misuzu/32/14021_2.png) [@misuzu](https://forum.gl-inet.com/u/misuzu)\ **Post date:** [February 11, 2025, 10:38am UTC](https://forum.gl-inet.com/t/mt6000-dns-leak-with-agh-and-wg-vpn/54339/5 "2025-02-11T10:38:18Z")
This is the only info that I could find. **Config: VPN Off** dig / dnslookup returns: ```auto root@GL-MT6000:~# nslookup dns.quad9.net Server: 121.54.70.162 Address: 121.54.70.162:53 Non-authoritative answer: Name: dns.quad9.net Address: 149.112.112.112 Name: dns.quad9.net Address: 9.9.9.9 Non-authoritative answer: Name: dns.quad9.net Address: 2620:fe::fe Name: dns.quad9.net Address: 2620:fe::9 ``` ```auto root@GL-MT6000:~# dig dns.quad9.net +short 149.112.112.112 9.9.9.9 ``` **Config VPN On:** ```auto root@GL-MT6000:~# dig dns.quad9.net +short ;; communications error to 121.54.70.162#53: timed out ;; communications error to 121.54.70.162#53: timed out ;; communications error to 121.54.70.162#53: timed out ;; communications error to 121.54.70.154#53: timed out ``` So 121.54.70.154#53 is obviously not a Quad9 address. When I tried to check it via [ipinfo.io](http://ipinfo.io), it returns: ![image](https://forum-static.gl-inet.com/original/3X/c/e/cea424d1fa448daf07d97c62d9a1c6fbee020879.png) Which is my Internet Provider's Prepaid / Cell telecom company. Im using Postpaid Fiber which is handled by their sister company, PLDT, but its highly possible that theyre sharing the same infra. I could simply not use Quad9 as a resolver for now since VPN is much more important but its a waste since Quad9's response time is better than Cloudflare or Google most of the time. Any possible lead from this info? ---
**Author:** ![teleney](https://forum-assets.gl-inet.com/letter_avatar_proxy/v4/letter/t/3be4f8/32.png) [@teleney](https://forum.gl-inet.com/u/teleney)\ **Post date:** [February 12, 2025, 1:22am UTC](https://forum.gl-inet.com/t/mt6000-dns-leak-with-agh-and-wg-vpn/54339/6 "2025-02-12T01:22:31Z")
> [@misuzu](#): > > I could simply not use Quad9 as a resolver for now since VPN is much more important but its a waste since Quad9's response time is better than Cloudflare or Google most of the time. Any possible lead from this info? Hi, It seems that the DNS address sent by the ISP following the DHCP does not support the resolution of Quad9. You can manually add the DNS address for your upstream interface, as shown in the picture below. ![image](https://forum-static.gl-inet.com/original/3X/b/f/bf8540765909f72d2fa3603f48334654670adf5a.png) This may help you solve this issue. ---
**Author:** ![misuzu](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/misuzu/32/14021_2.png) [@misuzu](https://forum.gl-inet.com/u/misuzu)\ **Post date:** [February 12, 2025, 2:01am UTC](https://forum.gl-inet.com/t/mt6000-dns-leak-with-agh-and-wg-vpn/54339/7 "2025-02-12T02:01:57Z")
I can confirm that this fixed the issue. Thanks! ---
**Author:** ![bruce](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/bruce/32/35649_2.png) [@bruce](https://forum.gl-inet.com/u/bruce)\ **Post date:** [October 29, 2025, 11:42am UTC](https://forum.gl-inet.com/t/mt6000-dns-leak-with-agh-and-wg-vpn/54339/8 "2025-10-29T11:42:50Z")