MV-1000 Brume override DNS for Tailscale exit node client

Technical Support for Routers VPN, DNS, Leaks
1

I have a Brume 1 with the v4.3.8 beta installed, and the Tailscale updates and features I use seem to work fine except for when using it as a client to another exit node -- which I know works for newer and non-GLinet devices -- where if I try to activate it the Brume loses all connection to the internet. I'd like to use this old Brume as I already have it, and it provides a second LAN port that I want to use as a direct connection to a VoIP phone.

I'm quite sure this is a DNS issue since there's one difference I noticed in newer GLi firmware that allows for a DNS override of VPNs, which I have had to set in order for a couple devices (GLi and not) to connect to Tailscale without losing access to the rest of the internet.

Is there a way to set the VPN DNS override in older firmwares, say in LuCI? I tried to manually set DNS forwardings but this has no effect.

2

Hi,

When you enable and select the exit node on the Brume, and approved the subnet on the Tailscale dashboard:

ping <domain name> is abnormal, but ping <IP> is normal, right?

4

No I'm unable to ping anything when trying to connect to the Exit Node. I'm still thinking it's something about the routing or DNS (specifically it's always trying to use the Tailscale DNS), because its firewall rules are configured that same way as the newer GLi devices which work but which have the Custom DNS Override VPN switch in the main GUI.

5

SSH to the router, execute to check:
ifconfig
tailscale status
ip r

Looks like it does not create the routing rule to the tailscale interface.
If there is no routing about the tailscale interface, please add these in the Luci > Network > Firewall > Custom Rule:

iptables -A FORWARD -i br-lan -o tailscale0 -j ACCEPT
iptables -A FORWARD -i tailscale0 -o br-lan -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
iptables -t nat -A POSTROUTING -o tailscale0 -j MASQUERADE
6

There's no "Custom Rule" tab on there, instead it's a different "IP Sets" one

Inputting the provided commands directly into the SSH shell does not seem to change anything either

7

Can IP and domain name ping succeed or not?

SSH to the router, execute and check if approve the subnet on the tailscale center:

ifconfig
tailscale status
ip r

Is this exit node available on the tailscale APP to test on the phone/laptop/pad?