# Separate subnet for DNS (pros and cons discussion) **URL:** \ **Category:** VPN, DNS, Leaks\ **Created:** [May 10, 2024, 9:42pm UTC](https://forum.gl-inet.com/t/separate-subnet-for-dns-pros-and-cons-discussion/42125 "2024-05-10T21:42:41Z")\ **Posts on this page:** 18\ **Page:** 1
**Author:** ![maksikos](https://forum-assets.gl-inet.com/letter_avatar_proxy/v4/letter/m/ecc23a/32.png) [@maksikos](https://forum.gl-inet.com/u/maksikos)\ **Post date:** [May 10, 2024, 9:42pm UTC](https://forum.gl-inet.com/t/separate-subnet-for-dns-pros-and-cons-discussion/42125/1 "2024-05-10T21:42:42Z")
In general official OpenWRT guide ([link](https://openwrt.org/docs/guide-user/firewall/fw3_configurations/intercept_dns)) have following recommendations: **Block DoT** ```auto uci -q delete firewall.dot_fwd uci set firewall.dot_fwd="rule" uci set firewall.dot_fwd.name="Deny-DoT" uci set firewall.dot_fwd.src="lan" uci set firewall.dot_fwd.dest="wan" uci set firewall.dot_fwd.dest_port="853" uci set firewall.dot_fwd.proto="tcp udp" uci set firewall.dot_fwd.target="REJECT" uci commit firewall service firewall restart ``` **Redirect DNS** ```auto # Configure firewall uci set firewall.dns_int.name="Redirect-DNS" uci set firewall.dns_int.dest_ip="192.168.2.2" uci commit firewall service firewall restart # Configure network uci add_list network.lan.ipaddr="192.168.2.1/24" uci commit network service network restart ``` So the main discussion is: - If created separate subnet for DNS will it increase stability and security? - If DoT blocked on router, can I ensure that all DNS traffic resolved on router and router pass all traffic via Wireguard (to hide DND requests from ISP) - WebRTC under question. Should (and can it?) be blocked on router to prevent IP leak? Generally I need clients to force use my DNS which will be resolved through VPN to avoid any information leak to ISP. ---
**Author:** ![SpitzAX3000](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/spitzax3000/32/11018_2.png) [@SpitzAX3000](https://forum.gl-inet.com/u/SpitzAX3000)\ **Post date:** [May 11, 2024, 2:13am UTC](https://forum.gl-inet.com/t/separate-subnet-for-dns-pros-and-cons-discussion/42125/2 "2024-05-11T02:13:31Z")
What about this options? It prevents leaks as per GL developers: ![2024-05-11_05-11](https://forum-static.gl-inet.com/original/3X/6/1/6170deeaf35e19b934de959a2d23e95275fe5f95.png) ---
**Author:** ![admon](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/admon/32/32880_2.png) [@admon](https://forum.gl-inet.com/u/admon)\ **Post date:** [May 11, 2024, 7:38am UTC](https://forum.gl-inet.com/t/separate-subnet-for-dns-pros-and-cons-discussion/42125/3 "2024-05-11T07:38:02Z")
I think many people get confused between VPN using a client app on the PC and using VPN by router. For example, WebRTC: Your PC can’t leak data by its real IP because it does not know about it. From the view of the PC, nothing changed while using the router as VPN - but there is no way to produce a leak. Leaking could be possible using a VPN app, but not by routing everything using a router. I don’t see any reason why creating an additional subnet for DNS should be 1. a necessary and 2. a good thing. The manual you found isn’t for GL devices and does not make sense in any way. Just ignore it. Blocking DoT does not make any sense either. Yes, it might leak your used DNS server - but it won’t leak your location. And there are plenty of ways to make DNS requests to the internet without using DoT. (By using DoH for example, which you simply can’t block) ---
**Author:** ![maksikos](https://forum-assets.gl-inet.com/letter_avatar_proxy/v4/letter/m/ecc23a/32.png) [@maksikos](https://forum.gl-inet.com/u/maksikos)\ **Post date:** [May 11, 2024, 7:53am UTC](https://forum.gl-inet.com/t/separate-subnet-for-dns-pros-and-cons-discussion/42125/4 "2024-05-11T07:53:06Z")
> [@admon](#): > > DoH for example, which you simply can’t block Is there any way to install DPI on router to block it too? ---
**Author:** ![admon](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/admon/32/32880_2.png) [@admon](https://forum.gl-inet.com/u/admon)\ **Post date:** [May 11, 2024, 8:02am UTC](https://forum.gl-inet.com/t/separate-subnet-for-dns-pros-and-cons-discussion/42125/5 "2024-05-11T08:02:10Z")
No. It’s not powerful enough, nor does OpenWrt provide this feature out of the box. There are solutions like [Installing Netify on OpenWrt](https://www.netify.ai/products/netify-informatics/get-netify/openwrt) but for me this does not sound like a real way of getting a “real” firewall. ---
**Author:** ![maksikos](https://forum-assets.gl-inet.com/letter_avatar_proxy/v4/letter/m/ecc23a/32.png) [@maksikos](https://forum.gl-inet.com/u/maksikos)\ **Post date:** [May 11, 2024, 12:08pm UTC](https://forum.gl-inet.com/t/separate-subnet-for-dns-pros-and-cons-discussion/42125/6 "2024-05-11T12:08:34Z")
Ok, but what if I will use BanIP or something similar to block access to DOH servers? Like [this](https://raw.githubusercontent.com/wranders/doh-list/master/doh-list.txt) or [this](https://raw.githubusercontent.com/MohamedElashri/doh-list/main/doh-list.txt) lists? Will this help me? ---
**Author:** ![admon](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/admon/32/32880_2.png) [@admon](https://forum.gl-inet.com/u/admon)\ **Post date:** [May 11, 2024, 12:12pm UTC](https://forum.gl-inet.com/t/separate-subnet-for-dns-pros-and-cons-discussion/42125/7 "2024-05-11T12:12:29Z")
It might help against the big ones, but tbh, banning DoH isn’t something you should do. ---
**Author:** ![maksikos](https://forum-assets.gl-inet.com/letter_avatar_proxy/v4/letter/m/ecc23a/32.png) [@maksikos](https://forum.gl-inet.com/u/maksikos)\ **Post date:** [May 11, 2024, 12:56pm UTC](https://forum.gl-inet.com/t/separate-subnet-for-dns-pros-and-cons-discussion/42125/8 "2024-05-11T12:56:47Z")
> [@admon](#): > > banning DoH isn’t something you should do I mean I want to run Adguard **FAMILY** DOH on router and force all devices to resolve domains via router (not by themselves) ---
**Author:** ![admon](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/admon/32/32880_2.png) [@admon](https://forum.gl-inet.com/u/admon)\ **Post date:** [May 11, 2024, 12:59pm UTC](https://forum.gl-inet.com/t/separate-subnet-for-dns-pros-and-cons-discussion/42125/9 "2024-05-11T12:59:03Z")
You can try to ban as much as possible - but as I said before, devices can freely decide if they will use your router as a DNS resolver or if they don’t. Just enable DNS rewriting (“[Override DNS Settings for All Clients](https://docs.gl-inet.com/router/en/4/interface_guide/dns/)”), which will take care of most things - and ignore all others since it’s lost time. ---
**Author:** ![maksikos](https://forum-assets.gl-inet.com/letter_avatar_proxy/v4/letter/m/ecc23a/32.png) [@maksikos](https://forum.gl-inet.com/u/maksikos)\ **Post date:** [May 11, 2024, 1:00pm UTC](https://forum.gl-inet.com/t/separate-subnet-for-dns-pros-and-cons-discussion/42125/10 "2024-05-11T13:00:48Z")
> [@admon](#): > > Just enable DNS rewriting (“[Override DNS Settings for All Clients](https://docs.gl-inet.com/router/en/4/interface_guide/dns/)”), which will take care of most things As I tested, only if request is unencrypted. What I want to block every DNS (not only DOH) except Adguard family. Will this work? Or I can have troubles? ---
**Author:** ![admon](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/admon/32/32880_2.png) [@admon](https://forum.gl-inet.com/u/admon)\ **Post date:** [May 11, 2024, 1:01pm UTC](https://forum.gl-inet.com/t/separate-subnet-for-dns-pros-and-cons-discussion/42125/11 "2024-05-11T13:01:39Z")
As written above, you simply can’t. Since DoH will use HTTPs you can’t block it. You can try to block as much as possible but there is always a way around it. As soon as an device uses DoH it will be able to get around your AdGuard DNS. ---
**Author:** ![maksikos](https://forum-assets.gl-inet.com/letter_avatar_proxy/v4/letter/m/ecc23a/32.png) [@maksikos](https://forum.gl-inet.com/u/maksikos)\ **Post date:** [May 11, 2024, 6:39pm UTC](https://forum.gl-inet.com/t/separate-subnet-for-dns-pros-and-cons-discussion/42125/12 "2024-05-11T18:39:56Z")
> [@admon](#): > > As soon as an device uses DoH it will be able to get around your AdGuard DNS But if it will be banned by BanIP? It will fall back to my DNS? Am I right? ---
**Author:** ![admon](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/admon/32/32880_2.png) [@admon](https://forum.gl-inet.com/u/admon)\ **Post date:** [May 11, 2024, 6:41pm UTC](https://forum.gl-inet.com/t/separate-subnet-for-dns-pros-and-cons-discussion/42125/13 "2024-05-11T18:41:59Z")
Mostly it will just fail and the device will not have internet. And there are way more servers than BanIP could ban. It‘s such a cat and mouse game. ---
**Author:** ![maksikos](https://forum-assets.gl-inet.com/letter_avatar_proxy/v4/letter/m/ecc23a/32.png) [@maksikos](https://forum.gl-inet.com/u/maksikos)\ **Post date:** [May 11, 2024, 6:50pm UTC](https://forum.gl-inet.com/t/separate-subnet-for-dns-pros-and-cons-discussion/42125/14 "2024-05-11T18:50:24Z")
Thank you for constructive feedback. So the best way just enable “override dns”? In this case will DNS pass through my VPN on router? ---
**Author:** ![SpitzAX3000](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/spitzax3000/32/11018_2.png) [@SpitzAX3000](https://forum.gl-inet.com/u/SpitzAX3000)\ **Post date:** [May 11, 2024, 7:01pm UTC](https://forum.gl-inet.com/t/separate-subnet-for-dns-pros-and-cons-discussion/42125/15 "2024-05-11T19:01:58Z")
> [@maksikos](#): > > In this case will DNS pass through my VPN on router? I don’t think so as this is a new feature in firmware version 4.6.x. But someone might test it and confirm. ---
**Author:** ![admon](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/admon/32/32880_2.png) [@admon](https://forum.gl-inet.com/u/admon)\ **Post date:** [May 11, 2024, 7:02pm UTC](https://forum.gl-inet.com/t/separate-subnet-for-dns-pros-and-cons-discussion/42125/16 "2024-05-11T19:02:41Z")
Plain DNS will be rewritten by the router, DoH and DoT will just flow through your VPN, if you use global routing. ---
**Author:** ![maholio](https://forum-assets.gl-inet.com/letter_avatar_proxy/v4/letter/m/9f8e36/32.png) [@maholio](https://forum.gl-inet.com/u/maholio)\ **Post date:** [May 17, 2024, 5:43pm UTC](https://forum.gl-inet.com/t/separate-subnet-for-dns-pros-and-cons-discussion/42125/17 "2024-05-17T17:43:45Z")
> [@admon](#): > > As written above, you simply can’t. > > Since DoH will use HTTPs you can’t block it. Purely theoretical you can use [this](https://github.com/hagezi/dns-blocklists/blob/main/dnsmasq/doh.txt) or [this](https://github.com/hagezi/dns-blocklists/blob/main/ips/doh.txt) list ## BUT! - I don’t think it will block ALL DOH. - Blocking DOH can cause connection issues. - It is reducing security. ---
**Author:** ![bruce](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/bruce/32/35649_2.png) [@bruce](https://forum.gl-inet.com/u/bruce)\ **Post date:** [October 29, 2025, 11:38am UTC](https://forum.gl-inet.com/t/separate-subnet-for-dns-pros-and-cons-discussion/42125/18 "2025-10-29T11:38:58Z")