Sharing a solution for DNS leak with AdGuard Home handling client requests + connecting to VPN client

[Integritas]

For anyone interested:

I've now tested the DNS policy rewrites/reconfiguration in the 4.8.1 and 4.8.2 firmware. As @root1 alluded to, it seems you'll no longer see any port forwarding rules with 4.8.x onward.

The good/great news: Everything works wonderfully.

If you enable AdGuard Home and have it handle client requests directly but do not allow custom DNS to override VPN DNS, you will not have any leaks anymore (this was the impetus behind my original post)! Non-VPN client traffic will route through AdGuard Home, and VPN client traffic will route through the VPN client tunnel and its DNS resolution (VPN client traffic will not benefit from AdGuard Home's functionality, but this may be a more “set it and forget it" option for some that may be favorable).

In addition, if you want to have all the benefits of AdGuard Home while also being connected to a VPN, that works as well! In that case, make sure you have AdGuard enabled and set to handle client requests directly, and then you should also allow custom DNS to override VPN DNS. There are additional directions below to ensure you don't leak if you want this setup (teaser: it is the same solution I previously offered @lirotia).

But first, just a couple of screenshots to help orient folks.

AdGuard Home options can be found at Applications > AdGuard Home:

(Note this screenshot shows enabling AdGuard Home and enabling it to handle client requests directly.)

DNS options can be found at Network > DNS:

(Note this screenshot shows allowing custom DNS to override VPN DNS.)

Now, if you've followed the above instructions in preparation of having all the benefits of AdGuard Home while being connected to a VPN, simply follow the detailed instructions I originally gave in a previous reply to @lirotia and then quoted in my reply to @teleney above this post. I've quoted it here again for ease of reference for folks wanting a “one-stop shop". After ensuring the above toggles are correct, you'll start at step 3 of the instructions I've quoted below.

@Integritas

Wonderful, thank you! It may also be of interest to you and others working on this to review part my most recent response to @lirotia where I delineate a method to (1) maintain AdGuard Home filtering (2) while using a VPN client and (3) while being able to tap into that additional functionality of AdGuard Home I mention above where AdGuard Home handles client requests directly

If you want to: (1) maintain AdGuard Home filtering (2) while using a VPN client and (3) while being able to tap into that additional functionality of AdGuard Home I mention above where AdGuard Home handles client requests directly, you would tweak my solution a bit:

1. Leave the port forwarding rules (in Network > Firewall > Port Forwards) alone / leave them as set by GL.iNet in their default setup. No changes in LuCi!
2. Toggle on AdGuard Home to handle client requests directly and allow custom DNS to override VPN DNS.
3. Use the upstream server specification within AdGuard Home to specify the DNS of your VPN provider. Note you can do this in more than one way, depending on what you're trying to accomplish. For global, always-on VPN, go to 4. For client-specific VPN (whether one client, a few, or anything coming from within a specified CIDR or multiple CIDRs), go to 5.
4. Global, always-on VPN: If you're planning to route all traffic through your VPN provider and leave it on all the time, then:

• Enter your VPN's DNS in Settings > DNS Settings > Upstream DNS Servers
• Leave Settings > DNS Settings > Fallback DNS servers blank

5. Client-specific VPN (whether one client, a few, or anything coming from within a specified CIDR or multiple CIDRs): If you're planning on routing traffic from 1 or more clients through your VPN, then:

• Configure whatever you want to configure for upstream DNS servers globally in Settings > DNS Settings > Upstream DNS Servers (e.g., Google, Quad9, Cloudflare, etc.). These will be active when not connected to your VPN.
• Configure a "Persistent client" record via Settings > Client Settings and clicking the Add Client button.
  • Enter a name for the client or client group in the box prompting for such.
  • Enter an appropriate identifier (e.g., the relevant IP address(es) of the client(s), or the CIDR(s) if defining a range or ranges).
  • Click the Save button (which will save the settings and close the window).
  • (The above is really just to facilitate the next step while still using the globally-defined rules when not connected to the VPN. If you'd rather wait to do this until the time of connecting to the VPN, you don't strictly have to do this ahead of time.)
• When you want to connect that client/those clients to the VPN, edit that "Persistent client" record created in the previous step (or create a new one following the directions in the previous step if you didn't create one ahead of time).
  • Now, instead of using the globally-defined upstream DNS servers, you'll edit the upstream DNS server to point to the VPN's DNS.
  • Note you may need to tweak the IP address specification if the IP address(es) for the client(s) in question changed for some reason between originally creation of the "Persistent client" record and when you edit it to connect to the VPN.
• When you're done with the VPN connection, delete the VPN DNS specified as the upstream DNS server in the "Persistent client" record. This will result in the client(s) specified by that record starting to use the globally-defined DNS servers again.

I hope this helps!

Thanks so much to the GL.iNet staff for the great work on 4.8.1 and 4.8.2! Not only is the functionality better from my testing, but the UI improvements are top-notch.