Split tunneled apps ignoring adguard

Router VPN, DNS, Leaks
1

Hello all, got a flint 2, my first non ISP provided router and most things have been easy enough to figure out on my own, but i’m having an issue with split tunneled apps ignoring adguard and resolving to cloudflare and google dns, i’ve been using firefox within vpn and waterfox outside vpn for consistent testing. I’ve had the router a grand total of 20 hours, so apologies if I forget to include anything pertinent. **

Setup:**

  • Client: Debian with KDE plasma

  • Router: GL.iNet Flint 2 (OpenWrt), AdGuard Home enabled

  • AdGuard upstreams: Mullvad DoH + Quad9 DoH

  • Router DNS settings:

    • :check_box_with_check: Override DNS settings for ALL clients

    • :check_box_with_check: Allow custom DNS to override VPN DNS

  • VPN: Proton VPN GUI (Linux), split tunneling enabled

    • Firefox (in tunnel) → correctly shows Quad9/Mullvad

    • Waterfox (excluded from tunnel) → shows Cloudflare/Google DNS on leak tests

  • Waterfox Settings:

    • DNS over HTTPS - Off
    • Network settings - Proxy - Off
    • network.trr.mode = 5
    • network.trr.custom_uri = ““
    • network.trr.default_provider_uri = ““
    • network.dns.native_https_query = false
    • network.dns.echconfig.enabled = false
    • captivedetect.canonicalURL = ""

  • Test results:

    • tcpdump -u any -n port 53 showed queries from 192.168.8.101
    • router logs show adguard home running on 3053
    • Intermittent “unexpected EOF” errors from quad9 DoH upstream, but resolution works on all apps going through the VPN

  • Things i’ve tried

    • changed trr and doh settings in waterfox, pointing towards my router, mullvad dns directly and leaving values emtpy
    • checked tcpdump to see packets reaching router
    • started waterfox in safe mode to ensure no extensions are interfering

If there’s anything obvious going over my head or any suggestions i’m all ears, thank you

2

Hello,

Does your router have the list domain-based VPN policy?

4

Hello,
Since making that post I have been trying to run the vpn on flint2, rather than the desktop client.

When using the desktop client the only exceptions were set in the protonvpn gui>split tunneling list
Currently using router level vpn and having a more fundamental issue where packets reach my router but somewhere in the adguard + vpn chain they get dropped before reaching my desktop
The router vpn dashboard shows “

From: Debian desktop MAC
To: All targets
Via: ProtonVPN /

Also since creating this thread, I have submitted a support ticket and set up goodcloud, provided support with my router MAC and temp admin credentials to facilitate people more knowledgeable than myself having eyes on what im stumbling over.