StrongVPN WireGuard + AdGuardHome (on Azure)

wcs2228 · 2022-05-02T23:44:14.205Z

What is the DNS IP address specified in the StrongVPN Wireguard config file? Is it the Azure AdGuardHome Public IP?

I do not work for and I do not have formal association with GL.iNet

abedoz · 2022-05-03T02:06:50.778Z

Thanks!

I tried that but it doesn’t seem to do the job.

What else I can tweak?

wcs2228 · 2022-05-03T02:15:54.426Z

When connected to strongVPN, run “nslookup google.com” in Windows, which should show the IP address of the DNS server that is actually used.

I do not work for and I do not have formal association with GL.iNet

abedoz · 2022-05-03T02:37:50.983Z

nslookup returns a DNS IP that is associated with Microsoft but not the Public IP of ADGH on Azure!

What that would mean?

abedoz · 2022-05-03T03:05:16.238Z

Apologies.

After refreshing the my machine’s NIC, the NSLOOKUP now points to the router private IP.

abedoz · 2022-05-03T15:51:39.585Z

Despite having the router’s private IP as my DNS, there are no DNS queries reach the Azure-hosted ADGH.

Can someone advise?

wcs2228 · 2022-05-03T16:37:23.069Z

It seems nslookup in Windows only shows the local DNS on the router, not the DNS through StrongVPN.

Can you open a browser and run a test on dnsleaktest.com or dnsleak.com to show the DNS(s) through the tunnel?

I do not work for and I do not have formal association with GL.iNet

abedoz · 2022-05-03T17:05:48.493Z

Although I put the Public IP of the Azure machine as the DNS of the WireGuard config, the dnsleaktest returns the WireGuard’s endpoint public IP and still no records on ADGH.

wcs2228 · 2022-05-03T18:06:54.888Z

As a test, can you try setting the DNS manually in Windows network settings to the Azure AdGuardHome Public IP address?

You have already set the Azure AdGuardHome DNS in the WireGuard config and the router custom DNS … not sure what is left .

I do not work for and I do not have formal association with GL.iNet

abedoz · 2022-05-03T21:26:25.010Z

DNS1308×1012 58.3 KB

Here are screenshots of all the things I currently have, including manually adding the DNS to the OS.

Still No Luck

abedoz · 2022-05-03T21:27:02.795Z

DNSLEAK848×236 23.1 KB

abedoz · 2022-05-03T21:28:04.767Z

WG1252×1786 111 KB

abedoz · 2022-05-03T21:28:40.478Z

CustomDNS1222×1088 106 KB

alzhao · 2022-05-04T03:41:49.758Z

Is the 20.x.x.x IP your AdguardHome IP?

The router’s private IP as DNS is correct. Because the router will make DNS query to the Adguard Home instead.

Can you post full screenshot of DNS testing of dnsleaktest.com?

Another reason could be that, the DNS is not encrypted and it is override by Strongvpn.

abedoz · 2022-05-04T05:05:18.917Z

Yes. 20.x.x.x is the Azure ADGH Public IP. Screenshot is attached as well.

Encryption is enabled on ADGH. Is there anything I should configure on the router as well?

TBH, I am doing all this effort for one reason, from day 1 I have received my FLINT, I couldn’t enable ADGH locally as it crashes the router entirely every few minutes.

Screenshot_20220504-080027_DuckDuckGo971×1202 105 KB

alzhao · 2022-05-04T07:31:08.367Z

abedoz:

Encryption is enabled on ADGH

On the router, you need to use DNS via TLS or DNScript to use encrypted DNS. The DNS from vpn config or custom DNS is not encrypted.

For adguardhome on Flint, pls try firmware 3.214 and it should working good.

abedoz · 2022-05-04T10:03:46.918Z

I have just noticed that OPENVPN works perfectly as expected and everything goes through Azure-ADGH.
But I want to use WireGuard instead due to the better connectivity speed compared to OPVN.

Would that give any clue?

alzhao:

On the router, you need to use DNS via TLS or DNScript to use encrypted DNS. The DNS from vpn config or custom DNS is not encrypted.

Once I enabled custom DNS, both [DNS over TLS (Cloudflare or NextDNS) / Dnscrypt-Proxy Settings] greyed out.

alzhao:

For adguardhome on Flint, pls try firmware 3.214 and it should working good.

I have already tested 3.214 and couldn’t notice a much better enhancement in the performance once ADG is enabled locally.

alzhao · 2022-05-04T10:05:04.290Z

abedoz:

Once I enabled custom DNS, both [DNS over TLS (Cloudflare or NextDNS) / Dnscrypt-Proxy Settings] greyed out.

This is the desired behavior.

I don’t know if there is any different between openvpn and wireguard in this case.

abedoz · 2022-05-04T10:13:50.032Z

Thanks, for your support.

What is the process of getting a refund?

wcs2228 · 2022-05-04T15:16:40.493Z

I did some tests running WireGuard on my GL-MV1000W Brume with DNS set manually on the client device and dnsleaktest.com shows that manual DNS is being used, overriding other DNS settings on the router.

I do not have a public AdGuardHome site, so I tested with public DNS servers from Quad9, OpenDNS, CleanBrowsing, Alternate DNS and AdGuard DNS, none of which I already use, nor used by the VPN provider (NordVPN).

With WireGuard running on the Brume, the DNS requests goes through the VPN tunnel, resulting in DNS servers near the endpoint location. With WireGuard not running, the DNS servers are near my own location.

EDIT:
Note that AdGuardHome is a DNS forwarder, not a true DNS server. Hence, dnsleaktest.com may not show the AdGuardHome IP address, but shows the upstream DNS servers that you have configured in AdGuardHome (e.g., Cloudflare, Quad9).

I do not work for and I do not have formal association with GL.iNet