StrongVPN WireGuard + AdGuardHome (on Azure)

wcs2228 · 2022-05-03T02:15:54.426Z

When connected to strongVPN, run “nslookup google.com” in Windows, which should show the IP address of the DNS server that is actually used.

I do not work for and I do not have formal association with GL.iNet

abedoz · 2022-05-03T02:37:50.983Z

nslookup returns a DNS IP that is associated with Microsoft but not the Public IP of ADGH on Azure!

What that would mean?

abedoz · 2022-05-03T03:05:16.238Z

Apologies.

After refreshing the my machine’s NIC, the NSLOOKUP now points to the router private IP.

abedoz · 2022-05-03T15:51:39.585Z

Despite having the router’s private IP as my DNS, there are no DNS queries reach the Azure-hosted ADGH.

Can someone advise?

wcs2228 · 2022-05-03T16:37:23.069Z

It seems nslookup in Windows only shows the local DNS on the router, not the DNS through StrongVPN.

Can you open a browser and run a test on dnsleaktest.com or dnsleak.com to show the DNS(s) through the tunnel?

I do not work for and I do not have formal association with GL.iNet

abedoz · 2022-05-03T17:05:48.493Z

Although I put the Public IP of the Azure machine as the DNS of the WireGuard config, the dnsleaktest returns the WireGuard’s endpoint public IP and still no records on ADGH.

wcs2228 · 2022-05-03T18:06:54.888Z

As a test, can you try setting the DNS manually in Windows network settings to the Azure AdGuardHome Public IP address?

You have already set the Azure AdGuardHome DNS in the WireGuard config and the router custom DNS … not sure what is left .

I do not work for and I do not have formal association with GL.iNet

abedoz · 2022-05-03T21:26:25.010Z

DNS1308×1012 58.3 KB

Here are screenshots of all the things I currently have, including manually adding the DNS to the OS.

Still No Luck

abedoz · 2022-05-03T21:27:02.795Z

DNSLEAK848×236 23.1 KB

abedoz · 2022-05-03T21:28:04.767Z

WG1252×1786 111 KB

abedoz · 2022-05-03T21:28:40.478Z

CustomDNS1222×1088 106 KB

alzhao · 2022-05-04T03:41:49.758Z

Is the 20.x.x.x IP your AdguardHome IP?

The router’s private IP as DNS is correct. Because the router will make DNS query to the Adguard Home instead.

Can you post full screenshot of DNS testing of dnsleaktest.com?

Another reason could be that, the DNS is not encrypted and it is override by Strongvpn.

abedoz · 2022-05-04T05:05:18.917Z

Yes. 20.x.x.x is the Azure ADGH Public IP. Screenshot is attached as well.

Encryption is enabled on ADGH. Is there anything I should configure on the router as well?

TBH, I am doing all this effort for one reason, from day 1 I have received my FLINT, I couldn’t enable ADGH locally as it crashes the router entirely every few minutes.

Screenshot_20220504-080027_DuckDuckGo971×1202 105 KB

alzhao · 2022-05-04T07:31:08.367Z

abedoz:

Encryption is enabled on ADGH

On the router, you need to use DNS via TLS or DNScript to use encrypted DNS. The DNS from vpn config or custom DNS is not encrypted.

For adguardhome on Flint, pls try firmware 3.214 and it should working good.

abedoz · 2022-05-04T10:03:46.918Z

I have just noticed that OPENVPN works perfectly as expected and everything goes through Azure-ADGH.
But I want to use WireGuard instead due to the better connectivity speed compared to OPVN.

Would that give any clue?

alzhao:

On the router, you need to use DNS via TLS or DNScript to use encrypted DNS. The DNS from vpn config or custom DNS is not encrypted.

Once I enabled custom DNS, both [DNS over TLS (Cloudflare or NextDNS) / Dnscrypt-Proxy Settings] greyed out.

alzhao:

For adguardhome on Flint, pls try firmware 3.214 and it should working good.

I have already tested 3.214 and couldn’t notice a much better enhancement in the performance once ADG is enabled locally.

alzhao · 2022-05-04T10:05:04.290Z

abedoz:

Once I enabled custom DNS, both [DNS over TLS (Cloudflare or NextDNS) / Dnscrypt-Proxy Settings] greyed out.

This is the desired behavior.

I don’t know if there is any different between openvpn and wireguard in this case.

abedoz · 2022-05-04T10:13:50.032Z

Thanks, for your support.

What is the process of getting a refund?

wcs2228 · 2022-05-04T15:16:40.493Z

I did some tests running WireGuard on my GL-MV1000W Brume with DNS set manually on the client device and dnsleaktest.com shows that manual DNS is being used, overriding other DNS settings on the router.

I do not have a public AdGuardHome site, so I tested with public DNS servers from Quad9, OpenDNS, CleanBrowsing, Alternate DNS and AdGuard DNS, none of which I already use, nor used by the VPN provider (NordVPN).

With WireGuard running on the Brume, the DNS requests goes through the VPN tunnel, resulting in DNS servers near the endpoint location. With WireGuard not running, the DNS servers are near my own location.

EDIT:
Note that AdGuardHome is a DNS forwarder, not a true DNS server. Hence, dnsleaktest.com may not show the AdGuardHome IP address, but shows the upstream DNS servers that you have configured in AdGuardHome (e.g., Cloudflare, Quad9).

I do not work for and I do not have formal association with GL.iNet

abedoz · 2022-05-05T05:43:09.653Z

wcs2228:

I did some tests running WireGuard on my GL-MV1000W Brume with DNS set manually on the client device and dnsleaktest.com shows that manual DNS is being used, overriding other DNS settings on the router.

I do not have a public AdGuardHome site, so I tested with public DNS servers from Quad9, OpenDNS, CleanBrowsing, Alternate DNS and AdGuard DNS, none of which I already use, nor used by the VPN provider (NordVPN).

With WireGuard running on the Brume, the DNS requests goes through the VPN tunnel, resulting in DNS servers near the endpoint location. With WireGuard not running, the DNS servers are near my own location.

EDIT:
Note that AdGuardHome is a DNS forwarder, not a true DNS server. Hence, dnsleaktest.com may not show the AdGuardHome IP address, but shows the upstream DNS servers that you have configured in AdGuardHome (e.g., Cloudflare, Quad9).

Thanks

My goal is to have the Wiregurad connection up and simultaneously get the DNS config points all LAN clients automatically to the Azure-hosted ADGH without the need to manually configure them individually.

Would that be possible? or am I just daydreaming ?

I bought Flint originally to achieve that on the same box but it seems the HW can’t accommodate both working simultaneously and crashes every other hour.

wcs2228 · 2022-05-05T14:01:14.721Z

You can configure the DHCP server on your Flint to give DNS to client devices to be your AdGuardHome site via LuCI → Network → Interfaces → LAN → Edit → DHCP Server → Advanced Settings → DHCP-Options. Enter the following and click Save, then click Save & Apply:

6,20.x.x.x

where 20.x.x.x is the IP address of your AdGuardHome site

I did this also in my tests. I think the Custom DNS Server setting in the GL.iNet UI works differently, on the router’s dnsmasq, and does not send the DNS to client devices.

EDIT:
On my own network, I have the main router set up to give DNS to client devices, which is AdGuardHome running on a separate NAS server on the same LAN. I do not use dnsmasq on the main router.

I do not work for and I do not have formal association with GL.iNet