[rkwood]

I'm running DD-WRT r39884 on a Linksys WRT32X with a VPN (Private Internet Access) using Policy Based Routing. My PBR configuration has IP addresses 192.168.1.100 through 192.168.1.150 routing through the VPN and all others going straight out through the ISP.

Here's my problem - it appears that Unbound is going straight through to the ISP for DNS queries because DNSLeakTest.com is reporting that Comcast is providing DNS service. I wish to avoid that.

With the default Unbound configuration (via checking the GUI box on the setup page), what are the simplest ways to 1) put Unbound behind the VPN and 2) force Unbound to use DNS servers of my choosing?

Any help would be greatly appreciated. Thank you.

Randy

[rkwood]

While waiting for some expert advice, I entered:

no-resolv
interface=tun1
server=1.1.1.1 #CloudFlare DNS Server

into Dnsmasq Options and made sure that "Use DNSMasq For DNS" and "Query DNS in Strict Order" were both checked. (I tried this with and without the 'interface=tun1' command and rebooted after the 'save'.)

This did not help. My router is based on the Marvell chip set, so a Kong build really is not an option if I want the latest security updates and the current (fully functional) driver.

Any thoughts? I just want the DNS queries to go anywhere but to my ISP (Comcast). Is there any way to create a Policy for Unbound to use the VPN? Or am I smoking crack?

[rkwood]

Thanks for the link to the thread and script.

Disabling Unbound and leaving everything else as described sends all DNS traffic to CloudFlare (likely via my ISP), however Secure DNS & Encrypted SNI are only present in a properly configured browser - so this is still not good because anyone "listening on the wire" can otherwise see the DNS queries & website connections.

[Alozaros]

well DNS leak is nothing new, there are few things to help....

use forced DNS settings option from a basic setup
use DNS strict order

domain-needed
no-poll
bogus-priv
no-resolv
interface=tun1
server=1.1.1.1


or you can try DNScrypt or Stubby with DNS over TLS
where stubby uses recursive DNS servers too, here is a bit of a talk about Stubby.. Stubby for DNS over TLS
i made it work via Entware on my lower grade router otherwise i use DNScrypt on my other devices if possible

there is also a VPN killswitch but this is not the case here...

if your DNScrypt option is missing from GUI and you still have the module for it, you can force it to run via start up script...

[egc]

The problem with PBR is that the router itself is not using the VPN tunnel and thus the DNS query is out in the open.

There is however a solution for this problem, see the following thread: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318662

Especially the second posting deals with DNS leak and PBR