DNS and VPN

[Preskitt.man]

Depending on where I am running my VPN client (or not), I am getting results I don't understand.
My basic configuraiton:
Asus 86U with Merlin 384.15
ISP IP: 207.171.232.98
PIA Server: 192.116.118.168 (for OpenVPN) or 192.116.118.x for PIA client on PC. The VPN server is in Bay Area of CA.
Asus DNS settings:
Connect to DNS Auto : Yes
Forward Local Domain: No
Enable DNS Rebind: No
Enable DNSSEC: No
Prevent Auto DOH : Autu
DNS over TLS : Opportunistic
DNS Servers: 1.1.1.1 & 1.0.0.1 (Cloudfare)

DNS Filter: On
Filter Mode: Router
DNS1: 1.1.1.1
DNS2: 1.0.0.1
Client List: (empty)

The IPV4 connection on my properties page is the default: Obtain DNS Server address automatically.

Now with all that out of the way, I went to ipleak.com with 3 different configurations:
1: Open VPN Client on Router: On & PIA client on server: Off
DNS addresses returned:
DNS1: 172.68.135.211 (San Jose, CA)
DNS2: 209.222.18.218 (in Brooklyn, NY)
Neither of these address make sense to me
2: Open VPN Client on Router: Off & PIA Client on server : Off
DNS address returned:
DNS1: 162.158.141.83 (in Phoenix, AZ)
DNS2: None
Note that DNS is same as DNS1 in Case 1
3: Open VPN Client On Router: Off & PIA client on server: On
DNS address returned:
DNS1: 199.116.118.172 (Address of PIA server in CA)
DNS2: None
This one actually makes sense: My PIA client specifies the use of PIA DNS and this IP is the address of the PIA server.

I am guessing that 162.158.141.83 is the DNS server that my ISP points to as I am in AZ as is the 162... address.

I am also guessing that the DNS addresses returned when using the OpenVPN client on ASUS are picked by the PIA/OpenVPN server in San Jose

Which leaves open two questions,
1: Why, when PIA is totally disabled am I not using Cloudfare (with DOT)
2) When using OpenVPN client on ASUS, how do I specify Cloudfare (DOT or otherwise)
I have tried specifying: push "dhcp-option DNS 1.1.1.1" and simly dhcp-option DNS 1.1.1.1 and neither seemed to have any effect.

 

[CaptainSTX]

On your ASUS router have you just gone to PIA's WEB site and used their configuration generator, created a configuration for your desired server, downloaded the resulting OVPN file, clicked the upload button in the client section, then add your user name and password and hit start?

I have found these configurations work fine, no tweaks needed or custom settings. Try this on your router and see if you get the results you want or expect.

 

[dave14305]

If I use a leak test after configuring Cloudflare for DoT, I also get a 172.68.x.x address returned, because 1.1.1.1 is an AnyCast IP and the actual IP of the DNS server receiving the requests at Cloudflare will not report themselves upstream as 1.1.1.1.

https://www.dnsleaktest.com will report the IP as belonging to Cloudflare though, so you can have reassurances that way.

 

[Preskitt.man]

@CaptainSTX : Basically I did exactly what you described - but did add these four custom config options as specified in a PIA document:
persist-key
persist-tun
pull-filter ignore "auth token"
ncp-disable

@dave14305 Thanks for that info - so it does look like when I use OpenVPN client on the router, I am using Cloudfare with DOT. Should have also gone to 1.1.1.1/help, and it confirmed I am on Cloudfare with DOT.