DNS Leak With VPN Director Policy

[NB_8]

My OpenVPN clients connect properly with no DNS leaks when the "Yes (all)" option is selected for "Redirect Internet traffic through tunnel". I would opt to simply leave this as-is, however, preferring not to have any leaks, I would like to be able to use "VPN Director (policy rules)" in light of user findings on that option avoiding IP leaks.

VPN Kill Switch Doesn't Work Temporarily Immediately After Rebooting

I'm running Merlin 386.3_2 on an RT-AC68U. I'm using the OpenVPN client with it set to connect when booted. The kill switch is enabled, and all internet traffic is set to be redirected over the VPN. I've noticed that traffic is allowed to go over the WAN immediately after rebooting for a short...

www.snbforums.com

If anyone can please point me in the right direction as to how one might go about keeping killswitch functionality and avoiding DNS leak while using "VPN Director (policy rules)" it would be much appreciated.

 

[eibgrad]

The link you posted is NOT specifically related to DNS leaks. That bug allows *any* traffic to leak over the WAN on reboot until the OpenVPN client is connected. And that same link provides a temporary workaround until the problem can be corrected in the firmware.

 

[NB_8]

The link you posted is NOT specifically related to DNS leaks. That bug allows *any* traffic to leak over the WAN on reboot until the OpenVPN client is connected. And that same link provides a temporary workaround until the problem can be corrected in the firmware.

I have not yet ventured into the realm of SSH coding, so at this time I am seeking to address the traffic leak issue (which I initially referred to as "IP leaks") in another way.

Using "VPN Director (policy rules)" apparently avoids the traffic leak issue. However, since I'm getting a DNS leak when I use "VPN Director (policy rules)", I'm trying to figure out what can be changed so that "VPN Director (policy rules)"can be used without causing a DNS leak.

 

[eibgrad]

Then the link you pointed to doesn't seem relevant.

One of the side-effects of using the VPN Director is that it necessarily takes the router itself OFF the VPN. And therefore any services its offering (e.g., DNSMasq as the local DNS proxy) are now bound to the WAN, NOT the VPN. So you have to be very careful about how you configure DNS on the OpenVPN client. The "Accept DNS configuration" setting should either be Exclusive or Strict. I would at least start there. It's also possible to configure "Accept DNS configuration" as Disabled *if* you configure DoT on the WAN, since then all your DNS activity will be encrypted, and then it doesn't matter whether your DNS is performed over the WAN or VPN.

 

[NB_8]

Then the link you pointed to doesn't seem relevant.

One of the side-effects of using the VPN Director is that it necessarily takes the router itself OFF the VPN. And therefore any services its offering (e.g., DNSMasq as the local DNS proxy) are now bound to the WAN, NOT the VPN. So you have to be very careful about how you configure DNS on the OpenVPN client. The "Accept DNS configuration" setting should either be Exclusive or Strict. I would at least start there. It's also possible to configure "Accept DNS configuration" as Disabled *if* you configure DoT on the WAN, since then all your DNS activity will be encrypted, and then it doesn't matter whether your DNS is performed over the WAN or VPN.

After looking into this more, DoT will not be an option due to incompatible servers.

That stated, short of getting started with SSH scripting, can anyone recommend a workaround to avoid WAN traffic leaks prior to OpenVPN clients becoming connected? The issue is detailed in the link in the OP.

 

[eibgrad]

After looking into this more, DoT will not be an option due to incompatible servers.

That stated, short of getting started with SSH scripting, can anyone recommend a workaround to avoid WAN traffic leaks prior to OpenVPN clients becoming connected? The issue is detailed in the link in the OP.

Kill switch doesn't work

It seems to me kill switch stopped working for me. I had 386.1.x FW and noticed after router reboot that my OpenVPN client is down and despite I had setting to prevent client access to Internet when VPN is down, client still had access to Internet. I could not make kill switch work so updated to...

www.snbforums.com