OpenVPN Android Client is leaking my IP?

[JT Strickland]

I have an android A95X Max TV box that is routed through OpenVPN at the router level, as well as a Firestick and FireTV and RokuTV. When I checked the Android box today on whatismyip dot com, they knew exactly where I was. Or pretty close. That was with the Firefox android version, and Chrome also leaked it. The other clients do not appear to be leaking. Not much use in using an old slow VPN if it's going to tell on me. My other clients use the VPN at the client level by app.

Anybody know what the culprit might be? I have "policy rules" implemented to force these clients through the tunnel, and wonder if maybe I should have "strict" rules. I had read in post(s) that I shouldn't use the strict rules, and I can't remember exactly why now.

I appreciate any help and direction,
jts

RT-AC86U w/ 384.17, RT-AC68U Aimesh node w/ same, Diversion, UiDivstats, Skynet, AiProtection, Scribe, UiScribe, Conmon, SpdMerlin, ScMerlin, Nsrum, NtpMerlin, OpenVPN selective clients

 

[distilled]

What is the VPN DNS set to? Do you have IPV6 enabled, and does your VPN provider support it?

 

[JT Strickland]

What is the VPN DNS set to? Do you have IPV6 enabled, and does your VPN provider support it?

I don't have IPV6 enabled, and the website doesn't recognize a IPV6 address. I have DNS over TLS enabled, with quad 9 servers. My other clients don't "tattle" on me, as far as I can tell. I have checked using firefox on the firestick and the website reports my VPN address and location, not my "real" one. I haven't been able to check the roku tv yet. These are routed through the same VPN connection as my android box.

 

[JT Strickland]

I changed my VPN setting from "policy rules" to "policy rules strict" and don't seem to have made any difference. I can get both firefox and chrome to behave properly by starting the vpn app, but then the router reports that 2 clients are connecting from this device. I may have to take it out of the forced tunnel and use it in this manner. If it is going through the tunnel based on the MAC, it is not accomplishing anything except slower data as far as I can tell.

I am puzzled why this is the only one client, that I am aware of, that is leaking my ip. If anyone knows a fix, I would appreciate you sharing.
thanks,
jts