PI hole + unbound + domain vpn routing

[OBENZ]

Hello community today i'm encountering an issue that i can't root out. My set up is as follow, 86U with asus merlin and 4 nordvpn client running. Pihole with unbound.
The way i have it set up is as follows:
WAN DNS is using cloudfare
LAN DNS is using PIHOLE IP
DNS DIRECTOR is ON with global redirection set to no redirection and RPI where the pihole is running is set to no redirection

I'm using domain vpn routing script to create a tunnel for specfic domains, mainly NETFLIX, DISNEY, AMAZON, MAX. Each VPN client configuration has a country region and each has its DNS set to Exclusive.

When i do i simple test of going to DNSLEAK or IPLEAK i end up with my ISP IP AND DNS even though i have added all their domains to the vpn routing script. i'm at loss to be honest any help would be appreciated

 

[eibgrad]

External DNS checkers are not reliable. What matters is what's actually happening within the router itself.

To that end, what does the merlin DNS monitor say are the DNS servers in use?

Tutorial - How to monitor DNS traffic in real-time

The following script allows for real-time monitoring of DNS on the router for the purposes of knowing what DNS servers are in use, and which network interfaces are being used. https://pastebin.com/AGNF8cC8 Overview One of the most difficult aspects of the router for users is managing DNS. DNS...

www.snbforums.com

 

[bennor]

DNS DIRECTOR is ON with global redirection set to no redirection and RPI where the pihole is running is set to no redirection

Out of curiosity, why do yo have Global Redirection set to No Redirection rather than set to Router? What is that setting accomplishing for your use case?

 

[OBENZ]

Out of curiosity, why do yo have Global Redirection set to No Redirection rather than set to Router? What is that setting accomplishing for your use case?

i dont like when the router's name keeps popping up on my pihole client list as the number one and it masks which client is making the queries if that makes sens

 

[OBENZ]

External DNS checkers are not reliable. What matters is what's actually happening within the router itself.

To that end, what does the merlin DNS monitor say are the DNS servers in use?

Tutorial - How to monitor DNS traffic in real-time

The following script allows for real-time monitoring of DNS on the router for the purposes of knowing what DNS servers are in use, and which network interfaces are being used. https://pastebin.com/AGNF8cC8 Overview One of the most difficult aspects of the router for users is managing DNS. DNS...

www.snbforums.com

it might be true but all the websites are not usable as they detect im in my country where those services don't work/are not available..i'll check your link though, thank you

 

[bennor]

i dont like when the router's name keeps popping up on my pihole client list as the number one and it masks which client is making the queries if that makes sens

You can possibly solve that by using Conditional forwarding on the Pi-Hole (Settings > DNS section) if you aren't doing so already. This assumes the router and not the Pi-Hole is doing the DHCP server. And this assumes the LAN clients are using the Pi-Hole for their DNS (via the Router GUI LAN > DHCP Server > DNS Server 1 & 2 values (and one has Advertise router's IP in addition to user-specified DNS disabled).

 

[Tech9]

i dont like when the router's name keeps popping up on my pihole client list as the number one

Your Pi-hole is not configured properly. You don't have to filter router's internal requests, just clients'. Router's DNS in WAN to whatever you like, clients' DNS in LAN to Pi-hole + don't advertise routers IP + Conditional Forwarding as explained above in Pi-hole. You won't see your router ever, clients only.

DNS DIRECTOR is ON with global redirection set to no redirection and RPI where the pihole is running is set to no redirection

Your setting effectively disables DNS Director. Global Redirection to Router, RPi with Pi-hole to No Redirection.

 

[bennor]

@OBENZ, see my example setup using DNS Director + Pi-Hole here:
https://www.snbforums.com/threads/pihole-dns.74646/page-3#post-712319

As Tech9 indicates, your current DNS Director settings appear to do nothing.

 

[OBENZ]

ok all taken into consideration and applied the changes still doesnt change anything regarding my situation

 

[bennor]

ok all taken into consideration and applied the changes still doesnt change anything regarding my situation

It may help if you post your VPN client configuration and domain VPN routing script, redacting sensitive info, for others to review.

The suggestions to fix DNS Director (Global Redirection to Router) may not affect your VPN settings. But at least you likely now have DNS Director working properly for main LAN non VPN clients

 

[OBENZ]

yea sure heres the client VPN config and my domainlist for DISNEY

www.apps.disneyplus.com
cdn.cookielaw.org
img.hotstar.com
disney.com
bamgrid.com
www.disneyplus.com
media.dssott.com
disney-plus.net
appconfigs.disney-plus.net
disney.api.edge.bamgrid.com
disney.content.edge.bamgrid.com
disney.connections.edge.bamgrid.com
cws.convava.com
disney-portal.my.onetrust.com
disneyplus.bn5x.net
js-agent.newrelic.com
adobedtm.com
braze.com
disney.demdex.net
starrot.com
cdn.registerdisney.go.com
disney.api.edge.bamgrid.com
disney.connections.edge.bamgrid.com
disney.content.edge.bamgrid.com
disney.images.edge.bamgrid.com
disney.playback.edge.bamgrid.com
pcs.bamgrid.com
playback-certs.bamgrid.com
prod-ripcut-delivery.disney-plus.net
prod-static.disney-plus.net
static-assets.bamgrid.com
vod-akc-na-central-1.media.dssott.com
vod-akc-na-east-2.media.dssott.com
vod-bgc-na-east-1.media.dssott.com
vod-ftc-na-east-2.media.dssott.com
vpe-static.bamgrid.com
vod-akc-na-west-2.media.dssott.com
vod-ftc-eu-south-1.media.dssott.com
vod-bgc-eu-west-1.media.dssott.com
vod-ftc-eu-south-1.media.dssott.com

for some reason, disney directs me to apps.disneyplus.com even if i try to visit disney.com as that's where our regional disney is hosted. yet when i run NordVPN through their app and visit disney it doesn't redirect