Tailscale Exit Node

[Brenneke]

I have set up an exit node on my RT-AX88U and it works, but with a DNS issue.

I want the exit node traffic to go through VPN so I set up a VPN client.

Given that I will only use this exit node with my Android phone, I set up a rule in VPN Director:

Tailscale Exit Node    100.xx.x.xx        OVPN4

The issue I have:

1) In the Tailscale Android app I must have Use Tailscale DNS toggled on before I can connect phone through exit node
2) When checking DNS leak, I see both my VPN provider and ISP DNS (Accept DNS Configuration set to Exclusive in OVPN4 client)

Please help.

 

[Brenneke]

95 views from those (surely) more knowledgeable than myself and not a sniff of a suggestion even.

Is it a reasonable answer?

The issue you're experiencing is likely due to how DNS handling works when combining Tailscale's exit node functionality with AsusWRT-Merlin's VPN Director. Even though you've set the VPN client to "exclusive DNS," Tailscale's exit node may still allow local LAN DNS queries to leak through.

So, the easiest and most effective solution in your scenario would be to configure your router (the exit node) to use exclusive DNS settings that match your VPN provider's DNS or another secure DNS service. This ensures that all DNS queries from your phone, routed through the exit node and VPN, are resolved using the intended DNS servers, thus preventing DNS leaks.

To achieve this, you can set the DNS servers in your router's VPN client settings to use the VPN provider's DNS or a secure public DNS service. Additionally, ensure that your router's firewall rules block any DNS queries that might bypass the VPN.

Here’s how you can do it - run these commands via SSH on your router:

iptables -I FORWARD -s 100.x.x.x -p udp --dport 53 ! -o tun11 -j DROP
iptables -I FORWARD -s 100.x.x.x -p tcp --dport 53 ! -o tun11 -j DROP

Replace tun11 with your VPN client's interface name (you can find it in the VPN status page).

The firewall rules ensure that all DNS traffic from your phone is forced through the VPN interface (tun11), preventing any fallback to LAN or ISP DNS.

Configuring secure DNS on the exit node ensures that even if Tailscale prioritizes local DNS, it will resolve queries using a trusted server.

This approach directly addresses the root cause of mixed DNS resolution paths and should eliminate leaks effectively.