wan dns vs dnscrypt vs vpn client dns confusion

[bilboSNB]

Can someone explain/confirm what they think is happening with dns here.


I am using dnscrypt with opendns to make use of parental controls blocking certain sites for the kids based on what I specify in my opendns profile. The DNS settings under wan are set to opendns servers but I believe this has no effect when dnscrypt is being used. çIs that bit correct (This all works as expected for normal LAN clients.)


Dns settings on my routers vpn client set to strict


VPN policy based routing is in place directing my tablet over the vpn to get round geo blocking. In relation to my tablet this is what is confusing me. When I run a dnsleak test the results are that I am using open dns servers and not my vpn providers however any filtering that I have in place per my opendns settings do not take effect for the tablet so….


In my mind this means that opendns is being used per the wan/dnscrypt settings but the request is getting sent through the vpn hence opendns don’t see my wan ip and I don’t get any filtering. <= does this sound plausible??


Also does this mean that the dns request for the tablet is not going through the dnscrypt tunnel with these settings, is there a way to check this??


If I use dns filter and force use of the router dns for the tablet via custom entry with the ip of my router dns leak returns opendns servers as expected and I do get filtering. <= edit after more testing tonight, no I dont.


I had previously asked if when using dnsfilter to force my vpn provider dns settings for vpn for certain lan clients like my tablet, did the dns request get sent down the tunnel or over the wan and I was told most likely over the vpn. ç does this still apply in the above scenario?


Many thanks

 

[bilboSNB]

So I really dont understand what is going on with policy routing and dns and dnscrypt.

For example, I use dnsmasq config to enforce google safesearch per the wiki, this still works for devices set to use the vpn via policy based routing and the router for dns via the dns filter however upstream dns requests would still appear to go over the vpn as evidenced by the lack of opendns filtering for those devices.

 

[RMerlin]

VPN policy based routing is in place directing my tablet over the vpn to get round geo blocking. In relation to my tablet this is what is confusing me. When I run a dnsleak test the results are that I am using open dns servers and not my vpn providers however any filtering that I have in place per my opendns settings do not take effect for the tablet so….

OpenDNS relies on your IP address to determine if it should use someone's personalized settings. Since the connection comes from your VPN provider, and therefore the VPN provider's IP address, OpenDNS has no way of knowing the DNS request came from you, and not some other random user. Therefore, you get the generic OpenDNS answers, not your personalized ones.

 

[bilboSNB]

So in conclusion then, if a lan client is forced to use the vpn via policy based routing and uses the routers lan ip for dns, the dnsmasq settings for local resolution are still in effect and the dns request still gets forwarded over the vpn for that client which agrees with what is happening for me.

 

[RMerlin]

So in conclusion then, if a lan client is forced to use the vpn via policy based routing and uses the routers lan ip for dns, the dnsmasq settings for local resolution are still in effect and the dns request still gets forwarded over the vpn for that client which agrees with what is happening for me.

That's correct. This is why mixing policy-based routing and custom DNS servers provided by the tunnel provider can cause issues. You have to manually configure the VPN provider's DNS through DNSFilter instead, so that way you can ensure that only VPN clients use the tunnel provider's DNS, and the rest of the LAN will use whatever DNS is configured in dnsmasq (typically your ISP's, or any custom DNS you entered on the WAN page).

 

[bilboSNB]

Thanks RMerlin.

I was having another play and thought about trying one of the other built in dns providers that just blanket block adult content no matter where the request comes from eg opendns family and norton family, the thing is the same behaviour persists eg no block when the client is routed through the vpn even though an ipleak test shows the correct dns servers are being used. I can't really get my head around that one yet unless I was having I should go to bed now its late moment. Will try again later.