Need help with DNS leaks with Wireguard and DoH

OpenCoffee · May 10, 2025, 7:11pm

Hello guys,
I hope, I have some interesting problem for you to resolve because I am lost at the moment and unable to resolve it.
So, I have an router with OpenWRT 23.05 with WireGuard. I also have 3 different zones: GUEST(192.168.10.1/24), WIFI(192.168.11.1/24) and LAN(192.168.1.1/24).
Every zone points to wireguard interface in firewall only.
Every interface has 100.64.0.63(provied by Mullvad guide) in 'Use custom DNS servers' option and '6,100.64.0.63' in DHCP server -> Advanced settings -> DHCP-Options.
Besides that, I installed and cofigured HTTPS DNS Proxy with Quad9 and Cloudflare and 'Dnsmasq' in 'Forwards -> DNS Forwards' has these values: 127.0.0.1#5053, 127.0.0.1#5054.

Problem: I have DNS leaks from Q9 and Cloudflare BUT ONLY FOR LAN zone, guest reports only Mullvad's DNS servers - which is good and how it should be.
I am able to remove these DNS leaks by removing values from Dnsmasq Forwards but why guest doesn't leak Q9/Cloudflate DNS but LAN does? - this is question I'm not able to answer, so I am seeking help on a forum

I can't remove HTTPS DNS Proxy because I also setup split tunneling with 'pbr' using Policy which works, so I need DoH because I don't use VPN for games. I just want to understand why LAN has these DNS leaks when configured exactly the same way as guest zone is. Yes, I disabled policy for split tunnel in pbr when I was testing for DNS.

If you need another details of my configuration, please let me know.

pavelgl · May 10, 2025, 7:49pm

If I remember correctly, after disabling the force_dns option, the firewall service must be restarted manually or the device must be rebooted. Otherwise, the DNS hijacking rules (which by default only affect the laninterface) remain in the dstnat_lan chain.

Run this command from the cli to see if this is the case.

nft list chain inet fw4 dstnat_lan

OpenCoffee · May 11, 2025, 9:19am

well, there is problem: this command returns an error - look at image, I can post only one image so sorry for troubles.

Then I tried 'nft list chain inet fw4 dstnat' which returns atleast something but I don't really understand what is it. Even after stoping and disabling pbr plus restarting the router after that - output still the same.

OpenCoffee · May 11, 2025, 9:50am

Also I just noticed that these leaks are kinda strange because they happen with a delay. What I mean: when I open https://dnscheck.tools/ it immediately shows me my VPN IP and VPN DNS but after 7-8 seconds Q9/Cloudflare DNSes show up. Maybe this observation can help.

OpenCoffee · May 12, 2025, 6:08pm

UP - I still want to find out what it is.

egc · May 13, 2025, 5:05am

Some background information about DNS leaks:

Also includes information about Split DNS

It can help if you show us your configs, please connect to your OpenWRT device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button

Remember to redact keys, passwords, MAC addresses and any public IP addresses you may have:

ubus call system board
cat /etc/config/network
cat /etc/config/dhcp
cat /etc/config/firewall
ip route show
ip -6 route show
ip route show table all
ip rule show
wg show
cat /etc/config/pbr
service pbr reload
service pbr status
``

OpenCoffee · May 13, 2025, 5:34pm

Thanks for the link.

ubus call system board
{
	"kernel": "5.15.167",
	"hostname": "**************",
	"system": "ARMv8 Processor rev 4",
	"model": "ASUS RT-AX59U",
	"board_name": "asus,rt-ax59u",
	"rootfs_type": "squashfs",
	"release": {
		"distribution": "OpenWrt",
		"version": "23.05.5",
		"revision": "r24106-10cc5fcd00",
		"target": "mediatek/filogic",
		"description": "OpenWrt 23.05.5 r24106-10cc5fcd00"
	}
}

cat /etc/config/network

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix '**************'
	option packet_steering '1'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'lan1'
	list ports 'lan2'
	list ports 'lan3'

config device
	option name 'lan1'
	option macaddr '**************'

config device
	option name 'lan2'
	option macaddr '**************'

config device
	option name 'lan3'
	option macaddr '**************'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option ipaddr '192.168.1.1'
	option netmask '255.255.255.0'
	option ip6assign '60'
	list dns '100.64.0.63'

config device
	option name 'wan'
	option macaddr '**************'

config interface 'wan'
	option device 'wan'
	option proto 'dhcp'
	option peerdns '0'

config interface 'wan6'
	option device 'wan'
	option proto 'dhcpv6'

config device
	option type 'bridge'
	option name 'br-guest'
	option bridge_empty '1'
	option macaddr '**************'

config interface 'guest'
	option proto 'static'
	option device 'br-guest'
	option ipaddr '192.168.10.1'
	option netmask '255.255.255.0'
	list dns '100.64.0.63'

config device
	option type 'bridge'
	option name 'br-wifi'
	option bridge_empty '1'
	option macaddr '**************'

config interface 'wifi'
	option proto 'static'
	option device 'br-wifi'
	option ipaddr '192.168.11.1'
	option netmask '255.255.255.0'
	list dns '100.64.0.63'

config interface 'WGINTERFACE'
	option proto 'wireguard'
	option private_key '**************'
	list addresses '10.71.136.26/32'
	list addresses ''**************':8819/128'
	option force_link '1'

config wireguard_WGINTERFACE
	option description 'wr'
	option public_key '**************'
	list allowed_ips '0.0.0.0/0'
	list allowed_ips '::0/0'
	option route_allowed_ips '1'
	option endpoint_host '**************'
	option endpoint_port '51820'

config wireguard_WGINTERFACE
	option description 'wr2'
	option public_key '**************'
	list allowed_ips '0.0.0.0/0'
	list allowed_ips '::0/0'
	option route_allowed_ips '1'
	option endpoint_host '**************'
	option endpoint_port '51820'

cat /etc/config/dhcp

config dnsmasq
	option localise_queries '1'
	option rebind_protection '1'
	option local '/lan/'
	option domain 'lan'
	option expandhosts '1'
	option cachesize '1000'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option localservice '1'
	option ednspacket_max '1232'
	option confdir '/tmp/dnsmasq.d'
	option noresolv '1'
	option authoritative '1'
	option domainneeded '1'
	option allservers '1'
	list server '127.0.0.1#5053'
	list server '127.0.0.1#5054'
	option doh_backup_noresolv '1'
	list doh_backup_server '127.0.0.1#5053'
	list doh_backup_server '127.0.0.1#5054'
	list doh_server '127.0.0.1#5054'
	list doh_server '127.0.0.1#5053'

config dhcp 'lan'
	option interface 'lan'
	option start '100'
	option limit '150'
	option leasetime '2m'
	option dhcpv4 'server'
	option dhcpv6 'server'
	option ra 'server'
	list ra_flags 'managed-config'
	list ra_flags 'other-config'
	list dhcp_option '6,100.64.0.63'

config dhcp 'wan'
	option interface 'wan'
	option ignore '1'

config odhcpd 'odhcpd'
	option maindhcp '0'
	option leasefile '/tmp/hosts/odhcpd'
	option leasetrigger '/usr/sbin/odhcpd-update'
	option loglevel '4'

config dhcp 'guest'
	option interface 'guest'
	option start '100'
	option limit '150'
	option leasetime '2m'
	list dhcp_option '6,100.64.0.63'

config dhcp 'wifi'
	option interface 'wifi'
	option start '100'
	option limit '150'
	option leasetime '12h'
	list dhcp_option '6,100.64.0.63'

cat /etc/config/firewall

config defaults
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option synflood_protect '1'
	option flow_offloading '1'

config zone
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	list network 'lan'

config zone
	option name 'wan'
	option input 'DROP'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'
	list network 'wan'
	list network 'wan6'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Drop-Ping'
	option src 'wan'
	option proto 'icmp'
	option family 'ipv4'
	option target 'DROP'
	list icmp_type 'echo-request'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config zone
	option name 'guest'
	option input 'DROP'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network 'guest'

config rule
	option name 'Allow-DNS-Guest'
	option src 'guest'
	option dest_port '53'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCP-Guest'
	list proto 'udp'
	option src 'guest'
	option dest_port '67'
	option target 'ACCEPT'

config zone
	option name 'wifi'
	option input 'DROP'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network 'wifi'

config rule
	option name 'Allow-DNS-Wifi'
	option src 'wifi'
	option dest_port '53'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCP-Wifi'
	list proto 'udp'
	option src 'wifi'
	option dest_port '67'
	option target 'ACCEPT'

config include 'pbr'
	option fw4_compatible '1'
	option type 'script'
	option path '/usr/share/pbr/firewall.include'

config zone
	option name 'WGINTERFACE'
	option input 'DROP'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'
	list network 'WGINTERFACE'

config forwarding
	option src 'guest'
	option dest 'WGINTERFACE'

config forwarding
	option src 'wifi'
	option dest 'WGINTERFACE'

config forwarding
	option src 'lan'
	option dest 'WGINTERFACE'

ip route show

default dev WGINTERFACE proto static scope link 
*************/23 dev wan proto kernel scope link src *************
************* via ************* dev wan proto static 
************* via ************* dev wan proto static 
192.168.1.0/24 dev br-lan proto kernel scope link src 192.168.1.1 
192.168.10.0/24 dev br-guest proto kernel scope link src 192.168.10.1 
192.168.11.0/24 dev br-wifi proto kernel scope link src 192.168.11.1 linkdown 

ip -6 route show
*************:8819 dev WGINTERFACE proto kernel metric 256 pref medium
*************/64 dev br-lan proto static metric 1024 pref medium
unreachable *************/48 dev lo proto static metric 2147483647 pref medium
fe80::/64 dev eth0 proto kernel metric 256 pref medium
fe80::/64 dev br-guest proto kernel metric 256 pref medium
fe80::/64 dev br-lan proto kernel metric 256 pref medium
fe80::/64 dev wan proto kernel metric 256 pref medium
fe80::/64 dev phy1-ap0 proto kernel metric 256 pref medium
default dev WGINTERFACE proto static metric 1024 pref medium

ip route show table all
default via ************* dev wan table pbr_wan 
192.168.1.0/24 dev br-lan table pbr_wan proto kernel scope link src 192.168.1.1 
192.168.10.0/24 dev br-guest table pbr_wan proto kernel scope link src 192.168.10.1 
192.168.11.0/24 dev br-wifi table pbr_wan proto kernel scope link src 192.168.11.1 linkdown 
default via 10.71.136.26 dev WGINTERFACE table pbr_WGINTERFACE 
192.168.1.0/24 dev br-lan table pbr_WGINTERFACE proto kernel scope link src 192.168.1.1 
192.168.10.0/24 dev br-guest table pbr_WGINTERFACE proto kernel scope link src 192.168.10.1 
192.168.11.0/24 dev br-wifi table pbr_WGINTERFACE proto kernel scope link src 192.168.11.1 linkdown 
default dev WGINTERFACE proto static scope link 
*************/23 dev wan proto kernel scope link src *************
************* via ************* dev wan proto static 
************* via ************* dev wan proto static 
192.168.1.0/24 dev br-lan proto kernel scope link src 192.168.1.1 
192.168.10.0/24 dev br-guest proto kernel scope link src 192.168.10.1 
192.168.11.0/24 dev br-wifi proto kernel scope link src 192.168.11.1 linkdown 
local 10.71.136.26 dev WGINTERFACE table local proto kernel scope host src 10.71.136.26 
local ************* dev wan table local proto kernel scope host src *************
broadcast ************* dev wan table local proto kernel scope link src *************
local 127.0.0.0/8 dev lo table local proto kernel scope host src 127.0.0.1 
local 127.0.0.1 dev lo table local proto kernel scope host src 127.0.0.1 
broadcast 127.255.255.255 dev lo table local proto kernel scope link src 127.0.0.1 
local 192.168.1.1 dev br-lan table local proto kernel scope host src 192.168.1.1 
broadcast 192.168.1.255 dev br-lan table local proto kernel scope link src 192.168.1.1 
local 192.168.10.1 dev br-guest table local proto kernel scope host src 192.168.10.1 
broadcast 192.168.10.255 dev br-guest table local proto kernel scope link src 192.168.10.1 
local 192.168.11.1 dev br-wifi table local proto kernel scope host src 192.168.11.1 
broadcast 192.168.11.255 dev br-wifi table local proto kernel scope link src 192.168.11.1 linkdown 
***************/:8819 dev WGINTERFACE proto kernel metric 256 pref medium
***************/64 dev br-lan proto static metric 1024 pref medium
unreachable ***************48 dev lo proto static metric 2147483647 pref medium
fe80::/64 dev eth0 proto kernel metric 256 pref medium
fe80::/64 dev br-guest proto kernel metric 256 pref medium
fe80::/64 dev br-lan proto kernel metric 256 pref medium
fe80::/64 dev wan proto kernel metric 256 pref medium
fe80::/64 dev phy1-ap0 proto kernel metric 256 pref medium
default dev WGINTERFACE proto static metric 1024 pref medium
local ::1 dev lo table local proto kernel metric 0 pref medium
local *******************:8819 dev WGINTERFACE table local proto kernel metric 0 pref medium
anycast*******************:: dev br-lan table local proto kernel metric 0 pref medium
local *******************::1 dev br-lan table local proto kernel metric 0 pref medium
anycast fe80:: dev eth0 table local proto kernel metric 0 pref medium
anycast fe80:: dev br-guest table local proto kernel metric 0 pref medium
anycast fe80:: dev br-lan table local proto kernel metric 0 pref medium
anycast fe80:: dev wan table local proto kernel metric 0 pref medium
anycast fe80:: dev phy1-ap0 table local proto kernel metric 0 pref medium
local fe80::************* dev wan table local proto kernel metric 0 pref medium
local fe80::::************* dev phy1-ap0 table local proto kernel metric 0 pref medium
local fe80::::************* dev br-guest table local proto kernel metric 0 pref medium
local fe80::::************* dev eth0 table local proto kernel metric 0 pref medium
local fe80::::************* dev br-lan table local proto kernel metric 0 pref medium
multicast ff00::/8 dev eth0 table local proto kernel metric 256 pref medium
multicast ff00::/8 dev br-lan table local proto kernel metric 256 pref medium
multicast ff00::/8 dev br-guest table local proto kernel metric 256 pref medium
multicast ff00::/8 dev wan table local proto kernel metric 256 pref medium
multicast ff00::/8 dev WGINTERFACE table local proto kernel metric 256 pref medium
multicast ff00::/8 dev phy1-ap0 table local proto kernel metric 256 pref medium

ip rule show
0:	from all lookup local
29998:	from all fwmark 0x20000/0xff0000 lookup pbr_WGINTERFACE
30000:	from all fwmark 0x10000/0xff0000 lookup pbr_wan
32766:	from all lookup main
32767:	from all lookup default


wg show
interface: WGINTERFACE
  public key: *************
  private key: (hidden)
  listening port: 47263

peer: *************
  endpoint: *************:51820
  allowed ips: 0.0.0.0/0, ::/0
  latest handshake: 2 minutes ago
  transfer: 49.38 GiB received, 616.28 MiB sent

peer: *************
  endpoint: *************:51820
  allowed ips: (none)

cat /etc/config/pbr

config pbr 'config'
	option enabled '1'
	option verbosity '2'
	option strict_enforcement '1'
	option resolver_set 'none'
	list resolver_instance '*'
	option ipv6_enabled '0'
	list ignored_interface 'vpnserver'
	option boot_timeout '30'
	option rule_create_option 'add'
	option procd_boot_delay '0'
	option procd_reload_delay '1'
	option webui_show_ignore_target '0'
	option nft_rule_counter '0'
	option nft_set_auto_merge '1'
	option nft_set_counter '0'
	option nft_set_flags_interval '1'
	option nft_set_flags_timeout '0'
	option nft_set_policy 'performance'
	list webui_supported_protocol 'all'
	list webui_supported_protocol 'tcp'
	list webui_supported_protocol 'udp'
	list webui_supported_protocol 'tcp udp'
	list webui_supported_protocol 'icmp'

config include
	option path '/usr/share/pbr/pbr.user.aws'
	option enabled '0'

config include
	option path '/usr/share/pbr/pbr.user.netflix'
	option enabled '0'

config include
	option path '/usr/share/pbr/pbr.user.wg_server_and_client'
	option enabled '0'

config dns_policy
	option name 'Redirect Local IP DNS'
	option src_addr '192.168.1.5'
	option dest_dns '1.1.1.1'
	option enabled '0'

config policy
	option name 'Ignore Local Requests'
	option interface 'ignore'
	option dest_addr '10.0.0.0/24 10.0.1.0/24 192.168.100.0/24 192.168.1.0/24'
	option enabled '0'

config policy
	option name 'Plex/Emby Local Server'
	option interface 'wan'
	option src_port '8096 8920 32400'
	option enabled '0'

config policy
	option name 'Plex/Emby Remote Servers'
	option interface 'wan'
	option dest_addr 'plex.tv my.plexapp.com emby.media app.emby.media tv.emby.media'
	option enabled '0'

config policy
	option name 'Split tunnel PC'
	option src_addr '192.168.1.186'
	option interface 'wan'
	option enabled '0'

service pbr reload
Using wan interface (on_start): wan 
Found wan gateway (on_start): *************
Setting up routing for 'wan/*************' [✓]
Setting up routing for 'WGINTERFACE/10.71.136.26' [✓]
Installing fw4 nft file [✓]
pbr 1.1.6-22 monitoring interfaces: wan WGINTERFACE 
pbr 1.1.6-22 (fw4 nft file mode) started with gateways:
wan/*************
WGINTERFACE/10.71.136.26 [✓]

service pbr status

pbr - environment
pbr 1.1.6-22 running on OpenWrt 23.05.5.

Dnsmasq version 2.90  Copyright (c) 2000-2024 Simon Kelley
Compile time options: IPv6 GNU-getopt no-DBus UBus no-i18n no-IDN DHCP no-DHCPv6 no-Lua TFTP no-conntrack no-ipset no-nftset no-auth no-cryptohash no-DNSSEC no-ID loop-detect inotify dumpfile

pbr fw4 nft file: /usr/share/nftables.d/ruleset-post/30-pbr.nft
add chain inet fw4 pbr_mark_0x010000
add rule inet fw4 pbr_mark_0x010000  mark set mark and 0xff00ffff xor 0x010000
add rule inet fw4 pbr_mark_0x010000 return
add chain inet fw4 pbr_mark_0x020000
add rule inet fw4 pbr_mark_0x020000  mark set mark and 0xff00ffff xor 0x020000
add rule inet fw4 pbr_mark_0x020000 return

pbr chains - policies
	chain pbr_forward { # handle 51
	}
	chain pbr_input { # handle 52
	}
	chain pbr_output { # handle 53
	}
	chain pbr_postrouting { # handle 55
	}
	chain pbr_prerouting { # handle 54
	}
	chain pbr_dstnat { # handle 50
	}

pbr chains - marking
	chain pbr_mark_0x010000 { # handle 1309
		meta mark set meta mark & 0xff01ffff | 0x00010000 # handle 1310
		return # handle 1311
	}
	chain pbr_mark_0x020000 { # handle 1312
		meta mark set meta mark & 0xff02ffff | 0x00020000 # handle 1313
		return # handle 1314
	}

pbr nft sets

IPv4 table 256 route: default via ************* dev wan 
IPv4 table 256 rule(s):
30000:	from all fwmark 0x10000/0xff0000 lookup pbr_wan
IPv4 table 257 route: default via 10.71.136.26 dev WGINTERFACE 
IPv4 table 257 rule(s):
29998:	from all fwmark 0x20000/0xff0000 lookup pbr_WGINTERFACE

egc · May 14, 2025, 8:17am

First something else, you have two peers defined with overlapping allowed_ips that cannot work only one is used so remove the one you do not want.
You can have multiple tunnels as long as you only use one with route_allowed_ips enabled which is your default. The other tunnels can be used with PBR

OpenCoffee:

config wireguard_WGINTERFACE
	option description 'wr'
	option public_key '**************'
	list allowed_ips '0.0.0.0/0'
	list allowed_ips '::0/0'
	option route_allowed_ips '1'
	option endpoint_host '**************'
	option endpoint_port '51820'

config wireguard_WGINTERFACE
	option description 'wr2'
	option public_key '**************'
	list allowed_ips '0.0.0.0/0'
	list allowed_ips '::0/0'
	option route_allowed_ips '1'
	option endpoint_host '**************'
	option endpoint_port '51820'

Now on to the DNS question.
A DNS leak can be defined in multiple ways, the most annoying DNS leak is if the geographical origin of DNS and IP address are different which is caused by a different route of the DNS and IP traffic.
This geographical check is what is done by streaming services, banks, amazon etc. (among other things) to detect VPN use.

If all your traffic is routed via the VPN then there is no problem in this regard.
Trouble starts when you are using PBR, when using PBR you have to make sure that lan clients using the VPN query DNS also via the VPN, one way is to use DNS option 6 but it can also be done with PBR DNS Policies.

You have installed PBR but are using an outdated version, so if you are planning on using PBR, first thing I would recommend is to upgrade PBR see: https://docs.openwrt.melmac.net/

The use of HTTPS DNS Proxy is certainly possible but is complicating things, if you use this then the setting on DNS servers on the interface is ignored so the setting of

On the interface is useless as it is ignored by using HTTPS DNS Proxy.
I do advice to set a publicly available DNS server e.g. 9.9.9.9 on the WAN interface in case HTTPS DNS Proxy is not running, do not use 100.64.0.63 as DNS server as that is only available through Mullvads tunnel.

Oh and the use of setting DNS server on multiple interfaces is useless all DNS server set on the interfaces will end up in the same basket (DNSMasq's resolv.conf) which is used by DNSMasq but not in case you are using HTTPS DNS Proxy as it is ignored in that case

When using HTTPS DNS Proxy in these kind of split DNS setups make sure you do not enable Force Router DNS as that will catch all DNS53 and will reroute via the router instead of following the client

For Split DNS I would advice to use the PBR DNS policies instead DNS option 6 like you are doing now.

But at this moment all your traffic is routed via the VPN so you will never have a DNS leak but yes not all clients will use Mullvads DNS servers as some will use HTTPS DNS Proxy.

My advice first find out what you want to route via the VPN and what not and then adjust accordingly.

As you can see you are opening a whole can of worms, a lot of information is available at:

Oh and to complicate matters further Mullvad is hijacking DNS53, see:

OpenCoffee · May 14, 2025, 6:18pm

yeah, I noticed that only one peer is used so I just left another one since it didn't work anyway but ok, I deleted it after you mention, thanks.

I don't see an upgrade for pbr in my software tab in Luci, so I don't think I would upgrade it in another way since I am noob and don't want to spend another day reverting back or something similar.

for this DoH is set to "Let local devices use their own DNS servers if set", so I it's not an option

yes and I want to know why "not all clients will use Mullvads DNS servers as some will use HTTPS DNS Proxy". I used all my knowledge to figure it out and I failed, so I created this post asking for help.

OpenCoffee · May 14, 2025, 6:20pm

my ultimate setup is that everything should use WireGuard on the router but I would like to make some exception in pbr, like for my PC, so it uses DoH on router and my ISP IP(for games, for example). And it works as I want with pbr/policy BUT if I disable pbr/policy, it should use WireGuard only: it does (so I have IP and DNS from mullvad) but after 7-8 seconds when dnscheck.tools is loaded it shows my DoH DNS - and I don't know why. So, I have IP from Mullvad, DNS from Mullvad and then DNSes from DoH. And it happens only for LAN: wifi and guest zones don't leak DoH DNS ever. Not even after 8 seconds

So, just to be clear: same setup on every zone(LAN,wifi,guest), pbr is disabled - LAN leaks DoH DNSes after 7-8 seconds but wifi,guest don't and I can't figure out why Help.

OpenCoffee · May 14, 2025, 6:40pm

I read it multiple times in different days but still unable to answer my question, unfortinatly