Routing DNS through L2TP Tunnel (xl2tpd)

Installing and Using OpenWrt Network and Wireless Configuration
1

Hello All,

I am a newbie in OpenWRT and I have a simple config as seen in the video below where I download and configure an l2tp VPN tunnel via xl2tpd package:

OpenWRT LT2P Tunnel via xl2tpd

Everything works as expected, the VPN tunnel starts working and the IP address is correct. However all DNS requests go through wan instead of VPN tunnel.

root@OpenWrt:~# ip rule

0:      from all lookup local
32766:  from all lookup main
32767:  from all lookup default

root@OpenWrt:~# ip route list

default via 1.0.0.1 dev l2tp-VPN
1.0.0.1 dev l2tp-VPN scope link  src 192.168.1.177
10.100.100.0/24 dev wan scope link  src 10.100.100.92
192.168.1.0/24 dev br-lan scope link  src 192.168.1.1
199.188.90.8 via 10.100.100.1 dev wan

Can someone please assist me on how to route the DNS requests through the L2TP tunnel please?

Any hint or assistance would be greatly appreciated. :grinning:

2

Looking at your routing table, all traffic is routed through 1.0.0.1, which is also a Cloudflare DNS server.

Disable the advertised (via DHCP) DNS servers on the wan interface and set 1.0.0.1 as a custom DNS server.
image

Also it's probably a good idea to change the LAN IP address range so that it doesn't overlap with the xl2tpd interface.

1 Like
3

Dear PavelGL.

Thank you for the kind assistance. I applied the settings as advised by you. However, I intermittenly get remote DNS, most of the times I have Cloudflare DNS servers which is quite problematic for my application.

video of the steps applied here

Remote DNS alternates now between:

172.70.113.84	    CLOUDFLARENET	US
108.162.218.13		CLOUDFLARENET	US
172.70.109.88		CLOUDFLARENET	US
172.70.113.122		CLOUDFLARENET	US
172.70.113.38		CLOUDFLARENET	US
108.162.218.45		CLOUDFLARENET	US
108.162.218.14		CLOUDFLARENET	US
172.70.109.41		CLOUDFLARENET	US
172.70.113.12		CLOUDFLARENET	US
172.70.229.81		CLOUDFLARENET	US
172.70.229.41		CLOUDFLARENET	US

or

2001:4888:801c:ff00:168:d::                   WIRELESSDATANETWORK	US
141.207.243.254 254.sub-141-207-243.myvzw.com WIRELESSDATANETWORK	US

Is there a way to filter out CloudDNS servers and keep the real remote ISP DNS servers only?

Any input would be greatly appreciated.

PS. A gentleman had suggested to have this rule at this post:

15000:  from all iif lo lookup vpn

However, I cannot figure out how to add this rule.

Thank you so much.

4

If the requests to your ISP DNS servers go through the tunnel, they will most likely be rejected.
Most ISPs do not accept DNS queries outside of their own networks.
For this reason, when using a VPN, you must use public DNS servers or the VPN provider's DNS servers (if any).

1 Like