Sorry for reviving this old thread, but the issue is still actual and I believe it's a bug/glitch in dnsmasq that should be addressed.
I'm running OpenWrt 19.07.5 on a D-Link DIR-860L B1 (ramips/mt7621) and configured a custom Point-to-Point OpenVPN instance on it (shared static key). On the client (Android) I defined the name server manually as the OpenWRT VPN end (tunnel IP - 10.0.10.1) and noticed that dnsmasq, although listening on the tun0 interface and the DNS requests arriving at the router through the tunnel (verified with tcpdump), doesn't answer them.
Here are some relevant infos:
root@ow:~# ip r s | grep 10.0
10.0.10.2 dev tun0 scope link src 10.0.10.1
root@ow:~# ip a s | grep 10.0
inet 10.0.10.1 peer 10.0.10.2/32 scope global tun0
root@ow:~# netstat -an | grep 10.0
tcp 0 0 10.0.10.1:53 0.0.0.0:* LISTEN
udp 0 0 10.0.10.1:53 0.0.0.0:*
Once I edited /etc/config/dhcp and set: option localservice '0', & restarted the router, dnsmasq would answer the requests on the tun0 interface, but it would also listen on the wan interface.
I filtered the tcp/udp port 53 on the wan (using PPPoE) in the custom firewall with:
/usr/sbin/iptables -I INPUT -i pppoe-wan -p udp --dport 53 -j DROP
/usr/sbin/iptables -I INPUT -i pppoe-wan -p tcp --dport 53 -j DROP
VPN (tun0 interface) looks treated as local, because dnsmasq starts listening on it, but it doesn't "serve" it until the option localservice is disabled (set on 0).