VPN + AGH --> trouble with DNS (rpi4)

Hi,

I got OpenWrt 22.03.4 running on a raspberry pi 4B.
Plus OpenVPN.
Plus AdGuard Home (internally).

I followed the Wiki, a bunch of guides & troubleshoots here on the forum, and a couple of youtube videos, and kind of got it working, but something is still wrong. The router itself can't resolve names, and lan clients are only able to do so after manually setting the DNS server.

I'm sure it's something really simple, and I hope you guys could help me figure it out.

Here are the configs:

network

config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'

config globals 'globals'
option ula_prefix '***'

config device
option name 'br-lan'
option type 'bridge'
list ports 'eth0'

config interface 'lan'
option device 'br-lan'
option proto 'static'
option netmask '255.255.255.0'
option ipaddr '192.168.10.1'

config interface 'wan'
option proto 'dhcp'
option device 'eth1'

config interface 'wwan'
option proto 'dhcp'

config interface 'vpntun'
option proto 'none'
option device 'tun0'

dhcp

config dnsmasq
option domainneeded '1'
option localise_queries '1'
option rebind_protection '1'
option rebind_localhost '1'
option local '/lan/'
option domain 'lan'
option expandhosts '1'
option authoritative '1'
option readethers '1'
option leasefile '/tmp/dhcp.leases'
option localservice '1'
option ednspacket_max '1232'
option noresolv '1'
option server '192.168.10.1'
option port '5353'

config dhcp 'lan'
option interface 'lan'
option start '100'
option limit '150'
option leasetime '12h'
option dhcpv4 'server'
option dhcpv6 'server'
option ra 'server'
list ra_flags 'managed-config'
list ra_flags 'other-config'

config dhcp 'wan'
option interface 'wan'
option ignore '1'

config odhcpd 'odhcpd'
option maindhcp '0'
option leasefile '/tmp/hosts/odhcpd'
option leasetrigger '/usr/sbin/odhcpd-update'
option loglevel '4'

config dhcp 'eth1'
option start '100'
option limit '150'
option leasetime '12h'
option interface 'eth1'

firewall

config defaults
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'
option synflood_protect '1'

config zone
option name 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
list network 'lan'

config zone
option name 'wan'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
list network 'wan'
list network 'wan6'
list network 'wwan'

... standard rules...

config zone
option name 'vpnfirewall'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
list network 'vpntun'

config forwarding
option src 'lan'
option dest 'vpnfirewall'

config redirect 'adguardhome_dns_53'
option src 'lan'
option proto 'tcp udp'
option src_dport '53'
option target 'DNAT'
option name 'Adguard Home'
option dest 'lan'
option dest_port '53'

adguardhome.yaml

> bind_host: 0.0.0.0
> bind_port: 3000
> beta_bind_port: 0
> users:
>   - name: ...
>     password: ...
> auth_attempts: 5
> block_auth_min: 15
> http_proxy: ""
> language: ""
> debug_pprof: false
> web_session_ttl: 720
> dns:
>   bind_hosts:
>     - 0.0.0.0
>   port: 53
>   statistics_interval: 90
>   querylog_enabled: true
>   querylog_file_enabled: true
>   querylog_interval: 2160h
>   querylog_size_memory: 1000
>   anonymize_client_ip: false
>   protection_enabled: true
>   blocking_mode: default
>   blocking_ipv4: ""
>   blocking_ipv6: ""
>   blocked_response_ttl: 10
>   parental_block_host: family-block.dns.adguard.com
>   safebrowsing_block_host: standard-block.dns.adguard.com
>   ratelimit: 20
>   ratelimit_whitelist: []
>   refuse_any: true
>   upstream_dns:
>     - https://dns10.quad9.net/dns-query
>     - https://dns.adguard-dns.com/dns-query
>     - https://security.cloudflare-dns.com/dns-query
>   upstream_dns_file: ""
>   bootstrap_dns:
>     - 9.9.9.10
>     - 149.112.112.10
>     - 2620:fe::10
>     - 2620:fe::fe:10
>   all_servers: false
>   fastest_addr: false
>   fastest_timeout: 1s
>   allowed_clients: []
>   disallowed_clients:
>     - 192.168.10.102
>   blocked_hosts:
>     - version.bind
>     - id.server
>     - hostname.bind
>   trusted_proxies:
>     - 127.0.0.0/8
>     - ::1/128
>   cache_size: 4194304
>   cache_ttl_min: 0
>   cache_ttl_max: 0
>   cache_optimistic: false
>   bogus_nxdomain: []
>   aaaa_disabled: false
>   enable_dnssec: false
>   edns_client_subnet: false
>   max_goroutines: 300
>   handle_ddr: true
>   ipset: []
>   ipset_file: ""
>   filtering_enabled: true
>   filters_update_interval: 24
>   parental_enabled: false
>   safesearch_enabled: false
>   safebrowsing_enabled: true
>   safebrowsing_cache_size: 1048576
>   safesearch_cache_size: 1048576
>   parental_cache_size: 1048576
>   cache_time: 30
>   rewrites: []
>   blocked_services:
>   upstream_timeout: 10s
>   private_networks: []
>   use_private_ptr_resolvers: true
>   local_ptr_upstreams:
>     - 127.0.0.1:5353
>   serve_http3: false
>   use_http3_upstreams: false
> tls:
>   enabled: false
>   server_name: ""
>   force_https: false
>   port_https: 443
>   port_dns_over_tls: 853
>   port_dns_over_quic: 853
>   port_dnscrypt: 0
>   dnscrypt_config_file: ""
>   allow_unencrypted_doh: false
>   certificate_chain: ""
>   private_key: ""
>   certificate_path: ""
>   private_key_path: ""
>   strict_sni_check: false
> filters:
>   - enabled: true
>     url: https://adguardteam.github.io/HostlistsRegistry/assets/filter_1.txt
>     name: AdGuard DNS filter
>     id: 1
>   - enabled: true
>     url: https://adguardteam.github.io/HostlistsRegistry/assets/filter_2.txt
>     name: AdAway Default Blocklist
>     id: 2
> whitelist_filters: []
> user_rules:
>   - ""
> dhcp:
>   enabled: false
>   interface_name: ""
>   local_domain_name: lan
>   dhcpv4:
>     gateway_ip: ""
>     subnet_mask: ""
>     range_start: ""
>     range_end: ""
>     lease_duration: 86400
>     icmp_timeout_msec: 1000
>     options: []
>   dhcpv6:
>     range_start: ""
>     lease_duration: 86400
>     ra_slaac_only: false
>     ra_allow_slaac: false
> clients:
>   runtime_sources:
>     whois: true
>     arp: true
>     rdns: true
>     dhcp: true
>     hosts: true
>   persistent: []
> log_file: ""
> log_max_backups: 0
> log_max_size: 100
> log_max_age: 3
> log_compress: false
> log_localtime: true
> verbose: false
> os:
>   group: ""
>   user: ""
>   rlimit_nofile: 0
> schema_version: 14