DNS leak with Tailscale and the Mullvad exit node.

Help
1

Expected Behaviour:

I installed Pi-hole directly onto my home lab (a desktop computer) onto my Tailscale network. My Tailscale network has a Mullvad exit VPN. I'm experiencing a DNS leak as tested on https://www.dnsleaktest.com/

The expected behaviour is that an extended test would reveal only the Mullvad exit node in Adelaide.

Details:

  • OS version: Linux Mint 22.2 Zara
  • Tailscale version: 1.98.4

Actual Behaviour:

A standard test detects only the Mullvad exit node in Adelaide, but an extended test doesn't detect the Mullvad exit node at all, it reveals my ISP and location in Sydney. (Bizarrely, it also picks up Singapore sometimes? I have no idea why.)

Debug Token:

https://tricorder.pi-hole.net/d92wmQfR/

(I get a blank page when I try to view that; I have no idea if you'd be able to see something on your end. Please let me know if you need a pastebin instead.)

Please keep in mind I'm a hobbyist, so please speak to me like I'm five! Thank you for your time. :slight_smile:

2

This doesn't look to be a Pi-hole issue:
Pi-hole only deals with your local DNS traffic.
It is receiving DNS requests and forwards allowed ones to its configured upstreams.

Interception and forceful redirection of outbound DNS requests to your VPN provider's DNS server would be something that your VPN gateway or VPN client software could be expected to do.

You should consider consulting your VPN provider's documentation and support.

That said, your debug log indicates that your Eero(?) routing equipment is advertising its own IPv6 ULA as local DNS server, e.g.:

*** [ DIAGNOSING ]: Discovering active DHCP servers (takes 6 seconds)
   Scanning all your interfaces for DHCP servers and IPv6 routers
   (…)
   * Received 80 bytes from fe80::<redacted>d @ wlp130s0f0
     Hop limit: 64
     (…)
     Recursive DNS server 1/1: fd<redacted>::1
     DNS server lifetime:600 sec

This would allow your IPv6 clients to by-pass Pi-hole via fd<redacted>::1.

This may or may not contribute to your DNS leak observation, e.g. if your VPN wouldn't be configured to handle IPv6 traffic.

Regardless, you'd have to find a way to configure your router to stop advertising its own IPv6 as DNS server, or to advertise your Pi-hole host machine's IPv6.

You'd have to consult your router's documentation sources on further details for its IPv6 configuration options.

If your router doesn't support configuring IPv6 DNS, you could consider disabling IPv6 altogether, provided you'd not depend on IPv6 for reasons.

If your router doesn't support that either, your IPv6-capable clients will always be able to bypass Pi-hole via IPv6.
You could then try to mitigate this, by setting Pi-hole as the only upstream of your router, provided your router supports it.
But note that you won't be able to attribute DNS requests to original individual IPv6 clients in such a configuration.

4

Rats, I don't have control over the router. I was going to set up Pi-hole as part of my Tailnet, on a per-device basis if I couldn't get it to play nice with the Tailnet.

I'll look into Mullvad and Tailscale's documentation then, thanks.

5

Just an update: after uninstalling pi-hole the DNS leak disappeared. It reappeared after reinstallation. So it's not the router, because the router hasn't been touched.

I can also see I'm not the only person dealing with this issue as well.

EDIT: I apologise. You were right, I was wrong. I found a config that had a strange IP attached and this time I happened to have a desktop app on hand that I'd downloaded after this for networking purposes and checked where it led... it was the same router you found. I changed the config file to point at Cloudflare and now it's working. Thank you, and apologies!

6

A router advertising its own IPv6 addresses as DNS server is something you want to address regardless whether you'd be facing a DNS leak with your VPN provider or not.

While such an IPv6 by-pass of Pi-hole may or may not contribute to your DNS leak observation, it's important to note that Tailscale currently marks its Mullvad VPN exit nodes as a beta feature, and it is available to Tailscale's paying customers only.

In particular, their documentation points out that DNS leaks could be expected to occur in certain exit node configurations (quoting from Mullvad exit nodes · Tailscale Docs):

Allowing exit nodes access to the local network might allow DNS leaks to occur (…)

As Tailscale with Mullvad exit nodes is a paid service, you should file an issue with them in case you'd still see any DNS leaks.

7

As noted in a previous comment, I am unable to address the router advertising itself as a DNS server as I do not have control over the router.