DNS over HTTPS (DoH) with OpenVPN

NiMing8

I read this excellent article on implementing DoH (https://bendews.com/posts/implement-dns-over-https/), and the part on the Raspberry Pi, and sucessfully implemented in on my RPi OpenVPN client server which acts as a Gateway on my home network.
The DoH setup works great and uses the CloudFlare Encrypted DNS service as tested using there command:

dig @127.0.0.1 -p 5053 google.com

Now I want to make it the default DNS service on my RPi OpenVPN Client so that any device using that RPi as its gateway will automatically use Encrypted DNS. So I made this change to the /etc/openvpn/client.conf file on the RPi:

dhcp-option DNS 127.0.0.1:5053

But it does not appear to be working.
If I run this nslookup command on my windows PC connected to the RPi Gateway, it still lists Google as the DNS server:

>nslookup all
Server:  google-public-dns-a.google.com
Address:  8.8.8.8

*** google-public-dns-a.google.com can't find all: Non-existent domain

Any ideas what I could be doing wrong? Is there perhaps a 'push DNS' command coming from the OpenVPN server that is overriding this ?
Thanks for any and all help/suggestions/pointers!

TinCanTech

NiMing8 wrote So I made this change to the /etc/openvpn/client.conf file on the RPi:

Code: Select all
dhcp-option DNS 127.0.0.1:5053

But it does not appear to be working.
If I run this nslookup command on my windows PC connected to the RPi Gateway, it still lists Google as the DNS server

Your RPi is a VPN client not a server so it does not push anything to the windows pc ..

NiMing8

Yes, I know the VPN Client is a Client, not a Server. I never said it pushed anything to my Windows PC. I asked if perhaps the OpenVPN Server could be pushing a DNS command to my VPN Client (The RPi).

TinCanTech

As usual .. check your logs ..

NiMing8

Does not appear to be anything significant in the openvpn.log file. No warnings, no errors. Shows nationalizations, links, completions, etc.

kptsky

I made it to work by changing cloudflared proxy listening address from 127.0.0.1 to local IP address - in my case 192.168.1.2

/etc/cloudflared/config.yml

proxy-dns: true
proxy-dns-upstream:
 - https://1.1.1.1/dns-query
 - https://1.0.0.1/dns-query
proxy-dns-address: 192.168.1.2

kptsky

The reason to do it is that you can't push

dhcp-option DNS 127.0.0.1:5053

to a client and expect that clients DNS request reach your server. The 127.0.0.1 IP address is always local one - you are asking your client to send DNS requests to itself.

In case if your DNS seats on the same server as Openvpn use the way described above. I have it working without any issues by pushing

dhcp-option DNS 192.168.1.2