Is Mullvad VPN + DoT possible?

[distilled]

The documentation for configuring Mullvad in Merlin is quite clear, and works well, but it requires IPv6 to be configured as Native, and it doesn't seem like DoT DNS configuration settings will work. When IPv6 is disabled, the VPN tunnel does not connect, regardless of any DoT settings, IPv6 or otherwise. I have tinkered with this for several days to no profit, and could not find what I am looking for by searching around.

The documentation requires a particular set of DNS servers be configured in LAN / DHCP, however this is obviously for the client's resolution needs, and can be circumvented by manually configuring these on clients and disabling IPv6 on the clients. Without this manual configuration, the entire LAN must use Mullvad's IPv4 DNS servers and your ISP's IPv6 DNS, and doing this causes a failed DNS leak test.

The documentation as posted by Mullvad:

https://mullvad.net/en/help/asus-merlin-and-mullvad-vpn/

Does anyone have DoT + Mullvad configured in such a way as to pass leak tests? Some configuration of DNS Filter or selective routing, perhaps?

Thanks for any thoughts, hope everyone is having a productive new year so far.

 

[krgck]

Disable dns from vpn config and and set dnsfilter global to router, and restart router

 

[distilled]

Thank you. I don't know what you mean by "disable dns from vpn config" though. I am not using the Mullvad Merlin config instructions for DNS as it is, and I have tried using DNSFilter globally to router. I can't get love from that setup, the VPN Client setup in Merlin won't connect when I do that.

 

[Davidncali001]

I have Mullvad VPN and ran into a problem using Mullvad's instructions since I do not use IPV6. I added some lines to the config file to ignore the IPV6 and then I was able to use the VPN.

Take a look at my Mullvad VPN setup maybe it can help you out.

 

[distilled]

You, sir, are my HotD, my Hero of the Day. I owe you a beer. The VPN now connects without IPv6 being enabled as Native, and no DNS in LAN or WAN (other than DoT and Router).

To pass leak tests, I simply added the systems routing through the VPN to the DNS Filter using a custom DNS set to Mullvad's 10.8.0.1. I am adding some filter exclusions for phones to allow for private DoT ("Private DNS" in Android Pie) because I prefer a particular adblocking DoT server.

Now to figure out how to best route one of my IoT Guest WiFi through a separate VPN, and set up site-to-site between here and the other house, for security cameras. Cameras there are wired, so a simple VLAN is all that is necessary. Merlin is wonderful - most things a user could ever want to do is possible. Guest WiFi through AImesh and Wireguard would be great, but those aren't Merlin issues, they are Asus.

Anyway, thanks again mate, this helped enormously. For posterity, some pics are attached.