DNS issue with OpenVPN on release 2.17.9

[wellloaded]

In release 2.17.9, I have set my own DNS server as my router runs Stubby and I trust it. So the DNS is set to Custom and the App Internal DNS set to OS Defaults

The Firewall is set to always on.

However: connecting via openvpn.conf the app complains the DNS server can't be reached and the custom is tweaked back to Auto. This is unwanted.

[wellloaded]

This 👆 is completely unwanted as my router DNS (aprart from running Stubby for outbound queries) it also resolves all the site-to-site VPN relevant domains which I run over tinc, hence it must be authoritative in my setup. Besides this, until I click OK manually on this GUI the VPN doesn't connect which is probably a poor UI design.

Bottom line, please allow me: what is the rationale behind adding such an option to then tell user this is not secure and automatically revert-back to auto? Perhaps you can transform this into a warning only instead and/or ask once, hopefully not at every connection.

[jaxu]

The Connected DNS setting is intended for you to set a DNS server that is reachable over the tunnel. This must be different from your regular OS resolver, because the firewall will block the OS resolver while the VPN is connected. This is because some applications may still try to use the OS resolver while connected to the VPN and this will leak your DNS requests outside the tunnel.

Specifically in your case, since your DNS server is on your LAN, it is guaranteed to bypass the VPN and leak. This is not a supported configuration since you are shooting yourself in the foot.

[wellloaded]

Ok, perhaps I should share a bit more of my setup.

I run Stubby and DNSSEC on my router plus (more importantly) I have site-to-site VPN resolution enabled on the very same router (freshtomato). Incidentally, the router also comes with an "intercept LAN DNS calls", so a direct client to Internet DNS query is not possible when that option is set.
So Windscribe installed on a Windows 11 LAN client (only) is unable to perform site-to-site DNS operations because it imposes itself and will not understand my locally defined domains.

I do believe you should give the (advanced) user the freedom instead, and perhaps just "warn" the user. If for whatever reason you are still really that vocal on this; I "could" compromise with a new Windscribe domain redirection function, e.g. allowing to specify locally the authoritative DNS server for a specific domain/s that will take precedence over a whatever imposed upstream resolver.

Thanks