DNS Settings on a VPN Router Explained

When you put a VPN on a router, most people think about the tunnel itself: which device is connecting, which button to press and whether the connection light turns green. DNS gets far less attention, yet it is the setting that decides whether your phone, laptop and television quietly keep telling your home internet provider which websites they look up. A tunnel can be up and healthy while DNS still goes around it.

This article is about the vpn router dns question only. It explains the places a DNS address can be stored, which one wins, how to point DNS the right way, how to keep local names working, and how to test the result. It assumes the VPN is already running on your router. If you have not done that part yet, start with the Help Center guide on setting up a VPN on a router, and if the word DNS is new, read how DNS works first.

Why DNS needs its own attention on a router

DNS is the phone book of the internet. Before a device can open a site, it asks a resolver to turn a name into a numeric address. These questions are usually small and unencrypted, and they reveal every site you visit even when the pages themselves use HTTPS.

On a single phone with a VPN app, the app normally takes care of this: it tells the operating system to send DNS questions into the tunnel. On a router, the situation is more complicated for three reasons.

• The router has two different jobs. It acts as the gateway for every device at home, and it acts as the VPN client. Each job can have its own DNS setting.
• The devices behind the router do not read the VPN settings. They simply accept whatever the router offers through DHCP, the service that hands out addresses when a device joins the network.
• Some devices ignore the router completely and use a DNS address they were configured with, or an encrypted DNS feature built into the browser or system.

The result is that a router VPN can give a false sense of completeness. Web traffic goes through the tunnel, but a smart television keeps asking the internet provider's resolver for names. That is the typical DNS leak, and on a router it affects the whole household.

The four places a DNS address can live

Before you change anything, find out which of these four layers your router uses. A setting in one layer is useless if a stronger layer overrides it.

Layer	Where you find it	Who it affects	Typical value
Router WAN or internet DNS	Internet or WAN page	The router itself, for its own lookups	Address from your provider, set automatically
VPN client DNS	VPN client page or the imported VPN profile	Lookups made through the tunnel	Address supplied by the VPN side
DHCP DNS	LAN or DHCP server page	Every device that joins the network	Usually the router's own address, such as 192.168.1.1
Device DNS	Wi-Fi settings on the phone or computer, browser setting	One device only	Automatic, or a manual address

Read the table from the bottom up when you troubleshoot. A manual device setting beats DHCP. DHCP decides what most devices use. The router's own forwarding decides where the router sends the question next. The WAN setting only matters if nothing else in the chain redirects the queries.

What "the router's own address" means

Most home routers give out their own private address, for example 192.168.1.1, as the DNS server. That sounds as though the router answers every question itself, but it is really a forwarder. It receives the question from your phone and passes it to an upstream resolver. Which upstream resolver it uses is the part you need to control. Private addresses of this kind are defined in RFC 1918 and are never reachable from outside your home.

What you want to end up with

The goal can be described in one sentence: every device asks the router, and the router asks a resolver through the tunnel. In practice there are three acceptable setups, with different trade-offs.

1. Router forwards to the VPN side's DNS. Devices keep the default DHCP setting. The router forwards questions to the DNS address supplied by the VPN side, and the forwarding path goes through the tunnel. This is the simplest and the most common choice.
2. Router forwards to a public resolver through the tunnel. You choose a resolver yourself, but the routing rules must send traffic to that resolver through the VPN interface. If the routing is wrong, you get a leak even though the address looks fine.
3. Router runs a local resolver that talks to an encrypted upstream. Advanced routers can run a small resolver and use encrypted DNS upstream. This is more work, and it is an extra layer rather than a replacement for the tunnel. See DNS over HTTPS vs VPN for how the two relate.

If you are unsure, choose the first setup. A less exotic configuration is easier to test and easier to undo.

A careful procedure for changing router DNS

Menu names differ between router makers and firmware versions, so the steps below describe the idea, not exact buttons. Take a note of every value before you change it, so you can go back.

1. Write down the current state. Open the WAN, LAN or DHCP and VPN client pages. Record the DNS fields on each. Take screenshots if the router allows it.
2. Run a baseline test. From a laptop on the router's network, run a DNS leak test with the VPN switched on at the router. Save the list of resolvers it shows. This is your "before" picture.
3. Look for an option that says to use the VPN's DNS. Many VPN client pages have a setting that accepts the DNS addresses supplied by the VPN side. Turn it on.
4. Check the DHCP page. Make sure the DNS field handed to devices is either empty (meaning the router itself) or the router's own address. If it contains your provider's DNS address, devices will go around the tunnel.
5. Disable any extra DNS features you did not choose. Some routers ship with filtering services or "smart" DNS settings. These may override the new setting.
6. Save and restart the VPN service. Some routers apply DNS changes only after the tunnel restarts. A full router restart is a last resort, but it is fine.
7. Renew the lease on a test device. Disconnect the device from Wi-Fi and reconnect, so it picks up the new DHCP information. On a computer, you can also flush the local DNS cache.
8. Run the leak test again and compare it with the baseline from step 2.

Do not forget IPv6

Many home connections now give devices both IPv4 and IPv6 addresses. The router may hand out IPv6 DNS information separately from IPv4 DHCP settings. If the VPN carries only IPv4, an IPv6 DNS server from your provider can quietly remain in use. Check whether your router has a separate IPv6 DNS field, and if the VPN does not support IPv6, turn IPv6 off on the LAN side or make sure the router does not advertise a provider resolver. The background is in what an IP leak is.

Keeping local names working

A common surprise after changing DNS is that things inside the house stop working. The printer disappears, the network storage no longer opens by name, or the router's own admin page no longer loads by its friendly name. This happens because those names exist only on your router. An outside resolver has never heard of them, and if the router sends every question into the tunnel, the answer is "no such name".

There are three practical ways to keep both worlds working.

• Let the router be the first resolver. Keep the router's address as the DNS server given out by DHCP. The router answers local names itself and forwards all others. This keeps things working in almost every case.
• Use fixed addresses for key devices. Give the printer and storage a reserved address in the DHCP page and type the address instead of a name.
• Use a domain rule. Some firmware lets you say that names ending in a certain suffix go to a local resolver and everything else goes upstream. This idea is similar to what split DNS does on a computer.

If something local fails only after you changed the DNS, the cause is almost always that local names are being sent to the wrong place. Put the router back as the first resolver and test again.

Three home scenarios

A family with a mix of devices. Aroon has two phones, a laptop, a television and a games console connected to a router with a VPN. She sets the VPN client to use the DNS from the VPN side, leaves DHCP on the default, and runs a leak test on a laptop. The laptop looks fine, but the television still shows the provider's resolver. The television has a manual DNS address in its network settings that was typed years ago. She changes it to automatic and the leak disappears.

A home office with a shared printer. Peter works from a spare room and prints from his laptop to a network printer by name. After he changes DNS on the router, the printer is no longer found. He puts the router's own address back as the DHCP DNS server and keeps the VPN's DNS as the router's upstream. The printer returns, and the leak test shows only the VPN side's resolvers.

A rented flat with a landlord's router. Mei cannot log in to the router's admin page, so she cannot change any of this. Instead she installs the VPN app on her own laptop and phone, where the app handles DNS inside the device. This is the practical alternative, and the trade-offs are covered in VPN router vs VPN app.

Testing the result properly

A single test is not enough, because different devices behave differently. Use a short routine.

1. Test one wired computer, if you have one, because it shows the router's behaviour without Wi-Fi quirks.
2. Test one phone on Wi-Fi with its mobile data switched off, so you know the phone is using the router.
3. Test a television or console by opening an app and checking the router's client list or DNS log, if the firmware offers one.
4. Repeat after a router restart, because some settings are not saved the way they look.
5. Repeat when the VPN is disconnected on purpose. This shows what the network does when the tunnel drops. If the router quietly falls back to your provider's DNS, that is a risk to understand, not a surprise to meet later.

Remember that a clean DNS result tells you only about DNS. Check that your public address has changed as well, for example with the steps in how to check if your VPN is working.

Common mistakes and limits

• Typing a public resolver in the DHCP page and thinking that is private. Devices then bypass the router's forwarder, and whether their questions enter the tunnel depends on routing, not on the address.
• Setting DNS only on the WAN page. That affects the router's own lookups, not what your devices ask.
• Forgetting devices with fixed DNS. Old streaming boxes, consoles and some smart speakers may have hard-coded resolvers that no router setting can change.
• Ignoring browser-level encrypted DNS. A browser that uses its own encrypted resolver bypasses the router's choice. That is allowed and sometimes useful, but you should know it exists.
• Blocking port 53 without testing. Some people add a firewall rule to force all DNS through the router. It can work well, but test it, because it also breaks devices that depend on their own setting.
• Expecting DNS settings to give anonymity. DNS is one of several signals. Accounts, cookies and apps still identify you; see what a VPN cannot protect you from.

There are also hardware limits. A budget router may offer only a single DNS field, may not let the VPN client push its own DNS address, or may lack a firewall page. In that case your realistic options are to run the VPN in the app on each important device, or to replace the router with a model whose firmware gives you the controls you need. Whichever route you take, note that a router VPN applies to every device at once, so a mistake also applies to every device at once.

Summary

On a VPN router, DNS can live in four places: the WAN page, the VPN client page, the DHCP page and each device. The one that wins is usually the setting closest to the device. Aim for a simple chain in which devices ask the router and the router asks a resolver through the tunnel, keep the router as the first resolver so local names still work, deal with IPv6 so it does not become the hole, and test several kinds of device before and after the change.

If you prefer to protect individual devices instead of the whole house, you can look at the pricing page and see how a prepaid pass fits.