How to Find and Fix DNS Leaks on Your Travel Router

You did everything right: the tunnel is up, your IP check shows home, and work tools are happy. But there's a quieter failure mode that can undo it all, a DNS leak. Learning to fix DNS leak travel router issues is essential, because leaked DNS queries broadcast your real location even when your IP address is perfectly hidden. Here's how to test properly, lock DNS to the tunnel, and make sure it stays fixed.

Running a Proper DNS Leak Test

A DNS leak test works by forcing your device to resolve a series of unique hostnames, then reporting which DNS servers actually performed the lookups. Here's the correct procedure, the before/after comparison is what makes it meaningful:

1. Baseline (VPN off): Connect your laptop directly to the hotel Wi-Fi (not through the router) and run a DNS leak test. Note which servers appear, typically the hotel's or local ISP's resolvers. This is what a leak looks like.
2. Through the tunnel (VPN on): Connect your laptop to your travel router's Wi-Fi with the WireGuard tunnel active. Run the same test.
3. Compare: With the tunnel up, none of the baseline servers should appear. Every resolver listed should be one you expect on the tunnel side, your home router's DNS, or the public resolver you configured.

What "good" looks like: The test shows only your home-side DNS servers (or your chosen resolver), and the geolocation of those servers matches your home country.

What "leaking" looks like: The hotel's DNS, the local ISP's DNS, or a mix of tunnel and local servers appears. Even one local resolver in the list is a leak, DNS is all-or-nothing for location privacy.

Test twice: Run the test once right after connecting and once more after 10–15 minutes. Some leaks only appear after DHCP renewals or when the device falls back to a secondary resolver.

Locking DNS to the Tunnel on GL.iNet Routers

On GL.iNet firmware (and similar OpenWrt-based travel routers), DNS behavior is controlled in a couple of places. Here's the lockdown sequence:

1. Set DNS to resolve through the tunnel

In the admin panel, go to the DNS settings (often under Network → DNS or within the VPN client settings):

• Set custom DNS servers to your home router's tunnel IP (e.g., 10.0.0.1), this keeps all resolution inside your home network, the most private option.
• Alternatively, use a trusted public resolver (Quad9, Cloudflare, etc.), but ensure it's reached through the tunnel, not directly.
• Disable any option like "allow custom DNS from the upstream network" or DNS passthrough from the hotel's DHCP, that's the hole leaks crawl through.

2. Enable the VPN kill switch

In VPN settings, turn on the kill switch ("block non-VPN traffic"). This ensures that if the tunnel drops, DNS has no path out at all, rather than silently falling back to the hotel's resolver.

3. Override per-device DNS if needed

Some devices (notably phones and some laptops) have hardcoded DNS or "private DNS" features (Android's Private DNS, iCloud Private Relay) that bypass the router's DNS entirely:

• On Android: set Private DNS to "Off" when you want the router's DNS to apply, or to a hostname you control.
• In browsers: disable DNS-over-HTTPS fallback to the browser vendor's resolver if you want all DNS on the tunnel, or accept that DoH to a resolver you chose is fine as long as it's your choice and geolocated correctly.
• iCloud Private Relay routes Safari traffic outside the VPN, disable it on work devices while traveling if location consistency matters.

4. Flush and re-test

After changing DNS settings, flush DNS caches (reconnect the Wi-Fi or reboot the router), then re-run the leak test. DNS results can be cached, and a stale "pass" is worse than no test at all.

Re-Testing and Monitoring for Regressions

DNS leaks love to come back. Build these habits:

• Re-test after every firmware update, updates can reset DNS settings to defaults.
• Re-test when you change networks, a new hotel's captive portal or aggressive DHCP can alter behavior.
• Re-test after touching VPN profiles, switching between WireGuard and OpenVPN profiles can carry different DNS settings.
• Spot-check monthly even if nothing changed, it takes 30 seconds and catches silent regressions.

Keep a note of what your "good" test result looks like (which resolvers, which country) so you can spot a changed result instantly.

Frequently Asked Questions

Need help setting this up?

DNS leaks are sneaky, and a second pair of expert eyes catches what checklists miss. Our VPN audit reviews your whole setup for leaks and weak spots: https://homeipvpn.com.