Some devices are upstreaming DNS queries to the Exit node

SUPPORT QUESTIONS
1

– Excuse my English, it’s not my mother tongue –

Hello,

I have a DNS issue with some devices on my Tailnet.

My setup:

  • Device 1 (Raspberry Pi with Pi-hole - Tailscale 1.20.4 - Exit node and home LAN subnet announced)
  • Device 2 (VPS Ubuntu 20.04 - Tailscale 1.20.4 - Exit node announced - NOT using any TS Exit node to outbound connections)
  • Device 3 (VPS Ubuntu 20.04 - Tailscale 1.20.4 - Exit node announced - NOT using any TS Exit node to outbound connections)
  • Device 4 (Android phone - Tailscale 1.20.2 - Using Device 1 as Exit node and subnets)
  • Device 5 (iPhone - Tailscale 1.20.1 - Using just the subnets announced by Device 1 (a NAS on LAN home), not using TS Exit node)
  • Device 6, 7… (Several devices, no Exit nodes or subnets use)

Others:

  • Using Device 1 as DNS resolver (Pi-hole) for the Tailnet (configured in Tailscale admin panel).
  • MagicDNS activated.

Issue:

Devices not using Exit node or subnets (Devices 2 & 3) are “leaking” some DNS requests to Device 1. Devices 2 & 3 were, previous to TS install, using the DNS setted in resolv.conf and I need to keep that scenario.

I would like that devices not using Device 1 as Exit node keep using their own DNS, not upstreaming DNS queries to Device 1 via tailscale0 interface.

I suppose that I would need to use Access control, but I have no clue where to start.

Thank you!!

2

If you want tailscale to not modify /etc/resolv.conf on Devices 2 and 3, you can use:

tailscale up --accept-dns=false

Magic DNS and Split DNS features won’t work in this case, but that may be acceptable.

1 Like
3

It works, thank you very much!!

Is it possible to do some like that on the Device 5? The iPhone is doing the same that the Linux VPSs, I can see some queries in the Pi-hole log, even not using the Raspberry exit node.

Thanks again.

4

The iOS app doesn’t have a similar accept-dns setting, at least not yet.

If you don’t want to use the Tailscale DNS features on any device, you can turn everything off at https://login.tailscale.com/admin/dns

1 Like
5

Thanks for your help.