DNS Leak with WireGuard on Deco BE95
I’m using WireGuard on my Deco BE95 with Surfshark VPN, and I’m seeing DNS leaks on tests, even though:
- WireGuard DNS is set to 194.169.169.169
- AllowedIPs = 0.0.0.0/0
- “Exclude private IPs” is off
- IPv6 is disabled
- Deco WAN IPv4 DNS is also set to 194.169.169.169
Testing the same WireGuard config directly on my iPhone does not leak DNS. This indicates the leak is caused by the BE95 firmware — system-level DNS queries (mesh, device discovery, or router services) are bypassing the VPN DNS.
I’ve rebooted, toggled WireGuard, and double-checked all settings — the leak persists.
Request: Can TP-Link provide a fix or guidance to ensure all DNS queries on the BE95 go through WireGuard, fully respecting the DNS setting?
Thanks!
@David-TP The BE95 isn't following DNS rules and is bypassing the VPN DNS, which is causing the leak. This can be shown on sites like dnsleak and even SurfSharks DNS leak checker. I don't have a screenshot of that at the moment while I'm at the office.