Sure I found little information to install a client DNS VPN through Pi-Hole.
My conf is a Pi3-B+ with Raspbian last update and upgrade My_IP_Pi:X.X.X.X name IP_A for this exemple
I Install Pi-Hole v5.0 configure with DHCP server.
After I install my Client VPN with default tunnel mode (sorry not ExpressVPN) and configure it with systemctl as service.
At this point in the process, all is OK, no firewall, no IP Forwarding, just routing table do the Job.
Pi3-B+: ( Pi3-B+ : eth0 interface / Ethernet Port ) ( VPN Tunnel : tun0 )
My Gateway/Box : 192.168.1.1
ip route show
0.0.0.0/1 via X.X.X.1 dev tun0
default via 192.168.1.1 dev eth0 src IP_A metric 202
I configure my interface Client with DHCP auto for IP and set DNS Pi to IP_A
The final test
Open Browser in Client
On the Pi3-B+
open 2 terminal.
For the first term I check this interface eth0 with :
sudo tcpdump -i eth0 udp port 53
For the second I check VPN :
sudo tcpdump -i tun0 udp port 53
On the client Browser open a link Page and check if you see a "similar" traffic in eth0 and tun0, for me I think is good. Traffic DNS go to eth0, after on the VPN. tcpdump capture all traffic for DNS, I recommend
to test with one Client.
Another Command to check DNS with or without VPN
Install iputils-tracepath and check exemple
Check IP in Pi3-B+:
Use command route for routing table
My Pi-hole settings:
Network interface: eth0 (so that it also works if we aren’t connected through the VPN)
Enable: DNS > Never forward non-FQDNs
Enable: DNS > Never forward reverse lookups for private IP ranges
Enable: DNS > Use DNSSEC (disable for test with tcpdump)
Select: DNS > Listen only on interface eth0. Local Mode -> Client VPN ;).
Allows only queries from devices that are at most one hop away.
My Other Settings
Disable IPV6 in Pi-Hole
Comment IPV6 loopback in /etc/hosts
#::1 localhost ip6-localhost ip6-loopback
Disable IPV6 in my client config Ethernet