[Android, Mullvad DNS] Various bizarre behaviour with Mullvad DNS resolvers

[mchar7]

What is the issue?

I am using Tailscale on my Android device with a Mullvad exit node. I tried using each of the different IP addresses of Mullvad's public DNS resolvers in the Tailscale DNS admin page with override local DNS selected. I have noticed some issues with DNS not resolving, adblock not working, and unexpected DNS server endpoints depending on whether I enable the exit node or not, and which DNS server I use.

Expectation:

• Without exit node: DNS queries are resolved and ads get blocked depending on the selected server. DNS queries are resolved on the public DNS server.
• With exit node: DNS queries are resolved and ads get blocked depending on the selected server. DNS queries are resolved internally on the exit node server, not from one of the public DNS servers (which add another hop if routed over the exit node and/or may be vary far away).

What happened:

Here is a summary of what happened with different DNS servers and exit node settings:

Exit node OFF

Server	IPv4 address	DNS resolves	Ads blocked
main	194.242.2.2	✔️	—
adblock	194.242.2.3	✔️	✔️
base extended all	194.242.2.4 194.242.2.5 194.242.2.9	❌	—

Exit node ON

Server	IPv4 address	DNS resolves	Ads blocked	DNS server
main	194.242.2.2	✔️	—	public
adblock	194.242.2.3	✔️	✔️	public
base extended all	194.242.2.4 194.242.2.5 194.242.2.9	✔️	❌	internal

Steps to reproduce

1. Go to the Tailscale admin DNS page, insert the IPv4 or IPv6 address of one of Mullvad's public DNS resolvers.
2. Enable local DNS override.
3. Connect to Tailscale network on Android client.
4. Using different Mullvad DNS servers and exit node off/on:
   Test if DNS resolves, check used DNS server (https://mullvad.net/en/check) and if adblocking is effective.

Are there any recent changes that introduced the issue?

No response

OS

Android

OS version

13

Tailscale version

1.48.2

Other software

No response

Bug report

No response

[arunsathiya]

DNS queries are resolved internally on the exit node server

I am a bit curious about this behavior. As far as I know, without configuring a override, exit node-provisioned DNS isn't working yet: #9284

So when you say DNS queries are resolved internally on the exit node, I am wondering why that is happening for you. 🤔

I tested that flow but they're still leaked, as expected at this time:

[mchar7]

I just did a sanity check and confirmed the behaviour of DNS resolving at the exit node when using one of the .4, .5 or .9 nameservers.

192.242.2.4 set in DNS settings, override enabled.

DNS server is showing as internal to the selected exit node: