Guide: Using OpenVPN + NextDNS together on Mac & iOS

Tony Z Option 3 is really just using Viscosity (configured with NextDNS) and the NextDNS app together. If one connection drops, there will be a fallback from the other app. This worked when I tested it, the NextDNS app seems to overrule the VPN DNS from Viscosity. You could try this even without configuring Viscosity, which is option 1.

Option 2 depends on using the correct settings. You mentioned having to refresh a linked IP and that indicates something in your setup may not be correct because there is no need for a linked IP with this option. Are you maybe using the IPv4 endpoints? This would necessitate linking your IP. If you are using the IPv6 endpoints, as in the screenshot, no linked IP is necessary.

The IPv6 endpoints you enter in Viscosity should look like this: 

2a07:a8c0::5b:XXXX, 2a07:a8c1::5b:XXXX

Use the numbers from your profile instead of XXXX, they are your configuration ID. 

Also make sure the settings framed in red are correct:

Tony Z You're welcome. 

If your Viscosity setup has the IPv6 endpoints as in the screenshot, Viscosity should work on its own with NextDNS (option 2), I would make sure this is the case before using both apps. Feel free to let me know if this works. If not, Viscosity might have changed something or there is some hidden issue with the setup. I don't have Viscosity installed at the moment, so can't check again. 

"For reference, I have the NextDNS MacOS application active while having Viscosity active and sometimes it simply won't use NextDNS unless I disable and reenable it via the desktop application. Althought its a bit annoying, and I'm happy that it finally works, I'm wondering if you've ever had this happen to you as well and if there is a remedy for it"

So you are using option 3. There, if the connection drops, it shouldn't matter because option 2 has the NextDNS IPv6 DNS settings. So I would make sure again that option 2 is actually working, this would be all you need really.

It seems likely that a reconnect of the VPN would get stuck with its own DNS settings and if they are not the NextDNS IPv6 endpoints in your case (for a currently unknown reason), this would necessitate the NextDNS app disable/reenable you describe. I have seen this when using third party VPN apps with the NextDNS app, they would either not work together, or NextDNS would have to be the last one to be activated in the chain. In my tests, this didn't apply to Viscosity or Passepartout however, only the official clients, probably due to them using firewall rules to prevent DNS leaks.

"Also, do you have any ideas on how we would be able to use Wireguard + NextDNS together? I've been trying to look for solutions for so long and haven't found anything."

There are some ways to change config files, but they all seemed like too much hassle. I didn't bother with this.

Some VPN providers can use custom DNS though. I know 1 provider that works, Mullvad. You can put your IPv6 endpoints in the custom DNS setting and it will use NextDNS with an active VPN Wireguard connection. Tested on macOS and iOS. Their multi-hop feature won't work with custom DNS though. 

Other providers I've tested:

- OVPN has a custom DNS setting, but the NextDNS IPv6 endpoints weren't working, only IPv4 (which sucks because of the need to link the IP constantly.

- Private Internet Access, same issue as with OVPN. 

- Proton VPN, not sure about why it didn't work any more.

I'd use Mullvad if I wanted to use NextDNS with a Wireguard VPN connection, they were the fastest of the tested ones as well (600 Mbps instead of 100–150 Mbps download).

Tony Z No problem.

I can see no issues with the Mullvad config, but I'll post some screenshots of mine, which works. I only ever used the IPv6 endpoints. I have set the Wireguard settings to automatic and am on the beta program (which you could try), but it always worked for me, even when I wasn't using the betas.

Maybe it's not an issue with the apps (Viscosity or Mullvad). Maybe something is blocking IPv6 connections for you, like your router? 

You could try on your phone with a mobile data connection and the IPv6 custom DNS configured in the Mullvad app, which would exclude the router as a factor.

Tony Z Hey Tony,

Given that the NextDNS profile and the NextDNS app use practically the same underlying technology, it's very similar to the setup of using the NextDNS app and VPN app together. You also might get some unexpected behavior like this, just was when you had to disable and reenable the NextDNS app. 

VPN apps usually take precedence and this might be fixed by the provider since it's technically a DNS leak. Some provider apps with integrated DNS leak checks (like OVPN's app) will also put a huge strain on the CPU because they freak out about the "wrong" DNS. 

This is also just a band-aid that gets around the IPv6 issue you have. In any case, the fact that multiple apps (Viscosity, Mullvad) don't work with the IPv6 endpoints, points to an IPv6 issue with your local network / router, client devices or even ISP. 

You could try other IPv6 endpoints in Mullvad, like Cloudlfare's (2606:4700:4700::1111, 2606:4700:4700::1001).

I'm glad you found an option that works and I'd say go for it as long as it does, but it's not an ideal setup and I myself would look into the IPv6 issue further. 

Tony Z That's fine. As expected, the ISP DNS is running on IPv4. 

When using Mullvad with the NextDNS IPv6 endpoints, it says IPv6 for me, so this page can be used as a quick way to check this. 

Things you could try to see if IPv6 works at all:

- Mullvad with custom DNS on your phone (I can only speak for iOS working) on your home network

- Mullvad with custom DNS on your phone with a data connection (not on your home network), to see if the router is a factor

- Changing the Mac DNS locally without running the Mullvad app, Private Relay, NextDNS app or NextDNS profile (inactivate it temporarily)*

*You can do this in System Preferences > Network > Wi-Fi > Advanced > DNS, as seen in the screenshot attached. Don't forget to hit apply in the end. 

Tony Z I see. Your Mac seems to be the issue then. Running the beta might explain it. It works on Monterey.

Tony Z No problem, hopefully this will be resolved soon. You could mention it on Mullvad's Github, but since the IPv6 endpoints in macOS network settings didn't work either, it looks like sending Apple feedback might be the best option.

Tony Z Ok, this really seems like an issue with your Mac in that case. Router / network should be fine, since it works on your phone on Wi-Fi.