How to protect a home router from ISP DNS leaks when a VPN is enabled?

FORCIBLY REDIRECT ALL PORT 53 REQUESTS TO A LOCAL ENCRYPTED SOCKET.

Even with an active secure channel, network devices may send name requests directly through ISP servers. Setting up DNS interception rules on the router closes this vulnerability for the entire local network.

The Cause of Hidden DNS Leaks

Connected devices' operating systems often retain backup ISP DNS addresses received via DHCP. If the tunnel gateway does not forcibly intercept traffic, browsers send some requests in plain text, allowing the ISP to record the list of visited domains.

How to Close the Leak at the Router Level

Enable DNS Rebind Protection and strict UDP port 53 interception in the firewall
Enter the local cryptographic DNS proxy address in the router's DHCP server settings
Block direct outgoing traffic to external public DNS servers bypassing the tunnel
Verify the absence of leaks via specialized DNS Leak diagnostic tests