WireGuard /w ProtonVPN -> local DNS resolving

[opn_minded]

Hi,

I've set up a working WG tunnel to ProtonVPN, but I am facing DNS leaks. This is due to the fact that I need to use unbound to resolve a local domain (.localhub), obv. because Proton's DNS server can't do that.

I have two question in that regard;

- Can someone please tell me why clients in my network, that use this WG tunnel have issues browsing e.g. with Reddit?
As an example: I can't access Reddit due to "security issues" -> Reddit tells me I need to login to do anything. When I start the native ProtonVPN client on my PC and connect to any ProtonVPN server, it's working fine without any issues

- What do I need to do, so that opnSense can distinguish between a local DNS request (basically *.localhub) and an outbound DNS request?
assuming this would prevent DNS leaks and prevent occasional "browsing issues" like mentioned with Reddit

Thanks for your time, have a great day!