DNS Resolver redirect over OpenVPN with failover gateway group

[netnewb2]

I have an edge case here. Maybe someone tried this before.

I'm trying to forward most DNS queries over an OpenVPN (PIA) connection, with failover to WAN. When the VPN is down, I want queries to go out through default WAN.

So far, the VPN connection is working fine. I can route traffic from LAN hosts over the VPN through NAT and firewall rules with a Gateway Group which has VPN as primary and WAN as secondary.

My problem is with the DNS Resolver. As far as I can tell, I have to use Floating Rules because the DNS Resolver falls in the "Filter traffic from the firewall itself" category. But it doesn't seem to work. I see outgoing traffic in the logs, but hosts are not resolved.

The floating rule that I tried:
Action: Pass
Interface: WAN
Direction: out
Proto: TCP/UDP
Source: any
Destination: any
Destination Port: 853
Gateway: PIA gateway group

Some other settings:

• DNS resolver set to forwarding mode, enabled DNSSEC, SSL/TLS, Register DHCP static mappings in the DNS Resolver
• Gateway Group with PIA as Tier 1 and WAN as Tier 2
• NAT Outbound Hybrid. Interface: PIA, Adress: Interface Address
• multi-wan setup
• setup DNS Servers for each gateway in General Setup