Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 0.0.0.0 0.0.0.0 U 1002 0 0 eth0
<private-network-behind-vpn-gw> 0.0.0.0 255.0.0.0 U 0 0 0 tun0
<vpn-server-ip> 192.168.1.1 255.255.255.255 UGH 0 0 0 wlo1
169.254.0.0 0.0.0.0 255.255.0.0 U 0 0 0 eth0
192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 wlo1
There is no such compulsion. This depends on how and what that specific implementation want to achieve.
As in my current case you can see my ip payload for 10.0.0.0/8 is getting routed via tun0 (my vpn interface), Which is again encapsulated by another ip header destined to my vpn provider.
When my computer is connected to the vpn do DNS requests look like
they come from the vpn exit ip or from my real ip?
tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:x.x.x.x P-t-P:x.x.x.x Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1300 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:28 errors:0 dropped:0 overruns:0 carrier:0
RX bytes:0 (0.0 B) TX bytes:1893 (1.8 KB)
If packets for the ip address of DNS that is configured need to be routed via tun0 then your DNS request will have x.x.x.x as source in ip header so it will be encrypted till the vpn gateway else it will be having a source address of interface from where default gateway is reachable.