Big dns leak security problem

hello, I am looking to remedy a dns leak problem, under qubes os, I have this configuration

sysnet >
pi-hole > sys-net >
sys-vpn > sys-firewall >
Pi-hole-clone > vpn >
chocolatvm > Pihole-clone

my virtual pi-hole and pi-hole-clone machine is based on a tutorial, installing pi-hole with nextdns.

on sys-vpn i have protonvpn

when I pass a dns leak test on my chokolatvm machine, I have a dns leak, I am trying to solve this problem, since I do not have much knowledge in the field, I hope to have a solution or another proposal so that my chocolatvm machine goes through vpn and pihole, without creating a pi-hole-clone machine

You chained all these VMs? Why sys-vpn is before sys-firewall? Does switching their positions makes a difference?

yes if I change position either, my chocolatvm does not go through the vpn, or it is not filtered by pihole, so as it was proposed to me, I had to clone pihole and place before firewall

What’s the purpose of the pi-hole’s here? If you’re trying to use a firewall before a VPN, why not this setup:

vm > dns-firewall > vpn > sys-net

Also, does your vpn have a killswitch? It’s possible to have DNS and IP leaks if the VPN doesn’t have a killswitch that prevents all outbound connections except to the VPN.

and where should I put my pihole machine?
if I do vm > dns-firewall > vpn > sys-net my virtual machine will go through the vpn, but the advertisements will not be blocked by pihole

dns-firewall would replace the piholes in this scenario and block ad domains before the requests are sent out through the VPN qube via a DNS blocklist. Maybe I’m misunderstanding, what applications are you trying to block ads from?

could you tell me how to replace pihole with dns firewall??

I have my chocolate virtual machine, I want that when I connect to my chocolatvm, the advertisements will be blocked, that’s why I installed pihole, and it works but to have a configuration so that pihole works and vpn also works, and for that both work, I created a pihole clone, which I had to place in this configuration

sysnet >
pi-hole > sys-net >
sys-vpn > sys-firewall >
Pi-hole-clone > vpn >
chocolatvm > Pihole-clone

and it works, my chocolatvm vpn works with pihole,
but i found when i did a dnsleak test i found that i have a dns leak