Eliminating DNS leaks for multi-WAN

Question

Hi all 
 Wondering if theres a way to isolate DNS for individual WAN interfaces? I expect this will require some real trickery to get right, hopefully some has pulled it off; 
 1st Prize is to have DNS lookups for each WAN interface redirected to a specific DNS server 
 Failing that a way to limit DNS lookups on a single interface to only one allowed DNS server; 
 
 Effectively I have three WAN interfaces, one of them directs traffic through a VPN service, which is working fine; 
 I have set up some network groups so any devices in my 'Systems using VPN' group break out via the VPN tunnel, the issue is that DNS lookups from those devices are still using the UTM DNS servers, I would like to force those to use a specific DNS server only; 
 
 Any ideas?

apijnappels · Answer

You need multiple configuration changes; for the "Systems using VPN" group to use a specific DNS server, easiest solution might be to make a DNAT rule: Traffic from "Systems using VPN" going to "Internet" (or maybe even any) using service "DNS" DNAT to ==> Desired DNS server. 
 Your first question to have specific DNS servers reachable over specific WAN connections, you can configure "Interfaces and routing => Interfaces => Multipath rules". There you can configure that traffic going to a specific DNS server should use a specific WAN interface.