4

Can anyone help to configure routing in wireguard, please?

What i have: Linux server with installed wireguard, unbound dns, pihole, seafile. router keenetic speedster iptables is set to deny 80 port to all, and allow only for wireguard local users. for services, I made local domain names in pi-hole that point to 10.0.0.1 - the address of the server on the wireguard network

What i can do now: I can connect to wireguard network with wg interface, and if all traffic goes through wireguard, i can access fake domain names like fakedomain.com to access seafile or other resources.

What i need: I want to split the traffic so that I can access resources in the local wireguard network via vpn, and all others via the provider's network.

My configurations:

WG-server

[Interface]
Address = 10.0.0.1/24
ListenPort = 56777
PrivateKey = privateKey
MTU = 1450
PostUp = iptables -t mangle -A POSTROUTING -p tcp --tcp-flags SYN,RST SYN -o ens3 -j TCPMSS --clamp-mss-to-pmtu; iptables -t nat -A POSTROUTING -o ens3 -j MASQUERADE; iptables -A FORWARD -i %i -j ACCEPT; sysctl -q -w net.ipv4.ip_forward=1
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o ens3 -j MASQUERADE; iptables -t mangle -D POSTROUTING -p tcp --tcp-flags SYN,RST SYN -o ens3 -j TCPMSS --clamp-mss-to-pmtu; sysctl -q -w net.ipv4.ip_forward=0

[Peer]
PublicKey = publikKey
PresharedKey = presharedKey
AllowedIPs = 10.0.0.6/32

WG-client:

[Interface]
Address = 10.0.0.6/32
PrivateKey = privateKey
DNS = 10.0.0.1
[Peer]
PublicKey = publicKey
PresharedKey = presharedKey
AllowedIPs = 0.0.0.0/0
Endpoint = 188.119.112.63:56777
PersistentKeepalive = 25

Iptables:

-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-N f2b-sshd
-A INPUT -p tcp -m multiport --dports 22 -j f2b-sshd
-A INPUT -s 10.0.0.0/24 -p tcp -m tcp --dport 53 -m conntrack --ctstate NEW -j ACCEPT
-A INPUT -s 10.0.0.0/24 -p udp -m udp --dport 53 -m conntrack --ctstate NEW -j ACCEPT
-A INPUT -s 10.0.0.0/24 -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -s 10.0.0.0/24 -p tcp -m tcp --dport 5000 -j ACCEPT
-A INPUT -s 10.0.0.0/24 -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5000 -j DROP
-A INPUT -p tcp -m tcp --dport 80 -j DROP
-A INPUT -p tcp -m tcp --dport 443 -j DROP
-A FORWARD -i wg0 -j ACCEPT

for the test, I created a route to dnsleaktest.com 23.239.16.110 specified the wireguard subnet and as a result, during the test, the ip of my server is displayed everything is fine, when i go to another site to check the ip, the dynamic address given by the provider is displayed 178.140.42.115

When I write a route to my own server, through the internal ip - 10.0.0.1 - I can connect to it at this address, I can access resources, but only by the local ip and port. By the names that I gave on the pi-hole local DNS - I can not enter. So i need to configure dns routing, but i don't know how to make it correct.

I tried to change the wireguard config and specify the following settings:

PostUp = iptables -t nat -A PREROUTING -i ens3 -p udp -m udp --dport 53 -j DNAT --to-destination 10.0.0.1:53
PostUp = iptables -t nat -A PREROUTING -i ens3 -p tcp -m tcp --dport 53 -j DNAT --to-destination 10.0.0.1:53
PostDown = iptables -t nat -D PREROUTING -i ens3 -p udp -m udp --dport 53 -j DNAT --to-destination 10.0.0.1:53
PostDown = iptables -t nat -D PREROUTING -i ens3 -p tcp -m tcp --dport 53 -j DNAT --to-destination 10.0.0.1:53

In this case, everything starts to work as it should, but, for some reason, after 2-3 minutes I again get an error that DNS cannot be resolved, after I turn it off and on again, on the wireguard router, everything works again for 2 - 3 minutes and then turns off.

Config of router:

Main

Routes

5 Answers 5

3

In the Wireguard Client setting, you can specify a domain through which DNS server to go using PostUP:

[Interface]
Address = 10.0.0.1/24
PrivateKey = somePrivateKey
PostUp = resolvectl dns %i 10.0.0.1 10.0.0.2; resolvectl domain %i ~fakedomain.com

[Peer]
PublicKey = somePubliceKey
AllowedIPs = 0.0.0.0/0
Endpoint = 1.2.3.4:60000
2

I have added a remote DNS server in my configuration from Wireguard via adding "DNS = [DNS Server IP]" in the Wireguard Interface section.

i.e.:

[Interface]
PrivateKey = xxxxxxxxxxx/xxxxxxxxxxx=
Address = 192.168.10.20/32
DNS = 192.168.10.130
1
  • That require the resolvconf command which is not installed at least on ubuntu 22.04
    – KumZ
    Apr 15, 2023 at 11:01
1

I found a solution, it was stupid, it was enough to register the same dns 10.0.0.1 on the main connection as on the wireguard interface

1
  • What do you mean by "main connection" ? wg0.config on wireguard server side?
    – Askar
    Oct 22, 2023 at 11:40
0

I'm also trying to get DNS and http/https running over wireguard for 2 days in a similar setup as you and still failing with name resolution. What exactly do you mean by "register the same dns ... on the main connection as on the wireguard interface". Do you think it is enough to write the key-value pair "DNS = [WG Server IP]" in the interface section of the client and the server? I would be really happy about a hint.

Regards, Martin

1
0

In my case adding this line within the "[Interface]" group worked:

PostUp = resolvectl dns $(ip route show default| cut -d" " -f 5|head -n1) 1.1.1.1 8.8.8.8 1.0.0.1; resolvectl domain $(ip route show default| cut -d" " -f 5|head -n1) ~.;
1
  • Your answer could be improved with additional supporting information. Please edit to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers in the help center.
    – djdomi
    Apr 8 at 5:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .