Cannot resolve DNS while connected to WireGuard VPN

Installing and Using OpenWrt
1

I currently have a WireGuard server running at home. When I connect to it from outside of my lan, I can access all devices on my home network via IP but cannot resolve DNS. I need a help to solve this, but It was working fine until Wednesday when it had some issues with my network/router.

Some configs files:

ubus call system board

root@horus:~# ubus call system board
{
        "kernel": "5.15.162",
        "hostname": "horus",
        "system": "Intel(R) Celeron(R) CPU  N2808  @ 1.58GHz",
        "model": "ULTRATOP ULTRATOP Liva",
        "board_name": "ultratop-ultratop-liva",
        "rootfs_type": "ext4",
        "release": {
                "distribution": "OpenWrt",
                "version": "23.05.4",
                "revision": "r24012-d8dd03c46f",
                "target": "x86/64",
                "description": "OpenWrt 23.05.4 r24012-d8dd03c46f"
        }
}
root@horus:~#

uci export network

root@horus:~# uci export network
package network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd0b:4bce:7eb5::/48'

config interface 'lan'
        option device 'eth1'
        option proto 'static'
        list ipaddr '192.168.15.1/26'
        option ip6assign '64'

config interface 'wan'
        option proto 'pppoe'
        option device 'eth0'
        option username 'cliente@cliente'
        option password 'cliente'
        option ipv6 'auto'

config interface 'onu_vsol'
        option proto 'static'
        option device 'eth0'
        list ipaddr '192.168.1.2/30'
        option ip6assign '64'

config interface 'wireguard'
        option proto 'wireguard'
        option private_key 'edited'
        option listen_port '1195'
        option ip6assign '64'
        list addresses '192.168.17.1/24'
        list addresses 'fd00:17::1/64'

config wireguard_wireguard
        option description 'Cel_POCOX3PRO_RR'
        option public_key 'edited01'
        option private_key 'wdited02'
        list allowed_ips '192.168.17.2/32'
        option persistent_keepalive '25'

root@horus:~#

uci export dhcp

root@horus:~# uci export network
package network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd0b:4bce:7eb5::/48'

config interface 'lan'
        option device 'eth1'
        option proto 'static'
        list ipaddr '192.168.15.1/26'
        option ip6assign '64'
root@horus:~# uci export dhcp
package dhcp

config dhcp 'lan'
        option interface 'lan'
        option start '42'
        option limit '20'
        option leasetime '1h'
        option dhcpv4 'server'
        option force '1'
        list dhcp_option '44,192.168.15.1/26'
        option ra_useleasetime '1'
        option ra 'server'
        option ra_lifetime '4500'
        option dhcpv6 'server'
        list ra_flags 'managed-config'
        list ra_flags 'other-config'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

config dnsmasq 'horus'
        option authoritative '1'
        option local '/hsh/'
        option domain 'hsh'
        option expandhosts '1'
        option rebind_protection '1'
        option localservice '1'
        option sequential_ip '1'
        option allservers '1'
        option domainneeded '1'
        option rebind_localhost '1'
        option localise_queries '1'
        option dhcpleasemax '20'
        option dnsforwardmax '300'
        option cachesize '5000'
        option readethers '1'
        option confdir '/tmp/dnsmasq.d'
        list server '127.0.0.1#5453'
        list server '0::1#5453'
        list server '/mask.icloud.com/'
        list server '/mask-h2.icloud.com/'
        list server '/use-application-dns.net/'
        list server '127.0.0.1#5053'
        list server '127.0.0.1#5054'
        option noresolv '1'
        list interface 'lan'
        option doh_backup_noresolv '1'
        list doh_backup_server '127.0.0.1#5453'
        list doh_backup_server '0::1#5453'
        list doh_server '127.0.0.1#5053'
        list doh_server '127.0.0.1#5054'
        list address '/horus.hsh/192.168.15.1'

config domain
        option name 'onu'
        option ip '192.168.1.1'

config domain
        option name 'horus'
        option ip '192.168.15.1'

config domain
        option name 'anubis'
        option ip '192.168.15.2'

config domain
        option name 'osiris'
        option ip '192.168.15.3'

config domain
        option name 'toth'
        option ip '192.168.15.4'

config host
        option name 'NintendoSwitch'
        option ip '192.168.15.30'
        list tag 'VideoGame'
        option leasetime 'infinite'
        list mac '20:0B:CF:E4:75:54'

config host
        option name 'an4'
        option ip '192.168.15.5'
        option leasetime 'infinite'
        list tag 'DecoderTVaCabo'
        list mac 'B6:D4:67:CD:CD:B2'
root@horus:~# uci export dhcp
package dhcp

config dhcp 'lan'
        option interface 'lan'
        option start '42'
        option limit '20'
        option leasetime '1h'
        option dhcpv4 'server'
        option force '1'
        list dhcp_option '44,192.168.15.1/26'
        option ra_useleasetime '1'
        option ra 'server'
        option ra_lifetime '4500'
        option dhcpv6 'server'
        list ra_flags 'managed-config'
        list ra_flags 'other-config'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

config dnsmasq 'horus'
        option authoritative '1'
        option local '/hsh/'
        option domain 'hsh'
        option expandhosts '1'
        option rebind_protection '1'
        option localservice '1'
        option sequential_ip '1'
        option allservers '1'
        option domainneeded '1'
        option rebind_localhost '1'
        option localise_queries '1'
        option dhcpleasemax '20'
        option dnsforwardmax '300'
        option cachesize '5000'
        option readethers '1'
        option confdir '/tmp/dnsmasq.d'
        list server '127.0.0.1#5453'
        list server '0::1#5453'
        list server '/mask.icloud.com/'
        list server '/mask-h2.icloud.com/'
        list server '/use-application-dns.net/'
        list server '127.0.0.1#5053'
        list server '127.0.0.1#5054'
        option noresolv '1'
        list interface 'lan'
        option doh_backup_noresolv '1'
        list doh_backup_server '127.0.0.1#5453'
        list doh_backup_server '0::1#5453'
        list doh_server '127.0.0.1#5053'
        list doh_server '127.0.0.1#5054'
        list address '/horus.hsh/192.168.15.1'

config domain
        option name 'onu'
        option ip '192.168.1.1'

config domain
        option name 'horus'
        option ip '192.168.15.1'

config domain
        option name 'anubis'
        option ip '192.168.15.2'

config domain
        option name 'osiris'
        option ip '192.168.15.3'

config domain
        option name 'toth'
        option ip '192.168.15.4'

config host
        option name 'NintendoSwitch'
        option ip '192.168.15.30'
        list tag 'VideoGame'
        option leasetime 'infinite'
        list mac '20:0B:CF:E4:75:54'

config host
        option name 'an4'
        option ip '192.168.15.5'
        option leasetime 'infinite'
        list tag 'DecoderTVaCabo'
        list mac 'B6:D4:67:CD:CD:B2'

config domain
        option name 'an4'
        option ip '192.168.15.5'

config host
        option name 'tesla'
        option dns '1'
        list mac '40:8D:5C:78:51:51'
        option ip '192.168.15.10'
        option leasetime 'infinite'
        option duid '000100012dd84203408d5c785151'
        list tag 'admin_pc'
        option instance '0'
        option broadcast '1'

config host
        option ip '192.168.15.61'
        option mac '60:21:C0:97:FE:BB'
        option name 'GT-N8000'

config host
        option name 'TL-SG108E'
        option ip '192.168.15.43'
        option mac 'D8:0D:17:E1:EF:E1'

root@horus:~#

uci export firewall

root@horus:~# uci export firewall
package firewall

config defaults
        option input 'DROP'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'
        option flow_offloading '1'
        option flow_offloading_hw '1'
        option drop_invalid '1'

config zone 'lan'
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list device 'tun+'
        list network 'lan'

config zone 'wan'
        option name 'wan'
        option input 'DROP'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list network 'onu_vsol'
        list network 'wan'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-Ping6'
        option family 'ipv6'
        list proto 'icmp'
        option src 'wan'
        option target 'ACCEPT'
        list icmp_type 'echo-request'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        option family 'ipv6'
        option target 'ACCEPT'
        list icmp_type 'echo-reply'
        list icmp_type 'echo-request'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config redirect
        option dest 'lan'
        option target 'DNAT'
        option name 'NintendoSwitch-NAT_A'
        list proto 'udp'
        option src 'wan'
        option src_dport '45000-65535'
        option dest_ip '192.168.15.30'
        option dest_port '45000-65535'

config redirect
        option target 'DNAT'
        option name 'DDNS_IPV4'
        option src 'wan'
        option src_dport '8181'
        option dest_ip '192.168.15.1'
        option dest_port '80'
        list proto 'tcp'

config redirect
        option target 'DNAT'
        option name 'Transmission'
        option src 'wan'
        option src_dport '1111'
        option dest_ip '192.168.15.1'
        option dest_port '1111'
        option dest 'lan'

config rule
        option name 'Allow-Transmission'
        option src 'wan'
        option dest_port '1111'
        option target 'ACCEPT'

config rule 'ovpn'
        option name 'Allow-OpenVPN'
        option src 'wan'
        option dest_port '1194'
        option proto 'udp'
        option target 'ACCEPT'

config zone
        option name 'wireguard'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'wireguard'

config forwarding
        option src 'wireguard'
        option dest 'lan'

config forwarding
        option src 'wireguard'
        option dest 'wan'

config forwarding
        option src 'lan'
        option dest 'wireguard'

config rule
        option name 'Allow-Wireguard'
        list proto 'udp'
        option src 'wan'
        option dest_port '1195'
        option target 'ACCEPT'

root@horus:~#

ip -4 addr ; ip -4 ro li tab all

root@horus:~# ip -4 addr ; ip -4 ro li tab all
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    inet 192.168.1.2/30 brd 192.168.1.3 scope global eth0
       valid_lft forever preferred_lft forever
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    inet 192.168.15.1/26 brd 192.168.15.63 scope global eth1
       valid_lft forever preferred_lft forever
4: wireguard: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1420 qdisc noqueue state UNKNOWN group default qlen 1000
    inet 192.168.17.1/24 brd 192.168.17.255 scope global wireguard
       valid_lft forever preferred_lft forever
5: pppoe-wan: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1492 qdisc fq_codel state UNKNOWN group default qlen 3
    inet 20x.43.4y.92 peer 20x.204.20y.126/32 scope global pppoe-wan
       valid_lft forever preferred_lft forever
6: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UNKNOWN group default qlen 500
    inet 192.168.16.1/29 scope global tun0
       valid_lft forever preferred_lft forever
default via 20x.204.20y.126 dev pppoe-wan proto static
192.168.1.0/30 dev eth0 proto kernel scope link src 192.168.1.2
192.168.15.0/26 dev eth1 proto kernel scope link src 192.168.15.1
192.168.16.0/29 dev tun0 proto kernel scope link src 192.168.16.1
192.168.17.0/24 dev wireguard proto kernel scope link src 192.168.17.1
20x.204.20y.126 dev pppoe-wan proto kernel scope link src 20x.43.4y.92
local 127.0.0.0/8 dev lo table local proto kernel scope host src 127.0.0.1
local 127.0.0.1 dev lo table local proto kernel scope host src 127.0.0.1
broadcast 127.255.255.255 dev lo table local proto kernel scope link src 127.0.0.1
local 192.168.1.2 dev eth0 table local proto kernel scope host src 192.168.1.2
broadcast 192.168.1.3 dev eth0 table local proto kernel scope link src 192.168.1.2
local 192.168.15.1 dev eth1 table local proto kernel scope host src 192.168.15.1
broadcast 192.168.15.63 dev eth1 table local proto kernel scope link src 192.168.15.1
local 192.168.16.1 dev tun0 table local proto kernel scope host src 192.168.16.1
broadcast 192.168.16.7 dev tun0 table local proto kernel scope link src 192.168.16.1
local 192.168.17.1 dev wireguard table local proto kernel scope host src 192.168.17.1
broadcast 192.168.17.255 dev wireguard table local proto kernel scope link src 192.168.17.1
local 20x.43.4y.92 dev pppoe-wan table local proto kernel scope host src 20x.43.4y.92

ip -4 ru

root@horus:~# ip -4 ru
0:      from all lookup local
32766:  from all lookup main
32767:  from all lookup default
root@horus:~#

ls -l /etc/resolv.* /tmp/resolv.* /tmp/resolv./

root@horus:~# ls -l  /etc/resolv.* /tmp/resolv.* /tmp/resolv.*/*
lrwxrwxrwx    1 root     root            16 Jul 15  2024 /etc/resolv.conf -> /tmp/resolv.conf
-rw-r--r--    1 root     root           119 Feb  2 10:24 /tmp/resolv.conf
-rw-r--r--    1 root     root           162 Feb  1 14:15 /tmp/resolv.conf.d/resolv.conf.auto
-rw-r--r--    1 root     root            52 Feb  1 12:00 /tmp/resolv.conf.ppp

/tmp/resolv.conf.d:
-rw-r--r--    1 root     root           162 Feb  1 14:15 resolv.conf.auto
root@horus:~#

head -n -0 /etc/resolv.* /tmp/resolv.* /tmp/resolv./

root@horus:~# head -n -0 /etc/resolv.* /tmp/resolv.* /tmp/resolv.*/*
==> /etc/resolv.conf <==
# /tmp/resolv.conf generated by Unbound UCI 2025-02-01T20:29:27-03:00
nameserver 127.0.0.1
nameserver ::1
search lan.


==> /tmp/resolv.conf <==
# /tmp/resolv.conf generated by Unbound UCI 2025-02-01T20:29:27-03:00
nameserver 127.0.0.1
nameserver ::1
search lan.


==> /tmp/resolv.conf.d <==
head: /tmp/resolv.conf.d: I/O error

==> /tmp/resolv.conf.ppp <==
nameserver 187.50.250.115
nameserver 187.50.250.215

==> /tmp/resolv.conf.d/resolv.conf.auto <==
# Interface wan
nameserver 187.50.250.115
nameserver 187.50.250.215
# Interface wan_6
nameserver 2001:12e0:0:1025:a080::115
nameserver 2001:12e0:0:1025:a080::215
root@horus:~#

I believe that this problem maybe it caused by dns crasheds that I have, but now, it works well again, so, Wireguard clients only works with IP address, but DNS, not works...
I don´t know that I can tests...

Thanks !

2

The WG clients set their DNS server, I assume you have set the routers Address as DNS server?

If so DNSMasq must listen on the WG interface which is does not:

You might also need to tweak the localservice setting although I think that should not be necessary as you already have the wg subnet on the router

3

Wireguard and opnVPN now is working very wall again...

I used this command to revert back to the old configuration I had before...

uci set dhcp.horus.interface='wan'
uci commit dhcp
service dnsmasq restart

Thanks for help @egc

4

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.