Forwarding DNS request based on DNS server IP Source

Installing and Using OpenWrt Network and Wireless Configuration
1

Hi everyone,
my setup is working in this way:
I have a WireGuard VPN Client and a WireGuard VPN Server setted up on OpenWRT. The Client is connected to a paid VPN Server, while the Server is allowing me access to the LAN network.
The devices connected to the WG Server are doing this route:
WG Client -> OpenWrt -> paid VPN Server -> Internet
In this way I can access my LAN, but I am browsing Internet with the IP of the VPN, and not the one of my ISP.
I achieved this configuration by using PBR.

The problem is that I need the DNS Server of the client to work like that:
VPN Client -> 10.0.0.1 (OpenWRT) -> 10.64.0.1 (paid VPN DNS Server)
I don't want to connect directly to 10.64.0.1 because I need to query the router first to resolve local hostname.

How can I achieve that?

I tried putting 10.64.0.1 on the advanced tab of the WireGuard Client and Server interface of OpenWRT but it's not enough, 10.0.0.1 is using my ISP DNS (from the wan interface) to query domains.

I need the rest of the network interfaces to query my ISP DNS normally

2

Configure paid DNS as forwarder for dnsmasq (luci/network/dhcp dns/ forward)

3

This way every interface goes out with the paid vpn dns, isn't it?
I want the other interface to go out with my ISP DNS

4

You need specific (eg pbr) routes and you can override for specified domains.

eg route 1.1.1.1/32 via provider
forward /cloudflare.com/1.1.1.1

5

I don't understand:
I don't need to split traffic based on domain name but based on the subnet the request is coming from.
So the requests from 10.0.0.0/24 make this route:
10.0.0.1 (OpenWRT Gateway) -> 10.64.0.1 (VPN DNS)
while other subnets (like 192.168.1.0/24) make this route:
192.168.1.1 (OpenWRT Gateway) -> ISP DNS

Basically I need to make DNS requests made from the router IP 10.0.0.1 forwarded to 10.64.0.1, and keep everything else unchanged.

6

On a brief perusal, looks like something that dns policies in pbr was made for.

1 Like
7

I have already tried it.
I tried to forward 10.0.0.0/24 to the interface of the paid VPN and only 10.0.0.1/24.
With the second option active I can no longer go to the Internet with the VPN Client.

8

@brada4 @stangri

Would this work?

  • make a second dnsmasq instance
  • set forwarders as paid DNS
  • make route for 10.64.0.1/32 via VPN
  • set dnsmasq to lookup .lan at 1st instance's IP (wonder if the reverse zone would work too :thinking: )
9

Fourth) one instance needs to get off localhost:53, but general outline is ok.

1 Like
10

Add DNS of VPN up as forwarder in DNSmasq. Setup a static route from DNSmasq to VPN tunnel. Eg: Avoiding DNS leaks with AdGuard Home and VPN provider - #7 by roofussummers

11

That would work if the OP wanted all requests to use the tunnel.

The OP wants the non-VPN clients to use the normal DNS.