Help configuring WireGuard VPN Client seperated from Main Network

Installing and Using OpenWrt Network and Wireless Configuration
1

Hello

I want to know if I can use a WireGuard VPN that's completely separate from my main network. My goal is for devices that are connected to a WiFi network to use Mullvad VPN only.

I have set up my router using this new project going on which is "WrtNova" which uses the officla firmware but adds a configuration file so it setups everything for you on first boot wanted to give it a try which had option to setup WireGuard VPN Client. The VPN connection works but I noticed that when I look up website addresses it is still using the lookup servers that I set up in AdGuard Home instead of the lookup servers that Mullvad said to use in their official guide which I want to use when I tested same thing with WireGuard app everything is good and even with their official app I want the same thing.

This is a problem because when I do a test to see if my lookup requests are leaking it shows that my AdGuard Home lookup servers are being used. This also causes another problem. One of the reasons I want to use a VPN is to get to websites that are blocked in my country.. Since the VPN network is still using lookup servers like Quad9 and Cloudflare through AdGuard Home I still cannot get to some of those websites.

For context this is what my network looks like:

• LAN network on its own VLAN (1)
• Guest network on a separate VLAN (8)
• A dedicated WireGuard VPN client network on its own VLAN (15)
• Multiple WiFi SSIDs assigned to different VLANs (Main, Guest, VPN)
• The WireGuard VPN is only used when connected to the specific WiFi SSID assigned to the VPN network
• AdGuard Home is handling DNS for the network (Main DNS Resolver) dnsmaq is moved to port 54*
• Tailscale is installed on the router for remote access

Is there a way to set up the VPN network so it uses Mullvads lookup servers through the WireGuard tunnel while keeping it separate, from my network?

I can give you my network and other configuration files if you need them. Any help will be great.

ubus call system board
{
        "kernel": "6.12.87",
        "hostname": "WrtNova",
        "system": "ARMv7 Processor rev 5 (v7l)",
        "model": "NETGEAR RBR50",
        "board_name": "netgear,rbr50",
        "rootfs_type": "squashfs",
        "release": {
                "distribution": "OpenWrt",
                "version": "25.12.4",
                "firmware_url": "https://downloads.openwrt.org/",
                "revision": "r32933-4ccb782af7",
                "target": "ipq40xx/generic",
                "description": "OpenWrt 25.12.4 r32933-4ccb782af7",
                "builddate": "1778712129"
        }
}
cat /etc/config/dhcp

config odhcpd 'odhcpd'
        option leasefile '/tmp/odhcpd.leases'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'
        option piodir '/tmp/odhcpd-piodir'
        option hostsdir '/tmp/hosts'

config dnsmasq 'guest_dns'
        option domainneeded '1'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/guest.lan/'
        option domain 'guest.lan'
        option expandhosts '1'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases.guest'
        option localservice '1'
        option dnsforwardmax '500'
        option dhcpleasemax '150'
        list interface 'guest'
        list notinterface 'loopback'
        option noresolv '1'
        option cachesize '0'
        list server '127.0.0.1#5354'
        list server '::1#5354'
        option port '54'

config dhcp 'guest'
        option instance 'guest_dns'
        option interface 'guest'
        option start '100'
        option limit '100'
        option leasetime '1h'
        list dhcp_option '6,192.168.8.1'

config dnsmasq 'lan_vpn_dns'
        option domainneeded '1'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/vpn.lan/'
        option domain 'vpn.lan'
        option expandhosts '1'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases.lan_vpn'
        option localservice '1'
        option dnsforwardmax '500'
        option dhcpleasemax '150'
        list interface 'lan_vpn'
        list notinterface 'loopback'
        list rebind_domain 'lan'
        option noresolv '1'
        option cachesize '0'
        option port '54'
        list server '/lan/127.0.0.1'
        list server '127.0.0.1#5354'
        list server '::1#5354'

config dhcp 'lan_vpn'
        option instance 'lan_vpn_dns'
        option interface 'lan_vpn'
        option start '100'
        option limit '100'
        option leasetime '24h'
        option ra 'server'
        option ra_preference 'medium'
        option dhcpv6 'server'
        list dhcp_option '6,192.168.15.1'

config dnsmasq 'lan_dns'
        option domainneeded '1'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases.lan'
        option localservice '1'
        option dnsforwardmax '500'
        option dhcpleasemax '150'
        list interface 'lan'
        list rebind_domain 'lan'
        option noresolv '1'
        option cachesize '0'
        option port '54'
        list server '/vpn.lan/192.168.15.1'
        list server '127.0.0.1#5354'
        list server '::1#5354'

config dhcp 'lan'
        option instance 'lan_dns'
        option interface 'lan'
        option start '100'
        option limit '100'
        option leasetime '24h'
        list dhcp_option '6,192.168.1.1'

cat /etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        list ipaddr '127.0.0.1/8'

config globals 'globals'
        option dhcp_default_duid ''
        option ula_prefix ''
        option packet_steering '1'

config device
        option name 'br-vlan'
        option type 'bridge'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'

config interface 'lan'
        option device 'br-vlan.1'
        option proto 'static'
        list ipaddr '192.168.1.1/24'
        option multipath 'off'

config device
        option name 'wan'
        option macaddr ''

config interface 'wan'
        option device 'wan'
        option proto 'pppoe'
        option ipv6 '0'
        option username ''
        option metric '5'
        option password ''
        option multipath 'off'

config interface 'wan_6'
        option device '@wan'
        option proto 'dhcpv6'
        option metric '10'
        option reqaddress 'try'
        option reqprefix 'auto'
        option norelease '1'
        option multipath 'off'
        option disabled '1'
        option auto '0'

config interface 'guest'
        option proto 'static'
        list ipaddr '192.168.8.1/24'
        option device 'br-vlan.8'
        option multipath 'off'

config interface 'usb0'
        option proto 'dhcp'
        option device 'usb0'
        option metric '15'

config interface 'lan_vpn'
        option proto 'static'
        list ipaddr '192.168.15.1/24'
        option device 'br-vlan.15'
        option multipath 'off'
        option ip6assign '60'
        option ip6hint '10'
        list ip6class 'local'

config interface 'vpn'
        option proto 'wireguard'
        option private_key ''
        option metric '20'
        option multipath 'off'
        option mtu '1280'
        list addresses ''
        list addresses ''

config interface 'vpn_6'
        option proto 'none'
        option device '@vpn'
        option metric '25'

config rule6
        option in 'loopback'
        option lookup '2'
        option priority '999'

config wireguard_vpn
        option public_key ''
        option endpoint_host ''
        option endpoint_port '51820'
        option persistent_keepalive '25'
        option route_allowed_ips '1'
        option description ''
        list allowed_ips '0.0.0.0/0'
        list allowed_ips '::0/0'

config bridge-vlan 'vlan_1'
        option device 'br-vlan'
        option vlan '1'
        list ports 'lan1:u*'
        list ports 'lan2:u*'
        list ports 'lan3:u*'

config bridge-vlan 'vlan_8'
        option device 'br-vlan'
        option vlan '8'
        list ports 'lan1:t'
        list ports 'lan2:t'
        list ports 'lan3:t'

config bridge-vlan 'vlan_15'
        option device 'br-vlan'
        option vlan '15'
        list ports 'lan1:t'
        list ports 'lan2:t'
        list ports 'lan3:t'

config interface 'tailscale'
        option proto 'none'
        option device 'tailscale0'
        option multipath 'off'

cat /etc/config/firewall

config defaults
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone 'lan'
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan'
        list network 'lan_vpn'

config zone 'wan'
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'DROP'
        option masq '1'
        option mtu_fix '1'
        list network 'wan'
        list network 'wan_6'
        list network 'usb0'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config redirect
        option name 'lan Intercept-DNS'
        option src 'lan'
        option src_dport '53'
        option family 'any'

config zone 'guest'
        option name 'guest'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'guest'

config rule
        option name 'guest Allow-DNS-DHCP-NTP'
        option src 'guest'
        option target 'ACCEPT'
        option proto 'tcp udp'
        option dest_port '53 67 123'

config rule
        option name 'guest Allow-Ping'
        option src 'guest'
        option target 'ACCEPT'
        option proto 'icmp'
        option family 'ipv4'
        list icmp_type 'echo-request'

config rule
        option name 'guest Allow-DHCPv6'
        option src 'guest'
        option target 'ACCEPT'
        option proto 'udp'
        option family 'ipv6'
        option dest_port '546'

config rule
        option name 'guest Allow-MLD'
        option src 'guest'
        option target 'ACCEPT'
        option proto 'icmp'
        option family 'ipv6'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'

config rule
        option name 'guest Allow-ICMPv6-Input'
        option src 'guest'
        option target 'ACCEPT'
        option proto 'icmp'
        option family 'ipv6'
        option limit '1000/sec'
        list icmp_type 'bad-header'
        list icmp_type 'destination-unreachable'
        list icmp_type 'echo-reply'
        list icmp_type 'echo-request'
        list icmp_type 'neighbour-advertisement'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'packet-too-big'
        list icmp_type 'router-advertisement'
        list icmp_type 'router-solicitation'
        list icmp_type 'time-exceeded'
        list icmp_type 'unknown-header-type'

config redirect
        option name 'guest Intercept-DNS'
        option src 'guest'
        option src_dport '53'
        option family 'any'

config forwarding 'guest_to_wan'
        option src 'guest'
        option dest 'wan'

config zone 'wan_nat6'
        option name 'wan_nat6'
        option masq '1'
        option masq6 '1'
        option mtu_fix '1'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'vpn'

config forwarding 'lan_to_wan_nat6'
        option src 'lan'
        option dest 'wan_nat6'

config rule
        option name 'Block-DoT-DoQ'
        option src '*'
        option dest '*'
        option dest_port '853'
        option target 'REJECT'

config zone
        option name 'tailscale'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list network 'tailscale'

config forwarding
        option src 'tailscale'
        option dest 'lan'

cat /etc/config/firewall

config defaults
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone 'lan'
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan'
        list network 'lan_vpn'

config zone 'wan'
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'DROP'
        option masq '1'
        option mtu_fix '1'
        list network 'wan'
        list network 'wan_6'
        list network 'usb0'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config redirect
        option name 'lan Intercept-DNS'
        option src 'lan'
        option src_dport '53'
        option family 'any'

config zone 'guest'
        option name 'guest'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'guest'

config rule
        option name 'guest Allow-DNS-DHCP-NTP'
        option src 'guest'
        option target 'ACCEPT'
        option proto 'tcp udp'
        option dest_port '53 67 123'

config rule
        option name 'guest Allow-Ping'
        option src 'guest'
        option target 'ACCEPT'
        option proto 'icmp'
        option family 'ipv4'
        list icmp_type 'echo-request'

config rule
        option name 'guest Allow-DHCPv6'
        option src 'guest'
        option target 'ACCEPT'
        option proto 'udp'
        option family 'ipv6'
        option dest_port '546'

config rule
        option name 'guest Allow-MLD'
        option src 'guest'
        option target 'ACCEPT'
        option proto 'icmp'
        option family 'ipv6'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'

config rule
        option name 'guest Allow-ICMPv6-Input'
        option src 'guest'
        option target 'ACCEPT'
        option proto 'icmp'
        option family 'ipv6'
        option limit '1000/sec'
        list icmp_type 'bad-header'
        list icmp_type 'destination-unreachable'
        list icmp_type 'echo-reply'
        list icmp_type 'echo-request'
        list icmp_type 'neighbour-advertisement'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'packet-too-big'
        list icmp_type 'router-advertisement'
        list icmp_type 'router-solicitation'
        list icmp_type 'time-exceeded'
        list icmp_type 'unknown-header-type'

config redirect
        option name 'guest Intercept-DNS'
        option src 'guest'
        option src_dport '53'
        option family 'any'

config forwarding 'guest_to_wan'
        option src 'guest'
        option dest 'wan'

config zone 'wan_nat6'
        option name 'wan_nat6'
        option masq '1'
        option masq6 '1'
        option mtu_fix '1'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'vpn'

config forwarding 'lan_to_wan_nat6'
        option src 'lan'
        option dest 'wan_nat6'

config rule
        option name 'Block-DoT-DoQ'
        option src '*'
        option dest '*'
        option dest_port '853'
        option target 'REJECT'

config zone
        option name 'tailscale'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list network 'tailscale'

config forwarding
        option src 'tailscale'
        option dest 'lan'
2

The general answer to this request is Policy Based Routing

You'd create a policy to route all traffic for the subnet associated with the wifi network through the VPN and your other network(s) through the regular wan. This is generally straight forward.

However, there might be some nuances here because of the very non-standard dnsmasq config you've got and the WrtNova "auto/pre-configuration" that has been used. To that end, maybe @LongQT-sea can take a look. Also @egc has some great guides on setting up PBR in this general context.

3

I already mentioned this in the other post "If you'd rather use Mullvad's own DNS, swap AdGuard's upstreams.".

If you'd like more detailed instructions, log in to AdGuard Home (192.168.1.1:3000), go to Settings → DNS Settings, delete everything under Upstream DNS servers, and paste the following:

10.64.0.1
https://dns.mullvad.net/dns-query
4

I mentioned this earlier after you explained why that approach would not work for me.

The problem is that my country blocks those DNS servers directly. As a result, some pages do not load at all. In some cases, the DNS response time reaches around 90,000 ms, which causes AdGuard Home to become unresponsive.

When I use the WireGuard VPN and forward DNS requests to Mullvad's DNS server at "10.64.0.1" instead, everything works correctly. The VPN tunnel bypasses my country's restrictions, and websites that were previously inaccessible start working normally.

Because of this, I think the issue is related to the DNS servers themselves being blocked rather than the VPN connection. Using Mullvad's DNS through the WireGuard tunnel seems to avoid that problem entirely.

5

That sounds like a fairly strong DPI system. Out of curiosity, which country is this? Iran or Russia?

6

Pakistan, it never had issues with VPNs before, but recently many VPN services have been blocked. At the moment, only PTA-approved VPNs that are officially registered for purposes such as freelancing and business use are allowed without restrictions.

That is the main issue I am facing. Because of these restrictions, I was asking how I could configure the VPN network to use its own DNS servers separately from the main network. My goal is for the VPN traffic and DNS requests to go entirely through the VPN provider so they can bypass these restrictions instead of relying on the DNS servers configured on the LAN.

The Mullvad VPN itself sometimes struggles due to the restrictions. I have noticed it switching between multiple servers in the same country and using different censorship bypass methods such as Shadowsocks and UDP-over-TCP.

To avoid those issues, I chose a server location that usually works without requiring those methods.

I want to share this VPN connection for my family instead of using it only on my own devices, since Mullvad limits accounts to a maximum of 5 devices.

7

As you do not show your whole config it is a bit of guessing.

The problem seems to be that you have setup a second DNSMasq instances for your VPN but in the end that is using Adguard Home which resides on the router so the DNS queries are coming from the router itself and that is not using the VPN.

You can use DHCP option 6 to send the Mullvad DNS to your VPN clients on the LAN but then you have to disable the DNS hijacking as that will route the DNS queries back to the router

There are other possibilities, see:

8

What else do you need in the config section?
As I mentioned earlier that I use @LongQT-sea WrtNova to generate a configuration which already had these setup for me the only thing was that I added the credentials

I think I tried to use DHCP option 6 on the lan_vpn itself not lan when I was testing myself to see what can I do after many things I gave up and asked for help here :sweat_smile:

9

At this moment nothing I would first try to use DHCP option 6 to send the mullvad DNS to the lan_vpn_dns clients

You have DNS hijacking implemented

If it is coming from Adguard home disable it there.
I cannot help you with that as I never use Adguard home, it is a terrible resource hog besides it does not support nftsets yet so if you later want to use Domain based policy based routing then you are also out of luck.

If it is separately implemented then disable the rule in the firewall

10

I have tried Adblock package before it was nice but not sure for what reason it wouldn't download other blocklists other then the default ones that it came with in the top list where it shows stats just showed "started with 0 blockslists" so I stopped using it also adblock-lean with https-dns-proxy It did let me use DoH servers but I'm not sure how I was able to change DNS for some specific websites like Tenor and Discord things wouldn't load so I have seperate DNS servers for them in AdGuard Home. I tried to use PBR before but it was confusing for me and I didn't understand the guide it was too technical for me :frowning:

Though I will give this one a try I just need to add DHCP 6 option and disable DNS Hijacking let me do that and give it a try how it goes

11

Soo.. I gave it a try disabled the lan interception rule and changed the dhcp 6 option but now it can't obtain an ip address

Edit: Okay soo I did this I added both "6,192.168.15.1" and "6,10.64.0.1" it connected to the wireguard vpn but it was still leaking the dns then I removed the 192.168.15.1 option and saved and then tested again showed no dns leaks and was only using the dns server from mullvad vpn soo how do I fix the not obtaining ip address issue

Edit again: now it seems to connect without a problem the VPN SSID??? :face_with_spiral_eyes:

also having an issue with now normal lan wifi devices they sometimes takes longer to connect now

12

Not sure why you cannot get an IP address but I can imagine you cannot get a DNS address.
Just use Mullvads Public DNS address

13

Nah it now uses the DNS server I added in the DHCP 6 option and shows no DNS Leaks no WebRTC leaks as well and it's working but now I have a question that I disabled the lan interception rule is this okay for normal lan devices because when I try to connect to my normal wifi ssid it takes like 10-15 seconds to connect saying "checking for internet access"" but it eventually connects with no internet access sometimes and with internet access sometimes

14

You can always make a rule for the lan users only.

You can even make a rule for the lan_vpn intercepting to the mullvad public DNS server :slight_smile:

15

Thanks for the help!!
I was able to do what I wanted to :slight_smile:

By the way the lan firewall covers both lan and vpn_lan so when I try to make lan interception rule it also has vpn_lan as well

I tried to make a seperate firewall for it but then I don't get internet access at all on the vpn ssid

How should I make the firewall zone for seperate vpn_lan?

In the official guide of wireguard on router by mullvad themselves they say this

218864
2188641080×2436 234 KB

16

You better make it separate so that you can also implement a kill switch meaning only allow forwarding from lan_vpn zone to vpn zone and not from lan_vpn to wan zone

See:

I think that has the instructions to setup a separate firewall zone

You might also want to have a look at:
WireGuard Client Setup Guide

But great to hear you got it working :+1:

P.S.do not forget to make backups between steps so that you can always go back to a working config

17

Tell me if I did it right?

What I did made "vpn_lan" zone

config zone
        option name 'vpn_lan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'lan_vpn'
        option masq6 '1'
        option masq '1'
        option mtu_fix '1'

config forwarding
        option src 'lan'
        option dest 'vpn_lan'

This made me access the internet and I added a rule to allow DHCP

config rule
        option src 'vpn_lan'
        option name 'vpn Allow-DHCP'
        option target 'ACCEPT'
        option dest_port '67'
        option enabled '1'

I enabled "lan-Intercept-DNS" back but I'm not sure how to what you said

I'm not why I can still see queries for the vpn @LongQT-sea is there a way to stop AGH from logging queries for this? I removed [vpn.lan] line from "Upstream DNS Servers" but it's still showing me in the "Statistics" because after the setup I did right now to seperate vpn_lan from lan I can't access AGH and Luci anymore also no point it having log queries of it either

image
image571×152 3.32 KB

image

18

No that does not look right.

Your lan_vpn interface is just another guest interface the same as you already made and should be setup the same and then forward from the newly created vpn_lan zone to the wan_nat6 zone and remove the vpn_lan zone form the lan firewall zone

19

So like this?

image
image901×755 36.4 KB

image
image909×754 41.6 KB

made same rules as guest network it's setup same as guest network as well other then ipv6 enabled on the interface
image
image443×682 33.4 KB

20

also I'm not sure if there is need for these in lan_vpn_dns?

image
image800×241 9.41 KB

can understand dns forwardings for lan but vpn.lan needed?
image
image825×253 9.73 KB