Luci config for dnsmasq DNS-only service for WireGuard clients?

CaptainBegin · October 20, 2024, 2:29am

Hi. I have WireGuard set up to enable access into my home network for WireGuard "clients". My client is an Android phone using the WireGuard Android app.

Getting basic IP connectivity was fairly straightforward, but the last obstacle was getting DNS queries against home-network hosts to succeed.

I noticed that on the router, netstat -panul showed dnsmasq listening on port 53 on all desired interfaces except for the wg0 WireGuard interface.

Through some trial and error, I found that what I needed was this:

uci add_list dhcp.@dnsmasq[0].interface='wg0'

and now dnsmasq is providing DNS service to WireGuard clients.

My questions:

Does this seem correct?
If correct, how would I configure this item in the LuCI web interface? I am currently just setting this configuration using the uci command-line interface. There does not seem to be a LuCI UI for just adding to the list of interfaces for which dnsmasq will provide DNS service. There is the "DHCP Server" tab in the Network Interface UI, but that only configures dhcp.wg0.ignore='1' without actually configuring dnsmasq to listen on that interface

What I believe is the relevant configuration:

/etc/config/network:

config interface 'wg0'
        option proto 'wireguard'
        option private_key 'xxx'
        option listen_port 'xxx'
        list addresses '192.168.xx.1/24'

/etc/config/dhcp:

config dnsmasq
        ...
        option localservice '1'
        list interface 'br-lan'
        list interface 'br-lan1'
        list interface 'br-lan2'
        list interface 'br-lan3'
        list interface 'wg0'
        ...

Specifically, I do NOT have (it doesn't seem to do anything for my purposes):

config dhcp 'wg0'
        option interface 'wg0'
        option ignore '1'

Thank you.

psherman · October 20, 2024, 2:40am

The approach you are taking is not ideal...

CaptainBegin:

        ...
        option localservice '1'
        list interface 'br-lan'
        list interface 'br-lan1'
        list interface 'br-lan2'
        list interface 'br-lan3'
        list interface 'wg0'
        ...

none of this is necessary, and probably not correct.

same with this.

The trick to getting DNS to work is on the remote peer -- set the DNS in the interface section of the remote peer.

Let's see the following to make sure you don't have latent issues:

Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button:

Remember to redact passwords, MAC addresses and any public IP addresses you may have:

ubus call system board
cat /etc/config/network
cat /etc/config/dhcp
cat /etc/config/firewall

And also post the config from the remote peer.

CaptainBegin · October 20, 2024, 6:23pm

Summary of (intended) configuration:

OpenWrt router is 192.168.10.1 running dnsmasq. There is a Pihole at 192.168.10.11
4 networks: default, VLANs 3, 4, 5, on bridge devices br-lan, br-lan1, br-lan2, and br-lan3 respectively, on subnets 192.168.{10,11,12,13} respectively
WireGuard peers (192.168.20.xx) should be "on" the default LAN network (192.168.10.xx). The firewall configuration sets up a separate wg0 zone with forwardings to match the lan zone. Would it be correct/simpler to just put the wg0 network directly into the lan zone?

ubus call system board

{
        "kernel": "5.15.167",
        "hostname": "gateway",
        "system": "Intel(R) Celeron(R) J4125 CPU @ 2.00GHz",
        "model": "Protectli VP2410",
        "board_name": "protectli-vp2410",
        "rootfs_type": "ext4",
        "release": {
                "distribution": "OpenWrt",
                "version": "23.05.5",
                "revision": "r24106-10cc5fcd00",
                "target": "x86/64",
                "description": "OpenWrt 23.05.5 r24106-10cc5fcd00"
        }
}

/etc/config/network

config globals 'globals'
        option ula_prefix 'xxx/48'

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config interface 'wan'
        option device 'eth1'
        option proto 'dhcp'

config interface 'wan6'
        option device 'eth1'
        option proto 'dhcpv6'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.10.1'
        option netmask '255.255.255.0'
        option ip6assign '60'

config interface 'lan1'
        option device 'br-lan1'
        option proto 'static'
        option ipaddr '192.168.11.1'
        option netmask '255.255.255.0'
        option ip6assign '60'

config interface 'lan2'
        option device 'br-lan2'
        option proto 'static'
        option ipaddr '192.168.12.1'
        option netmask '255.255.255.0'
        option ip6assign '60'

config interface 'lan3'
        option device 'br-lan3'
        option proto 'static'
        option ipaddr '192.168.13.1'
        option netmask '255.255.255.0'
        option ip6assign '60'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'eth0'
        list ports 'eth2'
        list ports 'eth3'

config device
        option name 'br-lan1'
        option type 'bridge'
        list ports 'eth0.3'

config device
        option name 'br-lan2'
        option type 'bridge'
        list ports 'eth0.4'

config device
        option name 'br-lan3'
        option type 'bridge'
        list ports 'eth0.5'

config interface 'wg0'
        option proto 'wireguard'
        option private_key 'xxx'
        option listen_port '51820'
        list addresses '192.168.20.1/24'

config wireguard_wg0
        option description 'peer_host'
        option public_key 'peer_pubkey'
        option preshared_key 'peer_psk'
        list allowed_ips '192.168.20.20/32'

/etc/config/dhcp

config dnsmasq
        option domainneeded '1'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option expandhosts '1'
        option authoritative '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option localservice '1'
        option ednspacket_max '1232'
        list interface 'br-lan'
        list interface 'br-lan1'
        list interface 'br-lan2'
        list interface 'br-lan3'

        # this is the hacky part that seems to be required to make DNS work for peers
        list interface 'wg0'

        option domain 'xxx'
        option local '/xxx/'

config odhcpd
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

config dhcp 'lan'
        option interface 'lan'
        option leasetime '1h'
        option start '100'
        option limit '150'
        list dhcp_option 'option:domain-search,xxx'
        list dhcp_option 'option:dns-server,192.168.10.11,192.168.10.1'
        list dhcp_option 'option:ntp-server,0.0.0.0'

config dhcp 'lan1'
        option interface 'lan1'
        option leasetime '1h'
        option start '100'
        option limit '150'
        list dhcp_option 'option:domain-search,xxx'
        list dhcp_option 'option:dns-server,192.168.10.11,192.168.10.1'
        list dhcp_option 'option:ntp-server,0.0.0.0'

config dhcp 'lan2'
        option interface 'lan2'
        option leasetime '1h'
        option start '100'
        option limit '150'
        list dhcp_option 'option:domain-search,xxx'
        list dhcp_option 'option:dns-server,192.168.10.11,192.168.10.1'
        list dhcp_option 'option:ntp-server,0.0.0.0'

config dhcp 'lan3'
        option interface 'lan3'
        option leasetime '1h'
        option start '100'
        option limit '150'
        list dhcp_option 'option:domain-search,xxx'
        list dhcp_option 'option:dns-server,192.168.10.11,192.168.10.1'
        list dhcp_option 'option:ntp-server,0.0.0.0'

config host
        option mac 'xxx'
        option name 'xxx'
        option dns '1'
        option ip '192.168.10.2'
        option leasetime '4h'

# many static lease configurations ...

config domain
        option name 'peer_host'
        option ip '192.168.20.20'

/etc/config/firewall

config defaults
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list network 'wan'
        list network 'wan6'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option src_ip 'fc00::/6'
        option dest_ip 'fc00::/6'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config include
        option path '/etc/firewall.user'

config zone
        option name 'lan1'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan1'

config zone
        option name 'lan2'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan2'

config zone
        option name 'lan3'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan3'

config forwarding
        option src 'lan'
        option dest 'wan'

config forwarding
        option src 'lan1'
        option dest 'wan'

config forwarding
        option src 'lan2'
        option dest 'wan'

config forwarding
        option src 'lan3'
        option dest 'wan'

config forwarding
        option src 'lan'
        option dest 'lan1'

config forwarding
        option src 'lan'
        option dest 'lan2'

config forwarding
        option src 'lan'
        option dest 'lan3'

config forwarding
        option src 'lan1'
        option dest 'lan2'

config rule
        option name 'Allow-Pihole-LAN1'
        option target 'ACCEPT'
        option src 'lan1'
        option dest 'lan'
        option dest_port '53'
        list proto 'tcp'
        list proto 'udp'
        list dest_ip '192.168.10.11'

config rule
        option name 'Allow-Pihole-LAN2'
        option target 'ACCEPT'
        option src 'lan2'
        option dest 'lan'
        option dest_port '53'
        list proto 'tcp'
        list proto 'udp'
        list dest_ip '192.168.10.11'

config rule
        option name 'Allow-Pihole-LAN3'
        option target 'ACCEPT'
        option src 'lan3'
        option dest 'lan'
        option dest_port '53'
        list proto 'tcp'
        list proto 'udp'
        list dest_ip '192.168.10.11'

config rule
        option name 'Allow-Printing-IPP-LAN1'
        option target 'ACCEPT'
        option src 'lan1'
        option dest 'lan'
        option dest_port '631'
        list proto 'tcp'
        list dest_ip '192.168.10.52'

config rule
        option name 'Allow-Printing-JetDirect-LAN1'
        option target 'ACCEPT'
        option src 'lan1'
        option dest 'lan'
        option dest_port '9100'
        list proto 'tcp'
        list dest_ip '192.168.10.52'

config rule
        option name 'Allow-mDNS-LAN'
        option target 'ACCEPT'
        option src 'lan'
        option src_port '5353'
        option dest_port '5353'
        list proto 'udp'
        list dest_ip '224.0.0.251'

config rule
        option name 'Allow-mDNS-LAN1'
        option target 'ACCEPT'
        option src 'lan1'
        option src_port '5353'
        option dest_port '5353'
        list proto 'udp'
        list dest_ip '224.0.0.251'

config rule
        option name 'Allow-mDNS-LAN2'
        option target 'ACCEPT'
        option src 'lan2'
        option src_port '5353'
        option dest_port '5353'
        list proto 'udp'
        list dest_ip '224.0.0.251'

config rule
        option name 'Allow-mDNS-LAN3'
        option target 'ACCEPT'
        option src 'lan3'
        option src_port '5353'
        option dest_port '5353'
        list proto 'udp'
        list dest_ip '224.0.0.251'

config zone
        option name 'wg0'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        option masq '1'                # this seems to be required
        list network 'wg0'

config forwarding
        option src 'wg0'
        option dest 'wan'

config forwarding
        option src 'wg0'
        option dest 'lan'

config forwarding
        option src 'wg0'
        option dest 'lan1'

config forwarding
        option src 'wg0'
        option dest 'lan2'

config forwarding
        option src 'wg0'
        option dest 'lan3'

config forwarding
        option src 'lan'
        option dest 'wg0'

config rule
        option name 'Allow-WireGuard'
        option target 'ACCEPT'
        option src 'wan'
        option dest_port '51820'
        list proto 'udp'

Looking at this, it occurs to me that I may have forgotten to add Firewall Traffic Rules to allow the wg0 zone to reach Pihole for DNS, although:

Wouldn't the Forwardings have taken care of that?
It looks like I forgot to configure the peer to use the Pihole anyway (see remote peer configuration below)

The remote peer is an Android phone using the WireGuard app; I can't directly "export" the configuration, so I've transcribed what appears in the app UI:

Interface
- name: wg2
- private key: xxx
- public key: peer_pubkey
- addresses: 192.168.20.20/32
- listen port: (random)
- DNS servers: 192.168.10.1
- MTU: (auto)

Peer
- public key: openwrt_pubkey
- pre-shared key: psk
- persistent keepalive: (optional, not recommended)
- endpoint: openwrt:51820
- allowed IPs: 0.0.0.0/0, ::/0