OpenWrt as WireGuard client + external Pihole = Conditional Forwarding not working

Installing and Using OpenWrt
1

Hi!

I have a VPS server with a WireGuard server (10.0.0.254) and a Pihole server.

I have an OpenWrt travel router (24.10) that has a LAN of 192.168.8.0/24 and is a WireGuard client (10.0.0.21).

The WireGuard interface (named wgclient) has its DNS address set to 10.0.0.250 (this is the alias of the WireGuard server that hosts Pihole). The AllowedIPs are 0.0.0.0/0, so all travel router traffic goes through the VPN tunnel.

On the WireGuard server side, the AllowedIPs are 10.0.0.21/32 and 192.168.8.0/24, so the local network is accessible via the VPN.

In this configuration, the travel router's clients are visible on the internet with the VPS server address, and DNS queries are processed by Pihole on the VPS – this is OK.

Currently, in Pihole's logs, all travel router clients appear as a single client, represented as the travel router.

For Pihole to recognize clients individually, you need to configure conditional forwarding in Pihole (https://discourse.pi-hole.net/t/conditional-forwarding-how-does-it-work/36644/2). So, in Pihole, in the conditional forwarding settings, I set:

true,192.168.8.0/24,192.168.8.254,NITZ

In my other installation, which has an OpenWrt home router and a separate Raspberry Pi running Pihole on the same local network, the conditional forwarding feature solved this problem.

Unfortunately, implementing conditional forwarding in Pihole on the VPS server didn't result in the travel router's clients being recognized individually.

I believe this is because AllowedIPs = 0.0.0.0/0 on the travel router's wgclient interface is set, and all travel router traffic is NATed to the WireGuard interface address.

Detailed configuration of the travel router:

root@NITZ-ROUTER:~# cat /etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd04:f1ad:96e::/48'
        option packet_steering '1'

config device
        option name 'br-lan'
        option type 'bridge'
        option bridge_empty '1'
        list ports 'eth1'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.8.254'
        option netmask '255.255.255.0'
        option defaultroute '0'

config interface 'wan'
        option device 'eth0'
        option proto 'dhcp'

config interface 'wan6'
        option device 'eth0'
        option proto 'dhcpv6'
        option reqaddress 'try'
        option reqprefix 'auto'
        option norelease '1'
        option disabled '1'

config interface 'wwan'
        option proto 'dhcp'

config interface 'wgclient'
        option proto 'wireguard'
        option private_key '????????????????????????????'
        list addresses '10.0.0.8/32'
        option mtu '1380'
        list dns '10.0.0.250'

config wireguard_wgclient
        option description 'VPS'
        option public_key ''????????????????????????????''
        option preshared_key ''????????????????????????????''
        list allowed_ips '0.0.0.0/0'
        option endpoint_host '???????'
        option endpoint_port '51820'
        option route_allowed_ips '1'
        option persistent_keepalive '25'

root@NITZ-ROUTER:~# cat /etc/config/dhcp

config dnsmasq
        option domainneeded '1'
        option localise_queries '1'
        option rebind_protection '0'
        option local '/NITZ/'
        option domain 'NITZ'
        option expandhosts '1'
        option cachesize '1000'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option localservice '1'
        option ednspacket_max '1200'
        option strictorder '1'
        option serversfile '/var/run/adblock-fast/dnsmasq.servers'

config dhcp 'lan'
        option interface 'lan'
        option start '1'
        option limit '10'
        option leasetime '1h'
        option dhcpv4 'server'
        list dhcp_option '6,10.0.0.250'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'
        option piofolder '/tmp/odhcpd-piofolder'

root@NITZ-ROUTER:~# cat /etc/config/firewall

config defaults
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'
        option flow_offloading '1'
        option flow_offloading_hw '1'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan'

config zone
        option name 'wan'
        option input 'DROP'
        option output 'ACCEPT'
        option forward 'DROP'
        option masq '1'
        option mtu_fix '1'
        list network 'wan'
        list network 'wan6'
        list network 'wwan'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config zone
        option name 'wgclient'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        option mtu_fix '1'
        list network 'wgclient'

config forwarding
        option src 'lan'
        option dest 'wgclient'

config forwarding
        option src 'wgclient'
        option dest 'lan'

config forwarding
        option src 'wgclient'
        option dest 'wan'

More importantly, it is worth noting that the LAN interface distributes DNS via DHCP option 6,10.0.0.250, so the travel router clients use this DNS (also checked with the DNS leak tool).

Am I right? If so, how can I resolve this? If I'm wrong, where is the configuration error and how can I correct it?

2

Execute the following command on the VPS:

ip route get 192.168.8.1

Verify the route is via the Wireguard interface.

3 

root@VPS:~$ ip route get 192.168.8.1
192.168.8.1 dev wg0 src 10.0.0.254 uid 1000
    cache

The travel router clients are using a DNS server with the address 10.0.0.250:

  • the DNS address of the router client's DHCP configuration is 10.0.0.250,
  • the nslookup result on the router client shows 10.0.0.250,
  • the Pihole logs show queries made by the router client.

The only problem is that in the Pihole logs, all DNS queries from the travel router clients are displayed as the name/IP of the travel router, not individually per travel router client, despite the conditional forwarding setting.

1 Like
4

Since there's a route from your server to this network, is there a reason you want to keep it that way?

5

For privacy reasons, I'd like the travel router's client traffic to pass through the VPS.

In other words, all the travel router's traffic would pass through the VPN tunnel.

6

It would pass through the VPN tunnel to contact pihole. The packets will have a source IP of 192.168.8.x. I assume this statement meant the network your clients will connect to on the travel router:

Correct?

Perhaps, I misunderstand your issue. If so, my apologies.

7

Btw, it's unclear what you meant by NATed to the interface. I actually don't see that in your config.

8

Pihole is on the same machine as WireGuard Server.

Travel router is a WireGuard client with AllowedIPs set to 0.0.0.0/0. It means that all traffic from travel routers is passed through VPN tunnel. Also DNS packets.

Travel router's clients have connection with VPN server.

Right now I have noticed something. If I remove 10.0.0.250 from DNS settings of wgclient interface there are no queries on Pihole. I think router's clients are not using DNS address from DHCP (from option 6,10.0.0.250).

Any ideas how to confirm it?

9

I think it's done automatically by option route_allowed_ips '1' of wgclient interface.

10

Yes, I saw that.

I meant to mention this, the DNS settings on Wireguard interfaces don't usually do anything in OpenWrt.

That's only the OpenWrt making queries.

On a Windows machine and Linux and others display the IP of the DNS server assigned via DHCP.

On a the travel router:

ip route get 10.0.0.250

11

No, and I reviewed the configurations and the wgclient firewall zone you assigned the interface to see if you had masq enabled. Unless I overlooked it, you didn't.

The source IP should be 192.168.8.x and your DHCP Option No. 6 seems to be OK.

You should see queries.

12

On client:

Tracing route to 10.0.0.250 over a maximum of 30 hops

  1     6 ms     1 ms     1 ms  NITZ-ROUTER.NITZ [192.168.8.254]
  2    60 ms    54 ms    54 ms  10.0.0.250

Trace complete.

On VPS:

root@VPS:~$ ip route get 10.0.0.250
local 10.0.0.250 dev lo src 10.0.0.250 uid 1000
    cache <local>
root@VPS:~$ ip route get 192.168.8.254
192.168.8.254 dev wg0 src 10.0.0.254 uid 1000
    cache

On travel router:


root@NITZ-ROUTER:~# ip route get 10.0.0.250
10.0.0.250 dev wgclient src 10.0.0.21 uid 0
    cache

I think the DNS setting on the wgclient interface does something, because:

  • When DNS on the (WireGuard-type) wgclient interface is set to 10.0.0.250, DNS queries from the router and its clients are visible in Pihole on the VPS (WireGuard server).
  • When DNS is not set on the (WireGuard-type) wgclient interface, queries in Pihole on the VPS (WireGuard server) are not visible, even though DHCP option 6,10.0.0.250 is enabled for the router's LAN interface.

Windows client configuration:

C:\Users\NITZ>ipconfig /all

Wireless LAN adapter Wi-Fi:

   Connection-specific DNS Suffix  . : NITZ
   Description . . . . . . . . . . . : Intel(R) Wi-Fi 6E AX211 160MHz
   Physical Address. . . . . . . . . : B0-47-E9-FF-6C-9D
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   IPv4 Address. . . . . . . . . . . : 192.168.8.51(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Lease Obtained. . . . . . . . . . : wtorek, 10 lutego 2026 23:05:46
   Lease Expires . . . . . . . . . . : środa, 11 lutego 2026 01:58:47
   Default Gateway . . . . . . . . . : 192.168.8.254
   DHCP Server . . . . . . . . . . . : 192.168.8.254
   DNS Servers . . . . . . . . . . . : 10.0.0.250
   NetBIOS over Tcpip. . . . . . . . : Enabled

C:\Users\NITZ>nslookup openwrt.org
Server:  UnKnown
Address:  10.0.0.250

Non-authoritative answer:
Name:    openwrt.org
Addresses:  2a03:b0c0:3:d0::1a51:c001
          64.226.122.113

IPv6 turned off.

Masquerade for wgclient intereface also turned off.

13

Whoa!

Try assigning this to any interface other than Loopback.

14

Sorry, we're talking about VPS - it's Debian. OK, I have to think how to do this.

15

Yes, I woud think you can assign this IP to the Wireguard interface. You haven't explained the scope or mask of the 10.x.x.x network.

Routable Loopback address can behave oddly. It seems you assigned the address 10.0.0.250 to the loopback interface.

16

Just to be clear, have you checked your logs?

17

Hi!

I'm sorry that I'am answering so late, but past few days I was on business delegation and I had no time and possibility to solve this problem (until yesterday).

Yesterday I found solution:

DHCP and DNS > Devices and Ports > Listen Interfaces

When is unspecfied should listen on all interfaces (according to official OpenWrt documentation).

But I think it's not.

I manually added all LAN interfaces and wgclient and now everything is working as intended.

Thank You for attention!

You can mark this topic as solved.

18

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.