Openwrt Wireguard Server (road warrior setup) force clients to use DNS

johnny71 · May 24, 2023, 1:57pm

Applying all your changes broke my DNS queries. Had to revert back.

johnny71 · May 24, 2023, 2:14pm

Setting option localservice '0' alone didn't work

trendy · May 24, 2023, 2:23pm

This guide is quite old and for the unsupported version 19.07.

Because it seems that you are using the unbound as primary.
What is the output of uci export unbound ?

johnny71 · May 24, 2023, 2:38pm

Yes I've stated already that I'm using an unbound/Adblock setup
The latest documentation on unbound is 3 years old and still has the same settings:

github.com

openwrt/packages/blob/master/net/unbound/files/README.md

# Unbound Recursive DNS Server with UCI
<!-- markdownlint-disable -->

## Unbound Description
[Unbound](https://www.unbound.net/) is a validating, recursive, and caching DNS resolver. The C implementation of Unbound is developed and maintained by [NLnet Labs](https://www.nlnetlabs.nl/). It is based on ideas and algorithms taken from a java prototype developed by Verisign labs, Nominet, Kirei and ep.net. Unbound is designed as a set of modular components, so that also DNSSEC (secure DNS) validation and stub-resolvers (that do not run as a server, but are linked into an application) are easily possible.

## Package Overview
OpenWrt default build uses [dnsmasq](http://www.thekelleys.org.uk/dnsmasq/docs/dnsmasq-man.html) for DNS forwarding and DHCP. With a forward only resolver, dependence on the upstream recursors may be cause for concern. They are often provided by the ISP, and some users have switched to public DNS providers. Either way may result in problems due to performance, "snoop-vertising", hijacking (MiM), and other causes. Running a recursive resolver or resolver capable of TLS may be a solution.

Unbound may be useful on consumer grade embedded hardware. It is fully DNSSEC and TLS capable. It is _intended_ to be a recursive resolver only. NLnet Labs [NSD](https://www.nlnetlabs.nl/projects/nsd/) is _intended_ for the authoritative task. This is different than [ISC Bind](https://www.isc.org/downloads/bind/) and its inclusive functions. Unbound configuration effort and memory consumption may be easier to control. A consumer could have their own recursive resolver with 8/64 MB router, and remove potential issues from forwarding resolvers outside of their control.

This package builds on Unbounds capabilities with OpenWrt UCI. Not every Unbound option is in UCI, but rather, UCI simplifies the combination of related options. Unbounds native options are bundled and balanced within a smaller set of choices. Options include resources, DNSSEC, access control, and some TTL tweaking. The UCI also provides an escape option and works at the raw `unbound.conf` level.

## HOW TO: Ad Blocking
The UCI scripts will work with [net/adblock](https://github.com/openwrt/packages/blob/master/net/adblock/files/README.md), if it is installed and enabled. Its all detected and integrated automatically. In brief, the adblock scripts create distinct local-zone files that are simply included in the unbound conf file during UCI generation. If you don't want this, then disable adblock or reconfigure adblock to not send these files to Unbound.

A few tweaks may be needed to enhance the realiability and effectiveness. Ad Block option for delay time may need to be set for upto one minute (adb_triggerdelay), because of boot up race conditions with interfaces calling Unbound restarts. Also many smart devices (TV, microwave, or refigerator) will also use public DNS servers either as a bypass or for certain connections in general. If you wish to force exclusive DNS to your router, then you will need a firewall rule for example:

**/etc/config/firewall**:
```

This file has been truncated. show original

 uci export unbound
package unbound

config unbound 'ub_main'
        option add_extra_dns '0'
        option add_local_fqdn '1'
        option add_wan_fqdn '0'
        option dhcp_link 'dnsmasq'
        option domain 'lan'
        option listen_port '53'
        option dhcp4_slaac6 '0'
        option dns64 '0'
        option dns64_prefix '64:ff9b::/96'
        option domain_type 'static'
        option edns_size '1232'
        option extended_stats '0'
        option hide_binddata '1'
        option interface_auto '1'
        option localservice '1'
        option manual_conf '0'
        option num_threads '1'
        option protocol 'default'
        option query_minimize '0'
        option query_min_strict '0'
        option rate_limit '0'
        option rebind_localhost '0'
        option rebind_protection '1'
        option recursion 'default'
        option resource 'default'
        option root_age '9'
        option ttl_min '120'
        option ttl_neg_max '1000'
        option unbound_control '0'
        option validator '0'
        option validator_ntp '1'
        option verbosity '1'
        list iface_trig 'lan'
        list iface_trig 'wan'
        list iface_wan 'wan'

config zone 'auth_icann'
        option enabled '0'
        option fallback '1'
        option url_dir 'https://www.internic.net/domain/'
        option zone_type 'auth_zone'
        list server 'lax.xfr.dns.icann.org'
        list server 'iad.xfr.dns.icann.org'
        list zone_name '.'
        list zone_name 'arpa.'
        list zone_name 'in-addr.arpa.'
        list zone_name 'ip6.arpa.'

config zone 'fwd_isp'
        option enabled '0'
        option fallback '1'
        option resolv_conf '1'
        option zone_type 'forward_zone'
        list zone_name 'isp-bill.example.com.'
        list zone_name 'isp-mail.example.net.'

config zone 'fwd_google'
        option enabled '0'
        option fallback '1'
        option tls_index 'dns.google'
        option tls_upstream '1'
        option zone_type 'forward_zone'
        list server '8.8.4.4'
        list server '8.8.8.8'
        list server '2001:4860:4860::8844'
        list server '2001:4860:4860::8888'
        list zone_name '.'

config zone 'fwd_cloudflare'
        option enabled '0'
        option fallback '1'
        option tls_index 'cloudflare-dns.com'
        option tls_upstream '1'
        option zone_type 'forward_zone'
        list server '1.1.1.1'
        list server '1.0.0.1'
        list server '2606:4700:4700::1111'
        list server '2606:4700:4700::1001'
        list zone_name '.'

trendy · May 24, 2023, 3:03pm

Change it to 0

johnny71 · May 24, 2023, 3:13pm

Didnt work

vgaetera · May 24, 2023, 5:01pm

Change to 10.0.5.1 in the VPN client config and verify the DNS service is listening either wildcard or both LAN and VPN interfaces/subnets.

In addition, make sure to disable DoH/DoT on the client.

johnny71 · May 24, 2023, 5:08pm

I will give it a try as soon as I can, however I'm looking for a server-side solution. I don't want my clients choosing the DNS. DoH/DoT is disabled (unbound/adblock works on my home LAN with same client).

vgaetera · May 24, 2023, 5:32pm

This can be problematic as the client can still use directly routed DNS advertised by the mobile/remote ISP over the WAN interface unless you explicitly override it by the VPN client configuration.

johnny71 · May 24, 2023, 5:42pm

So your suggestion above worked! If I specify on the client side in Wireguard app the DNS as 10.0.5.1 I get my unbound/adblock filtering! Now how can I force this/hijack this so that all WG clients/peers use 10.0.5.1 no matter what they input???

My Wireguard interface is linked to the LAN zone which is DNS hijacked. Is there something more I can try? Is there a way to direct all traffic from a peers IP (in this case 10.0.5.2)?

vgaetera · May 24, 2023, 6:14pm

Looks like your VPN interface is in the LAN zone, so the configured DNS hijacking should apply to both LAN and VPN networks.

I'm afraid this might be difficult to accomplish since the user can specify an IPv4 or IPv6 DNS routed directly to WAN bypassing the connected VPN.
We can only guess, as we cannot reliably confirm how routing is implemented on the client, unless we analyze client side routing tables and rules.