Routing LAN DNS to Adguard Home and into Wireguard Client

Installing and Using OpenWrt
1

Hi,
I would like to make this route possible, unfortunately without success:

  • All DNS traffic from zone lan -> Adguard Home (zone server) -> Wireguard Client (zone wg_out) -> internet
  • Everything non-DNS from zone lan -> Wireguard Client (zone wg_out) -> internet

I got it working without routing DNS to Adguard Home. Unfortunately with DNS leaks, despite following the OpenWRT Wireguard extras documentation about DNS leaks and other zones suddenly don't have internet access anymore.

I applied port forwarding rule from zone lan with destination port 53 to the DNS server in the Wireguard client configuration and dns leak test sites stopped reporting leaks.
However if I do the port forwarding instead to Adguard Home (zone server), I can't make nslookups, nor traceroutes (even to IPs). Zone lan has forwarding allowed to zone server, so I don't know what's wrong.

cat /etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'xxxxxxxx'

config atm-bridge 'atm'
        option vpi '1'
        option vci '32'
        option encaps 'llc'
        option payload 'bridged'
        option nameprefix 'dsl'

config dsl 'dsl'
        option annex 'j'
        option tone 'b'
        option ds_snr_offset '0'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan1'
        list ports 'lan3'
        list ports 'lan4'
        option ipv6 '0'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.1.1'
        option netmask '255.255.255.0'
        option delegate '0'

config device
        option name 'dsl0'
        option macaddr 'xxxxxxxx'

config interface 'wan'
        option device 'dsl0.7'
        option proto 'pppoe'
        option username 'xxxxxxxx'
        option password 'xxxxxxxx'
        option ipv6 '1'
        option peerdns '0'
        list dns '192.168.4.4'

config interface 'wan6'
        option device '@wan'
        option proto 'dhcpv6'

config interface 'tailscale'
        option proto 'none'
        option device 'tailscale0'

config interface 'guest'
        option proto 'static'
        option device 'br-guest'
        option ipaddr '192.168.3.1'
        option netmask '255.255.255.0'

config device
        option type 'bridge'
        option name 'br-guest'

config interface 'server'
        option proto 'static'
        option device 'lan2'
        option ipaddr '192.168.4.1'
        option netmask '255.255.255.0'

config interface 'tv'
        option proto 'static'
        option device 'br-tv'
        option ipaddr '192.168.5.1'
        option netmask '255.255.255.0'

config device
        option type 'bridge'
        option name 'br-tv'

config device
        option type 'bridge'
        option name 'br-iot'
        option bridge_empty '1'

config interface 'iot'
        option proto 'static'
        option device 'br-iot'
        option ipaddr '192.168.6.1'
        option netmask '255.255.255.0'

config interface 'wireguardvpn'
        option proto 'wireguard'
        option private_key 'xxxxxxxx'
        option listen_port '51820'
        list addresses '192.168.9.1/24'

config wireguard_wireguardvpn
        option description 'xxxxxxxx'
        option preshared_key 'xxxxxxxx'
        option public_key 'xxxxxxxx'
        option private_key 'xxxxxxxx'
        list allowed_ips '192.168.9.23/32'
        option persistent_keepalive '25'

config interface 'wg_out'
        option proto 'wireguard'
        option private_key 'xxxxxxxx'
        list addresses '10.2.0.2/32'
        list dns '10.2.0.1'

config wireguard_wg_out
        option description 'Imported peer configuration'
        option public_key 'xxxxxxxx'
        list allowed_ips '0.0.0.0/0'
        option endpoint_host 'xxxxxxxx'
        option endpoint_port '51820'
        option route_allowed_ips '1'


cat /etc/config/firewall

config defaults
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan'

config zone
        option name 'wan'
        option input 'DROP'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list network 'wan'
        list network 'wan6'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Drop-Ping'
        option src 'wan'
        option proto 'icmp'
        option family 'ipv4'
        option target 'DROP'
        list icmp_type 'echo-request'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config zone
        option name 'tailscale'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        option masq '1'
        option mtu_fix '1'
        list network 'tailscale'

config zone
        option name 'guest'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'guest'

config rule
        option name 'Allow-DNS-Guest'
        option src 'guest'
        option dest_port '53'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCP-Guest'
        list proto 'udp'
        option src 'guest'
        option dest_port '67'
        option target 'ACCEPT'

config zone
        option name 'server'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'server'

config rule
        option name 'Allow-DNS-Server'
        option src 'server'
        option dest_port '53'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCP-Server'
        list proto 'udp'
        option src 'server'
        option dest_port '67'
        option target 'ACCEPT'

config rule
        option name 'Allow-SSH-Server'
        option src 'lan'
        option dest 'server'
        option dest_port '22'
        option target 'ACCEPT'

config zone
        option name 'tv'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'tv'

config forwarding
        option src 'tv'
        option dest 'wan'

config rule
        option name 'Allow-DNS-TV'
        option src 'tv'
        option dest_port '53'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCP-TV'
        list proto 'udp'
        option src 'tv'
        option dest_port '67'
        option target 'ACCEPT'

config rule
        option name 'Allow-HTTP-Server'
        option src 'lan'
        option dest 'server'
        option dest_port '80'
        option target 'ACCEPT'

config rule
        option name 'Allow-HTTPS-Server'
        option src 'lan'
        option dest 'server'
        option dest_port '443'
        option target 'ACCEPT'

config zone
        option name 'iot'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'iot'

config forwarding
        option src 'iot'
        option dest 'wan'

config rule
        option name 'Allow-DNS-IoT'
        option src 'iot'
        option dest_port '53'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCP-IoT'
        option src 'iot'
        option dest_port '67'
        option target 'ACCEPT'
        list proto 'udp'

config rule
        option name 'Allow-HTTP-IoT'
        option src 'lan'
        option dest 'iot'
        option dest_port '80'
        option target 'ACCEPT'

config rule
        option name 'Allow-Homeassist'
        list proto 'tcp'
        option src 'iot'
        list src_ip '192.168.6.3'
        option dest 'server'
        option target 'ACCEPT'
        list dest_ip '192.168.4.4'
        option dest_port '8123'

config rule
        option name 'Allow-Server-To-Shelly'
        option src 'server'
        list src_ip '192.168.4.4'
        option dest 'iot'
        list dest_ip '192.168.6.3'
        option target 'ACCEPT'

config rule
        option name 'Tailscale'
        list proto 'udp'
        option src 'lan'
        option dest 'server'
        option dest_port '41641'
        option target 'ACCEPT'

config rule
        option name 'Tailscale2'
        list proto 'udp'
        option src 'server'
        option dest 'lan'
        option dest_port '41641'
        option target 'ACCEPT'

config rule
        option name 'Allow-VPN-In'
        list proto 'udp'
        option src 'wan'
        option dest_port '51820'
        option target 'ACCEPT'

config zone
        option name 'wg_in'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'wireguardvpn'

config forwarding
        option src 'wg_in'
        option dest 'server'

config zone 'vpn'
        option name 'wg_out'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list network 'wg_out'

config forwarding 'lan_vpn'
        option src 'lan'
        option dest 'wg_out'

config redirect
        option dest 'server'
        option target 'DNAT'
        option name 'LAN-DNS-to-wg_out'
        option src 'lan'
        option src_dport '53'
        option dest_ip '192.168.4.4'
        option dest_port '53'
        option enabled '0'

config forwarding
        option src 'lan'
        option dest 'server'

config forwarding
        option src 'server'
        option dest 'wan'

config nat
        list proto 'tcp'
        list proto 'udp'
        option src 'server'
        option dest_ip '192.168.4.4'
        option dest_port '53'
        option target 'MASQUERADE'
        option enabled '0'

config redirect
        option dest 'wg_out'
        option target 'DNAT'
        option name 'server-DNS-to-wg_out'
        option src 'server'
        option src_dport '53'
        option dest_ip '10.2.0.1'
        option dest_port '53'
        option src_ip '192.168.4.4'
        option enabled '0'

config rule
        option name 'Allow-Server-DNS-to-wg_out'
        option src 'server'
        option dest 'wg_out'
        list dest_ip '10.2.0.1'
        option dest_port '53'
        option target 'ACCEPT'

config redirect
        option dest 'server'
        option target 'DNAT'
        option name 'blub'
        option src 'wg_out'
        option src_dport '53'
        option dest_ip '192.168.4.4'
        option dest_port '53'
        option enabled '0'

config redirect
        option dest 'wg_out'
        option target 'DNAT'
        option name 'Lan-DNS-to-wg_out'
        option src 'lan'
        option src_dport '53'
        option dest_ip '10.2.0.1'
        option dest_port '53'