[SOLVED] Did I set DNS correct and does this work as a kill-switch?

[veridiux]

I think I have this setup correctly. However, I'm a quite the beginner when it comes up to networking and have a few questions. First, the way I have it setup, will that work as a kill switch if the vpn drops? Second, does the way I setup the DNS forward that DNS so anything connected will use those DNS?

Thanks to anyone who doesn't mind checking.

[psherman]

@veridiux

First, the way I have it setup, will that work as a kill switch if the vpn drops?

This is not DNS, but yes, the firewall appears to be setup correctly to act as a kill-switch for lan connectivity in the event that the VPN drops.
If the other VPN endpoint is untrusted (i.e. a commercial VPN provider or similar), you should set the input rule on the wgfirewall zone to reject.

@veridiux

Second, does the way I setup the DNS forward that DNS so anything connected will use those DNS?

Yes, although indirectly and not 100% guaranteed.

Devices will generally use the DHCP advertised DNS servers. By default (and you probably didn't change this), it will point to the router. This is fine, though, as the router will then use the DNS servers you specified to perform its lookups (device asks router > router asks upstream dns > upstream dns returns answer to router > router returns answer to device).

But, some devices and operating systems (or users who manually configure their network settings) will have other preferred DNS servers. This will not prevent them from using the DNS server of their preference, which is why you cannot guarantee that they will use the dns that you are specifying. If you want to do that, you'll setup firewall rules in a configuration that is known as "dns hijacking."

[veridiux]

Thank you and I'll go ahead and set the input rule to reject just to make sure. I'll also see if I can figure out the "dns hijacking". Also, I want to thank you for earlier. You really pointed me in the right direction and made it a lot easier to set up the system again lol. I ended up having to start over earlier after a simple mistake in root... However, in the end it all worked out and I think I learned a little bit. So I just wanted to say thank you.

Now to see if I can figure out the dns hijacking

[psherman]

@veridiux

I'll also see if I can figure out the "dns hijacking"

DNS hijacking

@veridiux

Also, I want to thank you for earlier. You really pointed me in the right direction and made it a lot easier to set up the system again

Glad I could help... sorry you had to start over, but yes, this does make for good learning experiences. Sometimes I'll intentionally start over to make sure I can execute a sequence of steps correctly from start to finsih.

Meanwhile, for both this and the previous thread...

If your problem is solved, please consider marking this topic as [Solved]. See How to mark a topic as [Solved] for a short how-to.
Thanks!