[Solved] DNS over Wireguard

Installing and Using OpenWrt Network and Wireless Configuration
1

Bottom-line - my dns leak tests keep showing my ISP DNS servers with Wireguard, although my IP address correctly shows my wireguard connection. PEr the luci interface, my Wireguard connection is up and running.

The rest of the story: I have the latest OpenWRT I just installed on a Cudy TR3000. Smooth install. I installed the luci and wireguard software, sans problems. Loaded my Wireguard profile, sans problem. The same wireguard profile I use on my gl-inet sft-1200, and all my other devices. The gl-inet is rock solid but because it's still has the 18+ series software, I figured an upgrade was due.

There must be a stupid simple setting I'm missing. And yes, I have named DNS servers in the "Advanced" tab of the Wireguard setup. I've tried various combinations of DHCP and DNS settings to no avail. I've set the "Firewall" tab in the Wireguard interface to my WAN interface. What am I missing?

2

Strict order and DNS weight?

3

Unfortunately using dns weight and strict order is not a very reliable solution, DNSMasq gives up really quick so there is a real chance of leakage nonetheless.

See my notes about this subject:

If the default routing is via WireGuard it just does not matter what DNS servers you are using as all traffic goes via WireGuard.

Problems usually arise if you are using Policy Based routing. So the question is are you?

4

At one point I reset OpenWRT to all the defaults, loaded my profile, and configured using the Wireguard protocol screens/tabs. I only set the DNS server (via my loaded profile) and the Firewall tab to "WAN". And I never set the strict order and dns weight settings. I've never had to do that in all my previous Wireguard settings.

5

It can help if you show us your configs, please connect to your OpenWRT device using ssh and copy the output of the following commands and post it here using the "Preformatted text

Remember to redact keys, passwords, MAC addresses and any public IP addresses you may have but do not redact private RFC 1918 IP addresses (192.168.X.X, 10.X.X.X and 172.16-32.X.X) as that is not needed:

ubus call system board
cat /etc/config/network
cat /etc/config/dhcp
cat /etc/config/firewall
ip route show
wg show
6

Will do. I'll do this later today. Got some stuff to do this am. Thanks for your help.

7 
root@OpenWrt:~# ubus call system board
{
"kernel": "6.12.94",
"hostname": "OpenWrt",
"system": "ARMv8 Processor rev 4",
"model": "Cudy TR3000 v1",
"board_name": "cudy,tr3000-v1",
"rootfs_type": "squashfs",
"release": {
"distribution": "OpenWrt",
"version": "25.12.5",
"firmware_url": "https://downloads.openwrt.org/",
"revision": "r33051-f5dae5ece4",
"target": "mediatek/filogic",
"description": "OpenWrt 25.12.5 r33051-f5dae5ece4",
"builddate": "1782737960"
}
}
root@OpenWrt:~# cat /etc/config/network

config interface 'loopback'
option device 'lo'
option proto 'static'
list ipaddr '127.0.0.1/8'

config globals 'globals'
option dhcp_default_duid '0004XXX'
option ula_prefix 'fdd0:323:XXXX::/48'
option packet_steering '1'

config device
option name 'br-lan'
option type 'bridge'
list ports 'eth1'

config interface 'lan'
option device 'br-lan'
option proto 'static'
option ip6assign '60'
list ipaddr '192.168.8.1/24'
option multipath 'off'

config interface 'wan'
option device 'eth0'
option proto 'dhcp'
option multipath 'off'

config interface 'wan6'
option device 'eth0'
option proto 'dhcpv6'
option disabled '1'
option auto '0'
option reqaddress 'try'
option reqprefix 'auto'
option norelease '1'
option multipath 'off'

config device
option name 'wg0'
option ipv6 '0'

config interface 'wg0'
option proto 'wireguard'
option private_key 'XXXX'
list addresses '10.102.40.3/24'
list addresses 'fd11:5ee:bad:XXXX::3/64'
list dns '192.168.1.1'
option multipath 'off'

config wireguard_wg0
option description 'XXXX.conf'
option public_key 'XXXXX'
option preshared_key 'XXXX'
list allowed_ips '0.0.0.0/0'
list allowed_ips '::/0'
option endpoint_host 'XXXX.synology.me'
option endpoint_port 'XXXX'
option route_allowed_ips '1'
option persistent_keepalive '25'

root@OpenWrt:~# cat /etc/config/dhcp

config dnsmasq
option domainneeded '1'
option boguspriv '1'
option filterwin2k '0'
option localise_queries '1'
option rebind_protection '1'
option rebind_localhost '1'
option local '/lan/'
option domain 'lan'
option expandhosts '1'
option nonegcache '0'
option cachesize '1000'
option authoritative '1'
option readethers '1'
option leasefile '/tmp/dhcp.leases'
option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
option nonwildcard '1'
option localservice '1'
option ednspacket_max '1232'
option filter_aaaa '0'
option filter_a '0'

config dhcp 'lan'
option interface 'lan'
option start '100'
option limit '150'
option leasetime '36h'
option dhcpv4 'server'

config dhcp 'wan'
option interface 'wan'
option ignore '1'

config odhcpd 'odhcpd'
option maindhcp '0'
option leasefile '/tmp/odhcpd.leases'
option leasetrigger '/usr/sbin/odhcpd-update'
option loglevel '4'
option piodir '/tmp/odhcpd-piodir'
option hostsdir '/tmp/hosts'

root@OpenWrt:~# cat /etc/config/firewall

config defaults
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option synflood_protect '1'

config zone
option name 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
list network 'lan'

config zone
option name 'wan'
option input 'REJECT'
option output 'ACCEPT'
option forward 'DROP'
option masq '1'
option mtu_fix '1'
list network 'wan'
list network 'wan6'
list network 'wg0'

config forwarding
option src 'lan'
option dest 'wan'

config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'

config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'

config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'

config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-IPSec-ESP'
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'

config rule
option name 'Allow-ISAKMP'
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'

root@OpenWrt:~# ip route show
default dev wg0 proto static scope link
10.102.40.0/24 dev wg0 proto kernel scope link src 10.102.40.3
75.67.179.233 via 192.168.1.254 dev eth0 proto static
192.168.1.0/24 dev eth0 proto kernel scope link src 192.168.1.65
192.168.8.0/24 dev br-lan proto kernel scope link src 192.168.8.1
root@OpenWrt:~# wg show
interface: wg0
public key: XXXXX
private key: (hidden)
listening port: 46362

peer: XXXXX
preshared key: (hidden)
endpoint: 75.XXXX:51820
allowed ips: 0.0.0.0/0, ::/0
latest handshake: 59 seconds ago
transfer: 361.54 KiB received, 252.88 KiB sent
persistent keepalive: every 25 seconds
8

Not related to your actual problem but what do you want with IPv6?
Your WireGuard interface seems to be able to use IPv6.

Now on to your problem:
You have WireGuard as default route so everything including traffic from the router and from DNSMasq should use that default route:

You can pick any DNS server you want and that will use the WG default route except a DNS server directly upstream because you have a specific route via the wan directly upstream:

and guess what that is the one you chose:

amazing: :rofl:

9

Ha ha lol. I did see that when I posted. Well… I’m not changing my whole house network remotely, so I guess I will have to pick other DNS servers.

Thanks for your feedback!! Most appreciated.

10

Glad we could help.

Just pick 1.1.1.1 or whatever you like
For redundancy pick two dns servers.

If your problem is solved, please consider marking this topic as [Solved]. See How to mark a topic as [Solved] for a short how-to.
Thanks! :slight_smile:

11

Switched the lan interface DHCP server settings to 1.1.1.2 / 1.0.0.2, and voila, everything works! Thanks everybody.