I’ve set up a lightweight VM with OpenWRT on Proxmox. A wireguard interface connected successfully to ProtonVPN as a client. Installed tailscale with advertising exit node. Both the wireguard is in their respective firewall zones, both are masqueraded. With the Policy-based routing package I’ve successfully managed to get the tailscale interface to use the wireguard interface as gateway. I also set in pbr a DNS rule that tailscale IPs should use Proton’s 10.2.0.1 DNS
Connecting to the exit node from another tailnet partially works, the client’s IP is a proton IP. But, the DNS resolvers it sees are the ones OpenWRT gets from the Proxmox host. I’ve tried setting proton’s DNS as custom DNS on both the wireguard and tailscale interfaces, but it changed nothing.
I only want exit node users to use Proton’s DNS, the OpenWRT itself should continue using the resolvers Proxmox provides. How to achieve this?
The IP 10.2.0.1 is a private range IP it cannot be reached by the router (and its apps) itself directly because of this and the fact that the IP can only be reached through wireguard interface. So a PBR DNS policy rule does not work here. Because PBR does not know howto reach the private IP and the DNS policy rule does not allow to add an interface.
In theory you could use a simple policy rule within PBR instead to achive this:
src_addr (one client or subnet)
dest_port 53
Interface wgvpn
But then you have to make the clients aware of the DNS server. Which does not make much sense if you have more then one or two clients. If you have more then you would use DNSMasq instance anyway.
So you would go this route (as I have it):
setup a new dnsmasq instance and give it as dns server the ProtonDNS (e. g. 10.2.0.1@vpn) and assign it to a zone (e. g. lan) to make it reachable via an IP the router knows.
create a firewall rule to intercept any DNS traffic comming from the zones you have in mind and force it to the new DNS server IP.
In this way you can even add an adblocker in between to filter out crap as I do.
EDIT: As a third option you could deal with routes and firewall rules directly also. Its not so difficult but you have to be aware that they exist if you use mainly a gui to manage the device.
Thanks for the reply! However, something’s still not right. The exit node client gets the proton IP, but the DNS resolvers are the ones coming through proxmox (and my main LAN).
I couldn’t set the listen port for the second dnsmasq instance to 53, even if I limited the first to only the LAN interface and the second to tailscale. Still complained that port already in use. Configs:
dhcp:
Well, I told you the basic about PBR. But your setup is huge/complex and hard to diagnose. Esp. the fact OpenWrt is running on Proxmox. This alone can be configured in several ways including some mayor errors like having just one NIC (which is error-prone configuring it right) or wrong wiring. Tailscale is another layer of complexity to this. I cannot diagnose this investing a huge amount of time here. This is certainly not a common household setup and more like a SB setup and out of scope and prop. the reason why nobody was answering to this topic at all. ;D
I don't know much about tailscale and its pitfalls/setup options. But it makes sense that in first place the clients are getting the LAN's DNS.
A short view to your config:
"Allow Tailscale DNS" and the following redirect rule do not make sense to me. 1st: What is listening on port 54 within your lan? 2nd: If a lan client sends a DNS request on port 53 and you want it redirect to port 54 you want to have an dest. IP too (so your 10.2.0.1). As I wrote already the router does not know howto reach this IP. So rediret to the 2nd DNS server IP having 10.2.0.1@device_vpn. As tailscale is a route into your LAN and you want to force certain clients to use specific DNS you have to force those clients to do so modifying your DNAT rule with clients IP's/MAC you want to steer (this is cumbersome). OpenWrt does not support IP range-based split DNS (AFAIK). So if you want easier setup you have to leverage ipset and use it as SRC for the firewall redirect rule.
Your DNS server needs the vpn device in addition 10.2.0.1@device_vpn because of the address. I'm not sure if tailscale device should be full masq'ed resp. if tailscale is doing those settings. Because I would think it should be like in=masq_off, out=masq_on. But I don't know tailscale.