After successfully installing DNScrypt-proxyv2 with Anonymised DNS (as confirmed by multiple DNS testing sites) I installed a Wireguard server on my router. Upon installing/configuring the Wireguard peer/client on a computer (connected to network via ethernet), I have no internet connectivity. I presume this is due to the DNS configuration in relation to the WG peer, but I am not certain.
The install script I used establishes a firewall Traffic Rule to accomodate the Wireguard server. However, one install video I watched opts to establish a firewall port forward rule instead. Assuming one of these is the cause, is there a preference here? How do they differ from eachother?
One suggestion I saw said to point the listen_address of the dnscrypt conf file to point to the Wireguard server & port. Could it be this simple to fix?
Below are the neccessary conf files. If I've missed any, please request and I will provide. Can someone please help me get this sorted?
@mittkonto @trendy you appear to have advanced knowledge of this setup. Would you be able to weigh in?
Firewall conf:
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-IPSec-ESP'
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'
config rule
option name 'Allow-ISAKMP'
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'
config redirect
option name 'Divert-DNS, port 53'
option src 'lan'
option dest 'lan'
option src_dport '53'
option dest_port '53'
option target 'DNAT'
config rule 'wg'
option name 'Allow-WireGuard'
option src 'wan'
option dest_port '51820'
option proto 'udp'
option target 'ACCEPT'
Network conf
config globals 'globals'
option ula_prefix ''
option packet_steering '1'
config device
option name 'br-lan'
option type 'bridge'
list ports 'lan1'
list ports 'lan2'
list ports 'lan3'
list ports 'lan4'
config interface 'lan'
option device 'br-lan'
option proto 'static'
option ipaddr '192.168.1.1'
option netmask '255.255.255.0'
option ip6assign '60'
config interface 'wan'
option device 'wan'
option proto 'dhcp'
option peerdns '0'
config interface 'wan6'
option device 'wan'
option proto 'dhcpv6'
config interface 'wg0'
option proto 'wireguard'
option private_key ''
option listen_port '51820'
list addresses '192.168.9.1/24'
list addresses 'fdf1:7610:d152:3a9c::1/64'
config wireguard_wg0
option public_key ''
option private_key ''
option description 'Client 1'
option route_allowed_ips '1'
list allowed_ips '192.168.9.2/32'
DHCP conf
option rebind_protection '1'
option rebind_localhost '1'
option local '/lan/'
option domain 'lan'
option expandhosts '1'
option nonegcache '0'
option cachesize '0'
option authoritative '1'
option readethers '1'
option leasefile '/tmp/dhcp.leases'
option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
option nonwildcard '1'
option localservice '1'
option ednspacket_max '1232'
option filter_aaaa '0'
option filter_a '0'
list server '127.0.0.53'
option noresolv '1'
option localuse '1'
config dhcp 'lan'
option interface 'lan'
option start '100'
option limit '150'
option leasetime '12h'
option dhcpv4 'server'
option dhcpv6 'server'
option ra 'server'
option ra_slaac '1'
list ra_flags 'managed-config'
list ra_flags 'other-config'
config dhcp 'wan'
option interface 'wan'
option ignore '1'
config odhcpd 'odhcpd'
option maindhcp '0'
option leasefile '/tmp/hosts/odhcpd'
option leasetrigger '/usr/sbin/odhcpd-update'
option loglevel '4'
DNSCrypt-proxy toml (only the active items are shown)
server_names = ['quad9-dnscrypt-ip4-filter-pri', 'dns.b33.network-dnscrypt']
listen_addresses = ['127.0.0.53:53']
max_clients = 250
ipv4_servers = true
ipv6_servers = false
dnscrypt_servers = true
doh_servers = true
odoh_servers = false
require_dnssec = true
require_nolog = true
require_nofilter = true
force_tcp = false
http3 = false
timeout = 5000
keepalive = 30
cert_refresh_delay = 240
bootstrap_resolvers = ['9.9.9.11:53', '8.8.8.8:53']
ignore_system_dns = true
netprobe_timeout = 60
netprobe_address = '9.9.9.9:53'
block_ipv6 = false
block_unqualified = true
block_undelegated = true
reject_ttl = 10
cache = true
cache_size = 4096
cache_min_ttl = 2400
cache_max_ttl = 86400
cache_neg_min_ttl = 60
cache_neg_max_ttl = 600
[sources.public-resolvers]
urls = ['https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v3/public-resolvers.md', 'https://download.dnscrypt
cache_file = 'public-resolvers.md'
minisign_key = 'RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3'
refresh_delay = 72
prefix = ''
[sources.relays]
urls = ['https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v3/relays.md', 'https://download.dnscrypt.info/reso
cache_file = 'relays.md'
minisign_key = 'RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3'
refresh_delay = 72
prefix = ''
fragments_blocked = ['cisco', 'cisco-ipv6', 'cisco-familyshield', 'cisco-familyshield-ipv6', 'cleanbrowsing-adult', 'cleanbrowsing-ad
routes = [
{ server_name='quad9-dnscrypt-ip4-filter-pri', via=['sdns://gRMxNzQuMTM4LjI5LjE3NToxNDQz', 'sdns://gRE3MC4zNi4xNzAuMTI2OjQ0Mw'] },
{ server_name='dns.b33.network-dnscrypt', via=['sdns://gQ4yMTMuMjAyLjIxNi4xMg', 'sdns://gQ8xNjMuMTcyLjE4MC4xMjU'] }
]
skip_incompatible = true
Wireguard peer (client) tunnel conf:
[Interface]
PrivateKey =
Address = 192.168.9.2/32
DNS = 127.0.0.53
[Peer]
PublicKey =
AllowedIPs = 0.0.0.0/0
Endpoint = 192.168.x.x:51820
