Hello!
I have two OpenWrt routers connected via a WireGuard VPN, and I have set up DNS forwarding. The DNS forwarding towards the VPN server works with the 'Local Service Only' option enabled by default, but for the DNS forwarding towards the client to work, I need to disable this option. Why does it work in one direction with this option enabled, but in the other direction only without it? And what are the risks of disabling it?
Thank you for your time and assistance!
Local == local to the router
Hence your server doesn't provide upstream resolution.
DNS resolution services will work.
See: https://openwrt.org/docs/guide-user/base-system/dhcp#all_options
I am talking about the option localservice '1' . By default, it is enabled. The DNS forwarding from the VPN client to the VPN server works this way. However, in the opposite direction, the DNS forwarding from the VPN server to the VPN client only works with localservice '0' . That's the whole difference in configuration. Why does the VPN server consider the VPN network local and provide DNS responses to it, while the client does not? This is the question.
vpn-server Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:10.8.0.1 P-t-P:10.8.0.1 Mask:255.255.255.0
UP POINTOPOINT RUNNING NOARP MTU:1420 Metric:1
RX packets:4552 errors:0 dropped:0 overruns:0 frame:0
TX packets:5011 errors:0 dropped:280 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:1029252 (1005.1 KiB) TX bytes:2956660 (2.8 MiB)
vpn-client Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:10.8.0.3 P-t-P:10.8.0.3 Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MTU:1420 Metric:1
RX packets:4984 errors:0 dropped:0 overruns:0 frame:0
TX packets:4555 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:2943016 (2.8 MiB) TX bytes:1029536 (1005.4 KiB)
I understood.
Traffic between the networks is working correctly; all hosts can see each other by IP. The problem is only with DNS forwarding. It works to the server with the default settings, but in the opposite direction, the client needs to set the option localservice '0'
The DNS query forward comes from the server to the client, but the client does not respond to it without this option.
Perhaps it's because the VPN server creates an interface for the entire VPN network, while the client only creates one for its own address. This is where the difference lies. Therefore, the DNS on the server considers the VPN network local, while on the client it does not.
I am trying to understand whether this is a bug or by design. Maybe someone has encountered this.
DNS resolution works fine here over Wireguard on 23.05.4 on multiple devices running Wireguard tunnels.
Apologies, if you're unable or unwilling to answer the questions, perhaps we can glean from your config.
Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button:
Remember to redact passwords, MAC addresses and any public IP addresses you may have:
ubus call system board
cat /etc/config/network
cat /etc/config/dhcp
cat /etc/config/firewall
This would be the answer - 10.8.0.1 isn't local.
vpn-server-router
br-lan Link encap:Ethernet HWaddr B0:4E:26:F9:DB:B4
inet addr:10.47.1.1 Bcast:10.47.1.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:2570 errors:0 dropped:0 overruns:0 frame:0
TX packets:975 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:180111 (175.8 KiB) TX bytes:250610 (244.7 KiB)
vpn Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:10.8.0.1 P-t-P:10.8.0.1 Mask:255.255.255.0
UP POINTOPOINT RUNNING NOARP MTU:1420 Metric:1
RX packets:4552 errors:0 dropped:0 overruns:0 frame:0
TX packets:5011 errors:0 dropped:280 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:1029252 (1005.1 KiB) TX bytes:2956660 (2.8 MiB)
config dnsmasq
option localise_queries '1'
option expandhosts '1'
option readethers '1'
option leasefile '/tmp/dhcp.leases'
option rebind_localhost '1'
option rebind_protection '1'
option domainneeded '1'
option domain 'server'
option local '/server/'
option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
option authoritative '1'
list rebind_domain 'client'
list server '/client/10.47.3.1'
option localservice '1'
vpn-clent-router
br-lan Link encap:Ethernet HWaddr D8:47:32:C2:81:A8
inet addr:10.47.3.1 Bcast:10.47.3.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:162171 errors:0 dropped:0 overruns:0 frame:0
TX packets:222397 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:38444998 (36.6 MiB) TX bytes:210870349 (201.1 MiB)
vpn Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:10.8.0.3 P-t-P:10.8.0.3 Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MTU:1420 Metric:1
RX packets:4984 errors:0 dropped:0 overruns:0 frame:0
TX packets:4555 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:2943016 (2.8 MiB) TX bytes:1029536 (1005.4 KiB)
config dnsmasq
option localise_queries '1'
option expandhosts '1'
option readethers '1'
option leasefile '/tmp/dhcp.leases'
option rebind_localhost '1'
option rebind_protection '1'
option domainneeded '1'
option domain 'client'
option local '/client/'
option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
option authoritative '1'
list rebind_domain 'server'
list server '/server/10.47.1.1'
option localservice '0'
On each side firewall allows traffic between br-lan and vpn, no problem with it.
Are you seeking clarification or seeking an answer to another inquiry?
The VPN client NATs the wg traffic so that it is considered local traffic
To be clear, my understanding is that the OP has an issue with the following DNS inquiry: SRC/query 10.8.0.1 > DST/resolver 10.8.0.3
In any case, whether the SRC is 10.8.0.1 or 10
41.3.0/24 - this isn't local to the remote device. That explains the OP's inquiry.
So, the difference is that the VPN server uses the 255.255.255.0 for its interface, while the VPN client uses 255.255.255.255, which allows the server to consider the VPN network local and respond on dns request with localservice '1' option, while the client does not consider the VPN network local and only responds with the localservice '0' option, right?
I was just suggesting this here.
Suggesting as a possible explanation
So, there is no other way for DNS forwarding from server to client except with localservice '0' on client? And that is correct way?
Yes! I setup vpn on client with mask 255.255.255.0. And it works now with localservice '1'! Thank you for helping me understand.
vpn Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:10.8.0.3 P-t-P:10.8.0.3 Mask:255.255.255.0
UP POINTOPOINT RUNNING NOARP MTU:1420 Metric:1
RX packets:1 errors:0 dropped:0 overruns:0 frame:0
TX packets:2 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:92 (92.0 B) TX bytes:180 (180.0 B)This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.