When using WireGuard with all traffic routed through the tunnel the DNS used by the clients is the DNS set under Network>DNS. I believe it should be the DNS set in my WireGuard config. Using FW 4.3.1
'# Spitz
[Interface]
PrivateKey =
Address = 10.50.1.7/32
DNS = 192.168.1.1
'# RT-AC86U ‘server’ (wg21)
[Peer]
PublicKey =
AllowedIPs = 0.0.0.0/0
Endpoint = Home IP Address:51820
PresharedKey =
PersistentKeepalive = 25
'# Spitz End
I can post the WG log if needed but after a quick look I didn’t see anything obvious.
When using OpenVPN clients are using the VPN’s DNS.
It should use the DNS that you set in DNS page.
Please print the following command output to check:
ip route get 192.168.1.1
ip route show table 51
cat /tmp/resolv.conf.wg
cat /tmp/etc/dnsmasq.conf.cfg01411c
That worked but seems like it’s very limiting. For example, say I typically use the VPN for SIM1 but not SIM2. So, when using SIM2 I am forced to use the ISP’s DNS servers vs a DNS server of my choice. Would changing how this works be something you might be able to consider in the future? Thanks.
root@GL-X3000:~# ip route get 192.168.1.1
192.168.1.1 dev wgclient src 10.50.1.7 uid 0
cache
root@GL-X3000:~# ip route show table 51
default via 100.70.51.141 dev rmnet_mhi0 proto static src 100.70.51.140 metric 40
52.144.113.70 via 100.70.51.141 dev rmnet_mhi0 proto static metric 40
100.70.51.136/29 dev rmnet_mhi0 proto static scope link metric 40
192.168.1.1 dev wgclient scope link
192.168.8.0/24 dev br-lan proto kernel scope link src 192.168.8.1
root@GL-X3000:~# cat /tmp/resolv.conf.wg
'# Interface wgclient
nameserver 192.168.1.1
root@GL-X3000:~# cat /tmp/etc/dnsmasq.conf.cfg01411c
'# auto-generated config file from /etc/config/dhcp
conf-file=/etc/dnsmasq.conf
dhcp-authoritative
domain-needed
localise-queries
read-ethers
enable-ubus=dnsmasq
expand-hosts
bind-dynamic
local-service
edns-packet-max=1232
domain=lan
local=/lan/
addn-hosts=/tmp/hosts
dhcp-leasefile=/tmp/dhcp.leases
dhcp-script=/usr/lib/dnsmasq/dhcp-script.sh
script-arp
resolv-file=/tmp/resolv.conf.d/resolv.conf.auto
dhcp-broadcast=tag:needs-broadcast
conf-dir=/tmp/dnsmasq.d
user=dnsmasq
group=dnsmasq
dhcp-ignore-names=tag:dhcp_bogus_hostname
conf-file=/usr/share/dnsmasq/dhcpbogushostname.conf
bogus-priv
conf-file=/usr/share/dnsmasq/rfc6761.conf
dhcp-range=set:lan,192.168.8.100,192.168.8.249,255.255.255.0,12h
root@GL-X3000:~#
Edit: Apostrophes added in front of # symbols to remove formatting code.
It sounds like a bug. are you referring to the DNS server that you chose in the Network → DNS page?
What I’m saying is that for SIM 1 to use the VPN assigned in the WireGuard config I need to set the system DNS to automatic. If I then switch to SIM 2 where I don’t use a VPN I will be using the ISP DNS servers as the router’s system DNS is set to automatic. But I don’t want to use the ISP’s DNS servers for SIM 2 so now I need to manually switch the system DNS to the DNS server of my choice. Now when I switch back to SIM 1 and use the VPN I need to switch the system DNS back to automatic. This behavior doesn’t seem right to me. The WireGuard VPN should use the DNS specified in the config file regardless of the system setting for DNS.
The OpenVPN client is working “correctly” in that it is using the DNS server specified in the VPN config regardless of the system setting.
There is no abnormality in the debug information. So I think you don’t need to set Manual DNS. The issue may be that the 192.168.1.1 DNS server is not accessible on the X3000 router.
If you change 192.168.1.1 to 1.1.1.1 for the original WireGuard config file, will it work as expected?
Do you disable IP masquerading?
Please try ping 192.168.1.1 to check if it is reachable.
But I want to set manual DNS so that when I’m using SIM 2 with no VPN it uses the DNS server of my choice.
With IP Masquerading on:
With Network>DNS set to automatic I AM able to use 192.168.1.1 for my DNS servers. With Network>DNS set to manual I AM NOT able to use 192.168.1.1 for my DNS servers and it uses the server set in Network>DNS>manual. I am able to successfully ping 192.168.1.1 with either Network>DNS setting.
I have set the WireGuard config to use 9.9.9.9 (192.168.1.1 uses 1.1.1.1 so I picked something different).
With Network>DNS set to automatic I AM able to use 9.9.9.9 for my DNS servers. With Network>DNS set to manual I AM NOT able to use 9.9.9.9 for my DNS servers and it uses the server set in Network>DNS>manual.
With IP Masquerading off:
With Network>DNS set to manual I AM NOT able to access the internet. The tunnel is broken.
With Network>DNS set to automatic I AM NOT able to access the internet. The tunnel is broken.
Edit:
I want to reiterate that when using OpenVPN the DNS server in the OpenVPN config is used regardless of the Network>DNS setting. This is my expected behavior when using a VPN.
Thank you for the detailed tests. I will check the OpenVPN client, as I assume the manually set DNS has the highest priority. We will find a way to make the VPN DNS override the manual DNS, which is more reasonable.
I test opevpn client, it will also use manual DNS setting designated server. How do you make sure the DNS traffic is via the server by the OpenVPN config?
I use this command to test
tcpdump -i ovpnclient -s0 -n port 53
I am using ipleak.net to check which DNS servers are being used.
I am happy to report that the issue appears to be fixed on 4.3.3. When using manual DNS servers under Network>DNS the DNS server specified in the WireGuard config is being used now.
1 Like
