Wireguard DNS issue with local hostnames


#1

I’m having issues with getting DNS resolution of local hosts to work correctly with my mini travel router and Wireguard.

About the basic setup - a picture paints a thousand words allegedly (please see attached). Yes I know my drawing and writing skills are that of a 6-year old - or a doctor. How about some marks for originality?

To explain a bit further:

  1. Travel router running OpenWRT (GL-INET AR300M). Google DNS, set to use DNS IP of Wireguard server when connection is established (in Wireguard config settings)
  2. Pfsense vm, main router for house and other VMs on internal network (port open and forwarded for Wireguard). Uses unbound resolver and is the default DNS for the home network. Forwards DNS to Cloudflare.
  3. Wireguard VM, set up using Streisand. Uses dnsmasq, has the Pfsense box set as the nameserver.
  4. Other VMs - all route and resolve correctly through the pfsense box.

Wireguard connects happily and traffic is routed correctly through the pfsense box as confirmed by using ipleak.net. Unfortunately resolution of local host names (e.g. the pfsense router and other vms doesn’t work correctly).

Diagnostics so far:

  • nslookup from the Wireguard box resolves local names correctly.
  • nslookup from the travel router does not resolve local names correctly.
  • nslookup from the mobile clients does not resolve local names correctly.
  • I’ve tried setting the Wireguard DNS server IP address on the Travel Router (1) to the IP of the pfSense router - no change

So I believe the issue is on the travel router but here I’m stuck - it looks OK and I have verified that the DNS settings in Wireguard are being picked up correctly - if I put nonsense in that field then nothing resolves.

What am I missing?!


#2

I have had similar problems but updated my hosts file as a workaround.
Could be related to this?


#3

Can you just ping the local domain name to check if it resolves?

Otherwise you may put the local domain list in the client router.


#4

As in ping my internal domain name? It doesn’t resolve…


#5

This does seem to be related - I really don’t want to manually update my hosts file with everything on the remote network to which I’m tunnelling…

From my understanding in the latest firmware, when WG comes up, it creates a new config with the upstream nameserver and gives this to dnsmasq - it doesn’t appear to be working correctly however.


#6

me neither, works fine using ubuntu clients.
hopefully GL will look into this bug.