Wireguard DNS issue with local hostnames

Shad0wca7 · 2018-11-24T21:12:20.024Z

I’m having issues with getting DNS resolution of local hosts to work correctly with my mini travel router and Wireguard.

About the basic setup - a picture paints a thousand words allegedly (please see attached). Yes I know my drawing and writing skills are that of a 6-year old - or a doctor. How about some marks for originality?

552096×484 134 KB

To explain a bit further:

Travel router running OpenWRT (GL-INET AR300M). Google DNS, set to use DNS IP of Wireguard server when connection is established (in Wireguard config settings)
Pfsense vm, main router for house and other VMs on internal network (port open and forwarded for Wireguard). Uses unbound resolver and is the default DNS for the home network. Forwards DNS to Cloudflare.
Wireguard VM, set up using Streisand. Uses dnsmasq, has the Pfsense box set as the nameserver.
Other VMs - all route and resolve correctly through the pfsense box.

Wireguard connects happily and traffic is routed correctly through the pfsense box as confirmed by using ipleak.net. Unfortunately resolution of local host names (e.g. the pfsense router and other vms doesn’t work correctly).

Diagnostics so far:

nslookup from the Wireguard box resolves local names correctly.

nslookup from the travel router does not resolve local names correctly.
nslookup from the mobile clients does not resolve local names correctly.
I’ve tried setting the Wireguard DNS server IP address on the Travel Router (1) to the IP of the pfSense router - no change

So I believe the issue is on the travel router but here I’m stuck - it looks OK and I have verified that the DNS settings in Wireguard are being picked up correctly - if I put nonsense in that field then nothing resolves.

What am I missing?!

manderss99 · 2018-11-25T05:16:07.114Z

I have had similar problems but updated my hosts file as a workaround.
Could be related to this?

AS-750S Slate Rotuer: DNS fix to allow use of internal DNS server with Wireguard Client Technical Support for Routers

We had to edit /etc/init.d/wireguard to use the DNS entry on the Slate Wireguard Client configuration page. This edit modifies the dnsmasq DHCP configuration to deliver the configured DNS server when the Wireguard VPN comes up. Unfortunately this fix requires the computer clients to renew their lease after the VPN is established to retrieve the new DNS entry. Without these changes, we were unable to make the Slate clients direct their DNS queries to the configured DNS server through the tunne…

alzhao · 2018-11-25T06:24:41.551Z

Can you just ping the local domain name to check if it resolves?

Otherwise you may put the local domain list in the client router.

Shad0wca7 · 2018-11-25T15:12:09.650Z

As in ping my internal domain name? It doesn’t resolve…

Shad0wca7 · 2018-11-25T15:21:32.688Z

This does seem to be related - I really don’t want to manually update my hosts file with everything on the remote network to which I’m tunnelling…

From my understanding in the latest firmware, when WG comes up, it creates a new config with the upstream nameserver and gives this to dnsmasq - it doesn’t appear to be working correctly however.

manderss99 · 2018-11-25T16:17:36.174Z

Shad0wca7:

This does seem to be related - I really don’t want to manually update my hosts file with everything on the remote network to which I’m tunnelling…

me neither, works fine using ubuntu clients.
hopefully GL will look into this bug.

alzhao · 2024-03-25T08:19:07.169Z