Wireguard DNS leak

reflector · 2018-11-15T07:06:18.867Z

Hi, I’m using this guide to set up WG WireGuard - GL.iNet Docs on my B1300, I’m connecting with my Android official Wireguard app, leaving DNS blank would have DNS leak, setting it 10.0.0.1 is leaking as well. any idea what should be the correct DNS to set to let the router resolve DNS?

also, how do we add more peers?

kyson-lok · 2018-11-15T07:17:01.937Z

If you use the Android app, please set the DNS to 8.8.8.8 or another reliable DNS server. The DNS filed can’t be blank.

reflector · 2018-11-15T07:43:14.038Z

so if DNS over TLS is set up in the router I can’t use that?

kyson-lok · 2018-11-15T07:46:27.879Z

Yes, you can use it to avoid dns leak. But you say you have B1300, while DNS over TLS only support in v3.0 firmware.

reflector · 2018-11-15T08:44:56.460Z

I’ve got dns over TLS set up using Unbound.
in that case, for extra peers do I do this?

config wireguard_wg0
option public_key ‘…’ # Client’s public key
option route_allowed_ips ‘1’
list allowed_ips ‘10.0.0.0/24’

instead of wg0 I set wg1, wg2 etc etc.
and what range do I set in allowed IPs?

kyson-lok · 2018-11-16T09:31:22.059Z

Is it server side? If you have some peer, you can set it as below.

config wireguard_wg0
    option public_key ‘…’ # Client1’s public key
    option route_allowed_ips ‘1’
    list allowed_ips ‘10.0.0.2/32’

config wireguard_wg0
    option public_key ‘…’ # Client2’s public key
    option route_allowed_ips ‘1’
    list allowed_ips ‘10.0.0.3/32’

reflector · 2019-02-01T07:23:40.041Z

getting back to this, I’ve upgraded to v3, tested the Wireguard server, all works well.
However I’d like to ask how do I change the default DNS generated in the config file? I’d like to set it to 192.168.8.1 so that it will resolve DoT by cloudflafe in the router instead of 64.6.64.6 now.

alzhao · 2019-02-01T09:44:08.338Z

I think you can just change the DNS in the config manually without touching the server

reflector · 2019-02-02T18:35:27.153Z

sure I know that’s possible, but for me it’s better if I can change the default DNS to the router, that way sharing it with other people is easy without changing any configuration.

alzhao · 2019-02-03T02:23:50.601Z

Can you set up customized dns server on the server to check if this option is put into WG config.

reflector · 2019-02-03T02:37:42.027Z

where is the server config file located? on the V3 GUI theres only server and port.

alzhao · 2019-02-03T03:28:33.717Z

I mean: more settings->custom dns server

reflector · 2019-02-03T04:03:01.906Z

currently I have DNS over TLS checked on that page.
WG server settings does not reflect that, neither is it my ISP DNS server.

alzhao · 2019-02-03T07:54:45.405Z

I mean you can set up a custom dns server in the server side.

DNS via tls will not pass to the client in wireguard settings.

reflector · 2019-02-03T08:17:43.068Z

that’s the problem, which is why I want the DNS to default to 192.168.8.1 so it will follow the router’s DNS, which is set to DNS over TLS.

alzhao · 2019-02-04T03:56:37.410Z

I think the best way is to change the DNS settings when you export settings from WG. This is the best way now.

192.168.8.1 for dns will not be accessible by client after WG connected. So you need to put in the WG settings.

reflector · 2019-02-04T05:54:39.256Z

OpenWrt Forum – 20 May 18

[SOLVED]The mobile device does not connect to the wireguard server

the address 192.168.1.1:51820 is the ip of the router, the devices have a thin ip address in the range 192.168.1.xxx router -> 192.168.1.1 pc -> 192.168.1.5 mobile device -> 192.168.1.2 I have finally installed termux on the mobile...

based on this, the solution is to set DNS to router IP.