I’m trying to setup Wireguard to use as a VPN on my server using this guide. I currently run Pihole on the same machine.
LAN
192.168.1.*
WG
10.14.0.*
WG Server Addr
10.14.0.1
WG Client Addr
10.14.0.10
The handshake succeeds, and I can even ping IP addresses. However, it doesn’t receive DNS responses. I checked in Wireshark and see the following:
WAN Client IP ->
Server IP
[Wireguard]
WG Client IP ->
Server IP
[DNS Request]
Server IP ->
Server IP
[DNS Request]
Server IP ->
Server IP
[DNS Response]
WG Server Addr ->
WG Client Addr
[DNS Response]
WG Client Addr ->
WG Server Addr
[ICMP Port unreachable]
I’m admittedly pretty inexperienced when it comes to routing, but I’ve been at this for days with no success. Any help would be greatly appreciated.
Edit
I now realize that it would have been relevant to mention the my Pihole instance was running inside a rootless podman container.
To test things further, I wrote a small echo server and spun it up on bare metal. Wireguard had no issues with that.
My guess is that something between wireguard and specifically rootless podman was going wrong. I still don’t know what, unfortunately.
My fix was to put Pihole in a privileged podman container with a network and static IP e.g. --net bridge:ip=10.88.0.230. I also put wireguard into a privileged podman container on the same network --net bridge. Finally, I set the peer DNS to the Pihole’s static IP on the podman network (10.88.0.230).
As I said before, I still don’t know why podman wasn’t replying to the correct IP initially. I’m happy with my fix, but I’d still prefer the containers to be rootless so feel free to message me if you have any suggestions.
I am. Server IP is 192.168.1.xxx. DNS server is running on that machine. It already allows access from all interfaces. I just don’t have port 53 natted from my router to avoid creating an open resolver.
No. I mean that my router doesn’t forward requests for port 53 to my server. My server’s firewall does allow access to port 53, and all my LAN devices are able to use it freely.
So, you’re running two exclusive DNS resolvers, one on your router and one on your pihole box? Or just one on the pihole box and using the local address of it for all LAN dns?
Why have a firewall on the pihole box at all? As long as it isnt in the DMZ you shouldn’t need it. I would try disabling it completely and see if dns on your wg peers starts working.
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !selfhosted@lemmy.world
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don’t control.
Rules:
Be civil: we’re here to support and learn from one another. Insults won’t be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it’s not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don’t duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
No trolling.
Resources:
selfh.st Newsletter and index of selfhosted software and apps
I am. Server IP is 192.168.1.xxx. DNS server is running on that machine. It already allows access from all interfaces. I just don’t have port 53 natted from my router to avoid creating an open resolver.
Do you mean you have all port 53 redirecting to your local DNS on your firewall?
No. I mean that my router doesn’t forward requests for port 53 to my server. My server’s firewall does allow access to port 53, and all my LAN devices are able to use it freely.
So, you’re running two exclusive DNS resolvers, one on your router and one on your pihole box? Or just one on the pihole box and using the local address of it for all LAN dns?
Why have a firewall on the pihole box at all? As long as it isnt in the DMZ you shouldn’t need it. I would try disabling it completely and see if dns on your wg peers starts working.
Just one on the pihole box and using the local address of it for all LAN DNS.
It is in the DMZ. I also use the box for Jellyfin so I want it remotely accessible.
I just tried disabling it for a short while with the same result. It still gets blocked in the 10.14.0.* network.