Wireguard client & DNS
-
It was pretty trivial to set up a mobile client to use Wireguard as a roaming VPN.
I did however have some issues with DNS. I'd configured my client to point to one of the LAN interfaces for DNS in the Android client which didn't work. What i discovered in the packet trace is that the reply was coming back from the Wireguard interface address, so obviously being ignored by the client. It was easy enough to reconfigure the client to point to the pfsense's Wireguard interface address for DNS, but is this expected behaviour?
If so, might be worth adding to the knowledgebase.
-
That is expected for most UDP-based services. They reply from the closest interface to the user if the daemon is bound to any/all. If your DNS resolver was set to bind to specific interfaces that may not have happened, but that also has its own drawbacks.
Better to have the clients use the closest address anyhow.
-
@jimp Yep I guess it just wasn't obvious that Unbound would bind to the WG address as it's not necessarily an "interface" in the traditional sense in pfsense.
-
@griffo Same thing happened to me. Glad this thread was in the forums because, yeah (head slap), of course I should have set the client's DNS address to the Wireguard interface on the server. Thanks for posting!