So i mostly followed this guide: https://www.ivpn.net/setup/router/opnsense-wireguard/ but as that guide is for routing all traffic of the whole network over the VPN, i made some adjustments. Those are the following:
1. Instead of setting MSS to 1412 on my LAN interface, i set it on the specific VLAN that I want to use for this.
2. The guide is made for opnsense 24.1.6, i'm on 26.7.7 so the NAT settings look different. I clicked source NAT, selected Hybrid source NAT rule generation, and made a new rule: - network interface ivpn (this is the wireguard instance i made for ivpn), version ipv4, protocol *, source <the vlan i want to use> network, port *, dest *, port *, translate source ip "interface address", translate source port *
3. Instead of configuring the wg dns server 172.16.0.1 on DCHP, i configured it within the clients by replacing the text in /etc/resolv.conf with "nameserver 172.16.0.1"
4. in my peer, i put in the eindpoint the IP of the ivpn wg server i want to connect to. It only successfully handshakes with the IP, not with the hostname. none of the DNS seem to work in the vlan im doing this on, so that tracks.
So currently i have no DNS whatsoever working on this VLAN. That seems to be the problem.
I'm kind of stuck at this point, if anyone knows something i can try it'd be great. Thanks!
Hi,
I have not tested this exact setup with IVPN, so these are suggestions for what to check.
1) Find out whether the problem is DNS or routing. From a client on the VLAN, try to reach a public IP address directly, then try a name. If the IP works and the name does not, it is DNS only. If the IP does not work either, the routing or the outbound NAT is the problem.
2) Rule order on the VLAN. If your VLAN has a rule that sends everything through the VPN gateway, it may also send the traffic meant for the firewall itself, such as DNS to the VLAN address, into the tunnel. Put a pass rule above it, without a gateway, that allows the VLAN to reach the firewall address on the DNS port. Then use the tunnel DNS address only for the traffic that really has to go through the VPN.
3) The tunnel DNS address. 172.16.0.1 is inside the tunnel, so it is only reachable if the traffic is routed through the VPN gateway. Check that your peer allows all addresses, and that the gateway for the WireGuard interface is up in System, Gateways.
4) The endpoint name. The firewall resolves the endpoint hostname with its own DNS settings, not through the VLAN. If it fails there, check the DNS servers in System, Settings, General. Using the IP address as the endpoint also works, with the drawback that you have to update it if the provider changes it.
5) To see what really happens, run a packet capture on the WireGuard interface while a client tries to resolve a name. If you see the queries leave and no answers come back, the problem is on the tunnel side; if you see nothing, the traffic is not reaching the tunnel.
Which one is it in your case, the IP test or the name test?
Sergio