Topics

1

23.7 Legacy Series / Mullvad WG Tunnels Loop Detected

« on: September 13, 2023, 03:09:08 pm »

I have 4 tunnels set up to mullvad with routes disabled, a gateway group set up, and used in firewall rules. For the past few months I've been getting consistent packet loss only on some of the tunnels. It used to only happen about once a day for about an hour, but now it's almost constant.

When all 4 tunnels are connected, logs in System > Log Files > General show

Code: [Select]

Notice kernel <5>wg1: loop detected If I bring down wg1, the loop changes to wg3, if I also bring down wg3, the remaining 2 tunnels are fine.

I have set up all 4 tunnels with the same methodology, so I don't think it's something in the wireguard settings. I've attached screenshots of them just in case I'm missing something.

I am more inclined to think it's a firewall rule somewhere, but neither wg1 or wg3 are in rules by themselves. I use the WG gateway group in my rules. How can I figure out what the exact cause of this loop is?

2

Virtual private networks / Tunnel to Mullvad suddenly won't connect

« on: January 23, 2023, 06:12:47 pm »

Hello,

Sometime last night my 3 tunnels to Mullvad all died for reasons I can't figure out and now they refuse to connect. They had been working fine for months prior to this.

I've rebooted, disabled all but 1 tunnel, and have tried using a different server than before. My subscription is still active. Which logs can I look at that might give me an idea of what's going wrong?

3

21.7 Legacy Series / DNS Fails w/ DNSCrypt

« on: October 09, 2021, 01:12:34 am »

I'm trying to get DoH working and am missing something. When I disable "DNS Query Forwarding" in Unbound, I get SERVFAILs back with "BOGUS (refused upstream)" for the queries.

Pihole Query Log:


My set up is Pihole -> Unbound -> DNSCrypt with mullvad & nextdns servers

I have the following in /usr/local/etc/unbound.opnsense.d/dnsCrypt-forward.conf:

Code: [Select]

server:
do-not-query-localhost: no

forward-zone:
name: "."
forward-addr: 127.0.0.1@5353
forward-addr: ::1@5353
Content of /usr/local/etc/dnscrypt-proxy/dnscrypt-proxy.toml:

Code: [Select]

server_names = ['mullvad-doh','mullvad-adblock-doh','nextdns']

listen_addresses = ['127.0.0.1:5353','[::1]:5353']

max_clients = 250

ipv4_servers = true

ipv6_servers = true

dnscrypt_servers = true

doh_servers = true

require_dnssec = true

require_nolog = true

require_nofilter = false

force_tcp = false


timeout = 2500
keepalive = 30

log_level = 2
log_file = '/var/log/dnscrypt-proxy/dnscrypt-proxy.log'
use_syslog = false

cert_refresh_delay = 240

dnscrypt_ephemeral_keys = false

tls_disable_session_tickets = false

fallback_resolver = '193.138.218.74:53'

ignore_system_dns = false

netprobe_timeout = 30
log_files_max_size = 10
log_files_max_age = 7
log_files_max_backups = 1

block_ipv6 = false

forwarding_rules = 'forwarding-rules.txt'
cloaking_rules = 'cloaking-rules.txt'

cache = true
cache_size = 2048
cache_min_ttl = 600
cache_max_ttl = 86400
cache_neg_min_ttl = 60
cache_neg_max_ttl = 600

[query_log]
file = '/var/log/dnscrypt-proxy/query.log'
format = 'tsv'

[nx_log]
file = '/var/log/dnscrypt-proxy/nx.log'
format = 'tsv'

[whitelist]
whitelist_file = 'whitelist.txt'
log_file = '/var/log/dnscrypt-proxy/whitelisted.log'
log_format = 'tsv'


[sources]
[sources.'public-resolvers']
urls = ['https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v2/public-resolvers.md', 'https://download.dnscrypt.info/resolvers-list/v2/public-resolvers.md']
cache_file = 'public-resolvers.md'
minisign_key = 'RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3'
refresh_delay = 72
prefix = ''

[static]

Contents of /var/unbound/unbound.conf:

Code: [Select]

##########################
# Unbound Configuration
##########################

##
# Server configuration
##
server:
chroot: /var/unbound
username: unbound
directory: /var/unbound
pidfile: /var/run/unbound.pid
root-hints: /var/unbound/root.hints
use-syslog: yes
port: 53
verbosity: 3
extended-statistics: yes
log-queries: yes
hide-identity: no
hide-version: no
harden-referral-path: no
do-ip4: yes
do-ip6: yes
do-udp: yes
do-tcp: yes
do-daemonize: yes
so-reuseport: yes
module-config: "validator iterator"
cache-max-ttl: 86400
cache-min-ttl: 0
harden-dnssec-stripped: no
serve-expired: no
outgoing-num-tcp: 10
incoming-num-tcp: 10
num-queries-per-thread: 4096
outgoing-range: 8192
infra-host-ttl: 900
infra-cache-numhosts: 10000
unwanted-reply-threshold: 0
jostle-timeout: 200
msg-cache-size: 20m
rrset-cache-size: 40m
num-threads: 4
msg-cache-slabs: 8
rrset-cache-slabs: 8
infra-cache-slabs: 8
key-cache-slabs: 8

qname-minimisation: yes
qname-minimisation-strict: yes

auto-trust-anchor-file: /var/unbound/root.key

prefetch: yes
prefetch-key: no

# Interface IP(s) to bind to
interface: 0.0.0.0
interface: ::
interface-automatic: yes



# DNS Rebinding



# Access lists
include: /var/unbound/access_lists.conf

# Static host entries
include: /var/unbound/host_entries.conf

# DHCP leases (if configured)
include: /var/unbound/dhcpleases.conf

# Domain overrides
include: /var/unbound/domainoverrides.conf

# Custom includes
include: /var/unbound/etc/*.conf

# Forwarding
forward-zone:
name: "."
forward-addr: 193.138.218.74
forward-addr: 10.0.8.1
forward-addr: 9.9.9.9


remote-control:
control-enable: yes
control-interface: 127.0.0.1
control-port: 953
server-key-file: /var/unbound/unbound_server.key
server-cert-file: /var/unbound/unbound_server.pem
control-key-file: /var/unbound/unbound_control.key
control-cert-file: /var/unbound/unbound_control.pem

I'm unsure what else to provide for insight. Any help would be greatly appreciated.

4

Virtual private networks / Wireguard performance expectations?

« on: March 20, 2021, 01:55:26 am »

Hello!

I am thinking about replacing pfSense with OPNSense (pf is going no matter what, regardless) and am curious about how much of a performance hit I'd expect to see with the WG userspace app.

On pfSense's (flawed) kernel implementation, with a Gigabit internet connection, I was getting in the range of 700Mbps down from Mullvad on a protectli device with a dual core intel CPU.

Roughly how much of a performance penalty would I expect from the OPNSense app?