FW rules? DNS problem? Get no connection with adguard on WLAN.

[bread]

Hey!
After some use of OPNsense I still don't understand the logic of the rules.
Especially I get no access from WLAN to WAN if I use the LAN-IP of the OPNsense (Adguard) as DNS server for Clients.

1. I stopped to use floating rules for better understanding of whats going on.
2. LAN: LAN net to PrivateNetworks net - allow PrivateNetworks for LANdevices
3. PrivateNetworks: Pr.Net.Devices to !PrivateNetworks - allow Pr.Net.Devices to WAN
    PrivateNetworks: Pr.Net. ICMP to any - allow ping within Pr.Net.
4. WLAN: WLAN net to Pr.Net. net - allow Pr.Net. for WLAN devices

I have also some Wireguard rules and Rules for Synology, they work.

The Clients in WLAN connect to ipfire Interface, I use it as access point.
DNS there is set recursive mode, so ipfire contacts the root server directly for its own purposes.

If I set the ipfire-IP ad DNS on the WLAN clients, i get connection to the LAN and WAN, so everything works, but as I understand, I don't use Adguard then.

If I set LAN-IP of the OPNsense (Adguard) as DNS on the WLAN clients, I get no connection to WAN, but connection to LAN.
Why that??

The strange thing is, I see the requests of the mobile client from WLAN in the Adguard dashboard if I go via VPN and choose LAN-IP of the OPNsense (Adguard) as DNS, but I can not get out to the Internet. If I just use directly WLAN on the mobile client and set Adguard as DNS, I don't even see any requests in the Adguard dashboard.

Does it have to do with FW rules, or is it some configuration between unbound and adguard (and maybe ipfire in recursive mode)? Or is it just some DNS problem (as nearly always if smth doesn't work)?

cheers
bread

[bread]

ok, it's an issue with ipfire and I solve it as it seems!

I don't know, why I can not set the LAN-IP of the OPNsense as DNS for clients, but if I set the IP of the interface the clients are connected to, everything seems to work.

The special problem with WLAN is because of the access point. If I set the IP of the ipfire as DNS for WLAN clients, the ipfire resolves in resursive mode and I get nothing from adguard. So I must set the interface IP of the NIC, the ipfire is connected to (the IP of the OPNsense on this special NIC). Then it works!