Noob trying to get Wireguard working on vlans, Help!

[RoWAN Tree]

OK I've done what you said, is this the page you were talking about? (The top rule)

Update: I put the rules in exactly this order and it worked to reach what's my IP website, it showed the proton endpoint address.

That's a good thing right it means proton is working 👍😁👍? I don't know how to test DNS though.

I will add this rule to the other vlans

I enabled (DNSsec)and some other options like (far gateway) during the initial setup using the 9.9.9.9 but I'm not sure if I did that right. I know I put the proper information in the Services>Unbound DNS> DNS over TLS.

[BoNetTech]

Yes, that is the right page, and that is the right rule: destination "This Firewall", port domain (53), no gateway. The order is fine too.

Proton: if the what's-my-IP site shows the Proton endpoint, your traffic goes through the tunnel, so that part works. It doesn't test DNS, though.

How to test DNS (from the laptop on PERSONAL20):

Open a terminal or command prompt and run nslookup example.com. The line "Server:" should show 192.168.20.1 (your firewall). If it shows something else, the laptop is not using your firewall's DNS.
Open dnsleaktest.com and run the extended test. It should show Quad9 servers, not your ISP's.
In OPNsense: Services > Unbound DNS > Log File, or Reporting > Unbound DNS. You should see your queries there.

DNSSEC, far gateway, DNS over TLS:
– DNSSEC enabled is fine; Unbound will validate the answers.
– "Far gateway" belongs to System > Gateways. As far as I know, it is normally needed for WireGuard tunnels where the gateway address is outside the tunnel subnet. Since traffic goes out through Proton, it is working.
– Your DNS over TLS entries look correct: 9.9.9.9 and 149.112.112.112, port 853, Verify CN dns.quad9.net.

Next: copy the DNS rule to XBOXS10 and GUEST30, and to MGNT99 if you want DNS from the management network. Then test the kill switch by disabling the WireGuard instance briefly: pages from the VLANs should stop loading.

Sergio