Noob trying to get Wireguard working on vlans, Help!

[RoWAN Tree]

OK I've done what you said, is this the page you were talking about? (The top rule)

Update: I put the rules in exactly this order and it worked to reach what's my IP website, it showed the proton endpoint address.

That's a good thing right it means proton is working 👍😁👍? I don't know how to test DNS though.

I will add this rule to the other vlans

I enabled (DNSsec)and some other options like (far gateway) during the initial setup using the 9.9.9.9 but I'm not sure if I did that right. I know I put the proper information in the Services>Unbound DNS> DNS over TLS.

[BoNetTech]

Yes, that is the right page, and that is the right rule: destination "This Firewall", port domain (53), no gateway. The order is fine too.

Proton: if the what's-my-IP site shows the Proton endpoint, your traffic goes through the tunnel, so that part works. It doesn't test DNS, though.

How to test DNS (from the laptop on PERSONAL20):

Open a terminal or command prompt and run nslookup example.com. The line "Server:" should show 192.168.20.1 (your firewall). If it shows something else, the laptop is not using your firewall's DNS.
Open dnsleaktest.com and run the extended test. It should show Quad9 servers, not your ISP's.
In OPNsense: Services > Unbound DNS > Log File, or Reporting > Unbound DNS. You should see your queries there.

DNSSEC, far gateway, DNS over TLS:
– DNSSEC enabled is fine; Unbound will validate the answers.
– "Far gateway" belongs to System > Gateways. As far as I know, it is normally needed for WireGuard tunnels where the gateway address is outside the tunnel subnet. Since traffic goes out through Proton, it is working.
– Your DNS over TLS entries look correct: 9.9.9.9 and 149.112.112.112, port 853, Verify CN dns.quad9.net.

Next: copy the DNS rule to XBOXS10 and GUEST30, and to MGNT99 if you want DNS from the management network. Then test the kill switch by disabling the WireGuard instance briefly: pages from the VLANs should stop loading.

Sergio

[nero355]

I don't know how to test DNS though.

The commands nslookup/dig/drill are your best friends for DNS troubleshooting ;)

[RoWAN Tree]

I've done the steps but I do t quite understand who's IP is what.. I'm seeing different things from the terminal IPS running nslookup example.com, dig example.com compared to dnsleaktest.com ( screen shots below)

It shows the server as 127.0.0.1 port 53, when it comes to DNS its confusing.

I've noticed as well that the proton gateway is not the deafualt and never says active beside it unless I unplug the WAN cable.(2nd batch photos⬇️)

I've made the rule for each vlans as well in the same order as personal. When I try the Xbox I can get online but the whole homepage is empty.

  I have gamepass but it says " Sorry we can't show Gamepass games right now" whereas on my phone hotspot via proton wireguard to Xbox shows everything I've set DNS on my phone to 1.1.1.1 though no issues, leads me to think⬇️

 I did check every single option in. Services>Unbound>Blocklists maybe that has to do with it 😅

I'm not exactly sure what's going on so far everything that's been troubleshooted now works, this has been a massive help I'd be eating dust if not for the forum, again its greatly appreciated 👍

[RoWAN Tree]

2nd Photo Batch

[BoNetTech]

Good progress, and thanks for all the screenshots.

1. About 127.0.0.53. That is not your firewall: it is the local DNS stub of your Linux laptop (systemd-resolved). It forwards to whichever DNS servers your connections give it. To ask the firewall directly, run: nslookup example.com 192.168.20.1 (and resolvectl status to see which servers each connection uses).

2. The leak test showing ISP-like servers. If the laptop is also connected via Wi-Fi to your ISP router, systemd-resolved can send queries to that router's DNS. Disconnect Wi-Fi (or any other connection), then run dnsleaktest again. Also check that your browser isn't using its own DNS (e.g. Firefox "DNS over HTTPS"). And check in Services > Dnsmasq DNS & DHCP that PERSONAL20 hands out 192.168.20.1 as the DNS server.

3. Proton gateway "active". That is fine. "(active)" only marks the default gateway, which is WAN. Your VLAN rules force traffic through Proton, as shown by "Proton End point" on the IP test. Only the firewall's own traffic uses WAN.

4. Xbox. One thing at a time: set the Xbox DNS manually to 1.1.1.1 (as on your phone). If the homepage and Game Pass load, the problem is DNS: check Services > Unbound DNS > Blocklists (disable them) and try disabling DNSSEC for a test. If it still doesn't load, it may be the tunnel MTU: on Interfaces > WgProtonVPN set MSS to 1380 and test again.

Please take a config backup before each change, and tell us the result of each step.

Sergio