Noob trying to get Wireguard working on vlans, Help!

[RoWAN Tree]

OK I've done what you said, is this the page you were talking about? (The top rule)

Update: I put the rules in exactly this order and it worked to reach what's my IP website, it showed the proton endpoint address.

That's a good thing right it means proton is working 👍😁👍? I don't know how to test DNS though.

I will add this rule to the other vlans

I enabled (DNSsec)and some other options like (far gateway) during the initial setup using the 9.9.9.9 but I'm not sure if I did that right. I know I put the proper information in the Services>Unbound DNS> DNS over TLS.

[BoNetTech]

Yes, that is the right page, and that is the right rule: destination "This Firewall", port domain (53), no gateway. The order is fine too.

Proton: if the what's-my-IP site shows the Proton endpoint, your traffic goes through the tunnel, so that part works. It doesn't test DNS, though.

How to test DNS (from the laptop on PERSONAL20):

Open a terminal or command prompt and run nslookup example.com. The line "Server:" should show 192.168.20.1 (your firewall). If it shows something else, the laptop is not using your firewall's DNS.
Open dnsleaktest.com and run the extended test. It should show Quad9 servers, not your ISP's.
In OPNsense: Services > Unbound DNS > Log File, or Reporting > Unbound DNS. You should see your queries there.

DNSSEC, far gateway, DNS over TLS:
– DNSSEC enabled is fine; Unbound will validate the answers.
– "Far gateway" belongs to System > Gateways. As far as I know, it is normally needed for WireGuard tunnels where the gateway address is outside the tunnel subnet. Since traffic goes out through Proton, it is working.
– Your DNS over TLS entries look correct: 9.9.9.9 and 149.112.112.112, port 853, Verify CN dns.quad9.net.

Next: copy the DNS rule to XBOXS10 and GUEST30, and to MGNT99 if you want DNS from the management network. Then test the kill switch by disabling the WireGuard instance briefly: pages from the VLANs should stop loading.

Sergio

[nero355]

I don't know how to test DNS though.

The commands nslookup/dig/drill are your best friends for DNS troubleshooting ;)

[RoWAN Tree]

I've done the steps but I do t quite understand who's IP is what.. I'm seeing different things from the terminal IPS running nslookup example.com, dig example.com compared to dnsleaktest.com ( screen shots below)

It shows the server as 127.0.0.1 port 53, when it comes to DNS its confusing.

I've noticed as well that the proton gateway is not the deafualt and never says active beside it unless I unplug the WAN cable.(2nd batch photos⬇️)

I've made the rule for each vlans as well in the same order as personal. When I try the Xbox I can get online but the whole homepage is empty.

  I have gamepass but it says " Sorry we can't show Gamepass games right now" whereas on my phone hotspot via proton wireguard to Xbox shows everything I've set DNS on my phone to 1.1.1.1 though no issues, leads me to think⬇️

 I did check every single option in. Services>Unbound>Blocklists maybe that has to do with it 😅

I'm not exactly sure what's going on so far everything that's been troubleshooted now works, this has been a massive help I'd be eating dust if not for the forum, again its greatly appreciated 👍

[RoWAN Tree]

2nd Photo Batch

[BoNetTech]

Good progress, and thanks for all the screenshots.

1. About 127.0.0.53. That is not your firewall: it is the local DNS stub of your Linux laptop (systemd-resolved). It forwards to whichever DNS servers your connections give it. To ask the firewall directly, run: nslookup example.com 192.168.20.1 (and resolvectl status to see which servers each connection uses).

2. The leak test showing ISP-like servers. If the laptop is also connected via Wi-Fi to your ISP router, systemd-resolved can send queries to that router's DNS. Disconnect Wi-Fi (or any other connection), then run dnsleaktest again. Also check that your browser isn't using its own DNS (e.g. Firefox "DNS over HTTPS"). And check in Services > Dnsmasq DNS & DHCP that PERSONAL20 hands out 192.168.20.1 as the DNS server.

3. Proton gateway "active". That is fine. "(active)" only marks the default gateway, which is WAN. Your VLAN rules force traffic through Proton, as shown by "Proton End point" on the IP test. Only the firewall's own traffic uses WAN.

4. Xbox. One thing at a time: set the Xbox DNS manually to 1.1.1.1 (as on your phone). If the homepage and Game Pass load, the problem is DNS: check Services > Unbound DNS > Blocklists (disable them) and try disabling DNSSEC for a test. If it still doesn't load, it may be the tunnel MTU: on Interfaces > WgProtonVPN set MSS to 1380 and test again.

Please take a config backup before each change, and tell us the result of each step.

Sergio

[RoWAN Tree]

If it can help someone else too its cool with me, whenever I'm online looking how to do whatever it is, I like tutorials and troubleshooting with screenshots too makes it easier for everyone 😅 especially for an entry level person like myself.

 I might not know all the technical stuff or have the skills, but I know that privacy, self learning, open sourced information is vital to humanity in the digital age, why not learn


I've followed what you said and double checked those command lines as well as browser DNS settings. (screenshots below)

I'm not sure what any of that means 🤔😅

[RoWAN Tree]

I think I was in the middle of setting this part up when chat gpt messed up last week, vlan 99 doesn't have anything setup.
My laptop is running CachyOS and in network manager its a wired manual ipv4 address of the one in the photo below.

I have various manual IPS on that connection and when I switch to personal vlan 20 I just switch it to wired automatic ipv4 to receive an IP in that personal range thats shown below. I confirm it does receive an IP ending between 20.100 - .20.200

Im still learning how IPs work, If I set it up like the rest of ranges ie: x.x.99.100-x.x.99.200 wont that exclude the manual laptop IP  192.168.99.10 because its lower than .99.100?

For the Xbox vlan I will have to check that to make sure.
 

[BoNetTech]

Great, these screenshots help a lot.

Good news: your laptop is using the firewall's DNS only (192.168.20.1 on the wired link, wlan0 has no DNS scope). The 127.0.0.53 you saw earlier is just the laptop's local stub. Firefox DoH is off, so the browser follows the system DNS. IPv6 addresses in a DNS answer are normal: the DNS knows about them even if your network doesn't use IPv6.

A small command fix: with dig the server needs an @: dig @192.168.20.1 example.com. Without it, dig also looked up "192.168.20.1" as a name, which gives the NXDOMAIN you saw. Harmless.

DHCP: your PERSONAL20, XBOXS10 and GUEST30 ranges look right. The MGNT99 row has a start address of 192.168.99.10 and no end. That is exactly your laptop's static IP. Either delete that row (you use static IPs there) or set the range to 192.168.99.100–192.168.99.200 so DHCP can never offer .10.

What is still open: where the firewall's own DNS queries go. Please run dnsleaktest again (the extended test) and post the table with the ISP column readable, blurring only the IP column. If the ISP names are your own provider, the firewall's queries leave through the WAN. If they are Quad9 or the operators that serve it, it's fine.

And for the Xbox: please do the test with 1.1.1.1 set manually on the Xbox first (DNS vs tunnel MTU), as described before.

Sergio