As I am continuing to set up a WireGuard VPN link to a remote location, I managed to get the link to work from the peer’s address to the instance’s LAN, after my previous question re the same. When the link is brought up from my local WG client machine, I can ping the remote router’s LAN IP address 192.168.15.1 as well as its WG address 192.168.14.1 and connect to the web UI on the latter. I literally followed the OpnSense WireGuard tutorial to the letter, so the configuration is exactly as it recommends for the scenario when the access to the outside world through the VPN is required. The set-up now looks as follows:
The WG peer network is 192.168.14.0/24. My peer is getting 192.168.14.2, and the WG instance is 192.168.14.1. This instance is running on an OpnSense router, which also acts as the remote LAN’s Unbound DNS forwarder and listens on the LAN and WireGuard interfaces. Its access is Deny by default, with an access lists to allow the LAN and the WG networks.
Among other rules, on the firewall the WG network is allowed to in/out to 192.168.14.1 over UDP port 53.
I thought that the combination of the Unbound DNS access list and the firewall rule should allow the peer to resolve through the remote router’s WG address, while the WG link is up, but when I dig www.google.com @192.168.14.1 it times out. Also tried to allow it to its LAN address 192.168.15.1, but the dig to it also timed out.
For reasons unknown to me, while the WG link is up, the peer’s DNS server becomes 127.0.0.1, and it unsurprisingly does not resolve anything, but if I set my local edge router as the DNS, it of course resolves normally. To sum it up, when the WG link is up, I can only access the remote WG network by IP addresses. Even though I allow the access to the outside world, for example I create a rule on the WireGuard interface to allow ICMP echo request to 8.8.8.8, it still does not ping from the peer.
How can I turn this into a solution which is more useful in the real world, i.e. into a configuration in which all of my traffic from the local peer is routed to the outside world through the WG link? I need at least some DNS, which ideally should remain my local edge router, and to be able to send the traffic through the WG link by default. Until then the VPN is summarily useless.
If it matters, my peer client machine is Fedora 43, and I use wg-quick to bring the VPN up and down. While up, the wg0 interface shows up in the network manager applet, but it looks weird: its port is some random number not equal to that in the wg0.conf file, and its private key field is blank.
Another peculiar fact is that the mere act of my enabling the WG instance on the remote router blocked its LAN users from having access to the outside Internet. When I disabled the instance and the WireGuard interface, they got their access back. The whole WireGuard thing is sounding more and more useless as I endeavor in its set-up, so unless this can be easily fixed it will be a no go.
