Occasionally, OPN Senses Wrong Gateway: A Guide for Tech Support

Title: Resolving Firewall Issues with Two Gateways: A Guide to Tech Support

Introduction

In this article, we will discuss a common issue faced by users who have set up a firewall with two gateways, one for the WAN (WireGuard going to Sweden) and the other for the local WAN. We will provide a step-by-step guide to troubleshoot and resolve this issue, focusing on the Unbound DNS setup that forwards specific queries to DNS Masq, which populates alias IPs for sites.

Understanding the Issue

When you have two gateways, it's essential to ensure that the firewall is correctly configured to allow traffic to flow between them. In this case, the WireGuard VPN is used for the WAN connection to Sweden, while the local WAN handles the rest of the network traffic.

However, if you've set up Unbound as your DNS server and DNS Masq to handle specific queries, you might encounter issues with alias IPs for sites. This article will guide you through the process of resolving these issues.

Configuring Unbound for Specific Queries

1. First, ensure that Unbound is installed and running on your system. If not, follow the appropriate installation guide for your operating system.

2. Open the Unbound configuration file, usually located at /etc/unbound/unbound.conf.

3. Add the following lines to the configuration file:

server:
  local-zone: "local." static
  local-data-dir: "/var/cache/unbound/local"
  local-data-max-cache-ttl: 3h

forward-zone:
  name: "."
  forward-addr: 8.8.8.8
  forward-addr: 8.8.4.4

4. Save the changes and restart Unbound:

sudo systemctl restart unbound

Setting Up DNS Masq for Alias IPs

1. Open the DNS Masq configuration file, usually located at /etc/dnsmasq.conf.

2. Add the following lines to the configuration file:

dhcp-option=6,10.0.0.1
dhcp-option=61,10.0.0.1
interface=wan
dhcp-range=wan,10.0.0.100,10.0.0.200,255.255.255.0,12h

3. Replace 10.0.0.1 with the IP address of your Unbound server.

4. Save the changes and restart DNS Masq:

sudo systemctl restart dnsmasq

Testing the Setup

1. Open a terminal and run the following command to test if DNS Masq is forwarding queries to Unbound:

dig @127.0.0.1 local.example.com TXT +short

Replace local.example.com with a domain name you've set up an alias IP for.

2. If the output includes the expected TXT record, the setup is working correctly. If not, double-check your configuration files and restart the services.

Summary

• Issue: Firewall with two gateways, one for the WAN (WireGuard going to Sweden) and the other for the local WAN, causing problems with alias IPs for sites when using Unbound DNS and DNS Masq.
• Solution: Configure Unbound to handle specific queries and set up DNS Masq to forward these queries to Unbound.
• References:
  • Unbound User Manual
  • DNS Masq Manual