I have a Fedora 31 box acting as a Wireguard VPN server. Everything with Wireguard is
working great. Traffic is flowing in both directions, and my packets are protected. DNS is
getting resolved by Quad9.
As an enhancement, I've installed PowerDNS Recursor on the server to respond to DNS
queries. The recursor is working fine for the server, but I can't get the Wireguard
clients access to the recursor. I'm assuming this is a problem with my firewalld
rules, but I don't have a lot of experience building Linux based routers, which means
it could be anything.
Thoughts on what I'm missing here?
Firewalld Default Zone:
firewall-cmd --list-all
FedoraServer (active)
target: default
icmp-block-inversion: no
interfaces: ens3 ens7
sources:
services: dhcpv6-client ssh wireguard
ports:
protocols:
masquerade: yes
forward-ports:
source-ports:
icmp-blocks:
rich rules:
rule family="ipv6" source ipset="sshguard6" drop
rule family="ipv4" source ipset="sshguard4" drop
----------
Internal Zone with the Wireguard interface and network added to it:
firewall-cmd --list-all --zone=internal
internal (active)
target: default
icmp-block-inversion: no
interfaces: wg0
sources: 192.168.13.0/24
services: dhcpv6-client dns ssh wireguard
ports:
protocols:
masquerade: yes
forward-ports:
source-ports:
icmp-blocks:
rich rules:
------------
If it helps...
Wireguard Client Config:
[Interface]
PrivateKey = <private key>
Address = 192.168.13.10/32
DNS = 192.168.13.1, 9.9.9.9
[Peer]
PublicKey = <server public key>
PresharedKey = <psk>
AllowedIPs = ::/0, 0.0.0.0/0
Endpoint = wgg.domain.tld:2350
PersistentKeepalive = 25
----------
Wireguard server config:
[Interface]
PrivateKey = <private key>
Address = 192.168.13.1/24
ListenPort = 2350
[Peer]
PublicKey = <client public key>
AllowedIPs = 192.168.13.10/32
PreSharedKey = <psk>