Encontrei uma situação estranha com minha configuração de wireguard.
Minha configuração: O Wireguard encapsula o acesso à minha rede. Os controladores de domínio do Active Directory fornecem DNS. Os clientes usam os servidores DNS no túnel. Os clientes Linux não têm problemas para resolver consultas DNS com um túnel wireguard usando os controladores de domínio como servidores DNS.
O problema: Os clientes Windows não podem navegar com um túnel wireguard ativo. O ping falha, mas o nslookup funciona. Posso executar ping nos servidores DNS (por endereço IP). Posso executar ping em endereços IP externos (por exemplo, 1.1.1.1). Wireshark mostra a consulta DNS saindo, mas sem respostas. O firewall no servidor wireguard não mostra as consultas bloqueadas.
O que estou fazendo de errado?
Aqui está minha configuração:
Servidor Wireguard
# cat /etc/wireguard/wg0.conf
[Interface]
Address = 10.101.0.1/16
SaveConfig = true
PostUp = ufw route allow in on wg0 out on enp6s0
PostUp = ufw route allow in on enp6s0 out on wg0
PostUp = ufw route allow in on wg0 out on enp1s0
PostUp = ufw route allow in on enp1s0 out on wg0
PostUp = iptables -t nat -I POSTROUTING -o enp6s0 -j MASQUERADE
PostUp = iptables -t nat -I POSTROUTING -o enp1s0 -j MASQUERADE
PreDown = ufw route delete allow in on wg0 out on enp6s0
PreDown = ufw route delete allow in on wg0 out on enp1s0
PreDown = ufw route delete allow in on enp6s0 out on wg0
PreDown = ufw route delete allow in on enp1s0 out on wg0
PreDown = iptables -t nat -D POSTROUTING -o enp6s0 -j MASQUERADE
PreDown = iptables -t nat -D POSTROUTING -o enp1s0 -j MASQUERADE
ListenPort = 51820
PrivateKey = <snipped>
Tabela de roteamento no servidor Wireguard
# ip route
default via <wan_gateway> dev enp1s0 proto static
10.0.0.0/16 dev enp6s0 proto kernel scope link src 10.0.25.20
10.0.0.0/16 via 10.0.1.254 dev enp6s0 proto static metric 100
10.101.0.0/16 dev wg0 proto kernel scope link src 10.101.0.1
<wan_ip_block>/22 dev enp1s0 proto kernel scope link src <wireguard_public_ip>
Regras de firewall no WireguardServer
# ufw status
Status: active
To Action From
-- ------ ----
51820/udp ALLOW Anywhere
22/tcp ALLOW Anywhere
3389 ALLOW Anywhere
80/tcp ALLOW Anywhere
443/tcp ALLOW Anywhere
135/tcp ALLOW Anywhere
389/tcp ALLOW Anywhere
636/tcp ALLOW Anywhere
3268/tcp ALLOW Anywhere
3269/tcp ALLOW Anywhere
53/tcp ALLOW Anywhere
88/tcp ALLOW Anywhere
445/tcp ALLOW Anywhere
123/tcp ALLOW Anywhere
464/tcp ALLOW Anywhere
137/tcp ALLOW Anywhere
138/tcp ALLOW Anywhere
139/tcp ALLOW Anywhere
135/udp ALLOW Anywhere
137/udp ALLOW Anywhere
138/udp ALLOW Anywhere
389/udp ALLOW Anywhere
445/udp ALLOW Anywhere
1512/udp ALLOW Anywhere
42/udp ALLOW Anywhere
42/tcp ALLOW Anywhere
1512/tcp ALLOW Anywhere
500/udp ALLOW Anywhere
49152:65535/tcp ALLOW Anywhere
49152:65535/udp ALLOW Anywhere
464 ALLOW Anywhere
5985:5986/tcp ALLOW Anywhere
53/udp ALLOW Anywhere
51820/udp (v6) ALLOW Anywhere (v6)
22/tcp (v6) ALLOW Anywhere (v6)
3389 (v6) ALLOW Anywhere (v6)
80/tcp (v6) ALLOW Anywhere (v6)
443/tcp (v6) ALLOW Anywhere (v6)
135/tcp (v6) ALLOW Anywhere (v6)
389/tcp (v6) ALLOW Anywhere (v6)
636/tcp (v6) ALLOW Anywhere (v6)
3268/tcp (v6) ALLOW Anywhere (v6)
3269/tcp (v6) ALLOW Anywhere (v6)
53/tcp (v6) ALLOW Anywhere (v6)
88/tcp (v6) ALLOW Anywhere (v6)
445/tcp (v6) ALLOW Anywhere (v6)
123/tcp (v6) ALLOW Anywhere (v6)
464/tcp (v6) ALLOW Anywhere (v6)
137/tcp (v6) ALLOW Anywhere (v6)
138/tcp (v6) ALLOW Anywhere (v6)
139/tcp (v6) ALLOW Anywhere (v6)
135/udp (v6) ALLOW Anywhere (v6)
137/udp (v6) ALLOW Anywhere (v6)
138/udp (v6) ALLOW Anywhere (v6)
389/udp (v6) ALLOW Anywhere (v6)
445/udp (v6) ALLOW Anywhere (v6)
1512/udp (v6) ALLOW Anywhere (v6)
42/udp (v6) ALLOW Anywhere (v6)
42/tcp (v6) ALLOW Anywhere (v6)
1512/tcp (v6) ALLOW Anywhere (v6)
500/udp (v6) ALLOW Anywhere (v6)
49152:65535/tcp (v6) ALLOW Anywhere (v6)
49152:65535/udp (v6) ALLOW Anywhere (v6)
464 (v6) ALLOW Anywhere (v6)
5985:5986/tcp (v6) ALLOW Anywhere (v6)
53/udp (v6) ALLOW Anywhere (v6)
Anywhere on enp6s0 ALLOW FWD Anywhere on wg0
Anywhere on wg0 ALLOW FWD Anywhere on enp6s0
Anywhere on enp1s0 ALLOW FWD Anywhere on wg0
Anywhere on wg0 ALLOW FWD Anywhere on enp1s0
Anywhere (v6) on enp6s0 ALLOW FWD Anywhere (v6) on wg0
Anywhere (v6) on wg0 ALLOW FWD Anywhere (v6) on enp6s0
Anywhere (v6) on enp1s0 ALLOW FWD Anywhere (v6) on wg0
Anywhere (v6) on wg0 ALLOW FWD Anywhere (v6) on enp1s0
Cliente Windows
[Interface]
PrivateKey = <snipped>
Address = 10.101.0.4/32
[Peer]
PublicKey = <snipped>
AllowedIPs = 10.101.0.0/16, 10.0.0.0/16, <wan_ip_block>/22
Endpoint = <snipped>:51820
Responder1
O problema era:
- Os VPNs wireguard aparentemente configuram automaticamente uma métrica mais baixa do que todas as outras conexões no cliente
- Configurei os servidores DNS do cliente na conexão com fio/wi-fi, NÃO na conexão wireguard
- o Windows envia consultas DNS pela conexão com a métrica mais baixa
A solução: adicione os servidores DNS à configuração do cliente wireguard:
DNS = <ip_address_of_dns_server>, <ip_address_of_dns_server>
Configuração completa do cliente
[Interface]
PrivateKey = <snipped>
Address = 10.101.0.4/32
DNS = <ip_address_of_dns_server>, <ip_address_of_dns_server>
[Peer]
PublicKey = <snipped>
AllowedIPs = 10.101.0.0/16, 10.0.0.0/16, <wan_ip_block>/22
Endpoint = <snipped>:51820