[Support] Using NextDNS with PiVPN WireGuard

[Epikest]

In raising this issue, I confirm the following:

{please fill the checkboxes, e.g: [X]}

• I have read the documentation
• I have read and understood the contributors guide.
• The issue I am reporting can be replicated.
• The issue I am reporting can be is directly related to the pivpn installer script.

Have you searched for similar issues and solutions?

I tried searching for anything like my issue but I can't find anything that works.

Has your install failed?

no

Please provide your system information

What type of hardware are you running PiVPN at?

Oracle Cloud Instance

Output of uname -a

Linux instance-20220131-0012 5.13.0-1018-oracle #22~20.04.1-Ubuntu SMP Wed Feb 16 09:28:40 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux

Output of cat /etc/os-release

NAME="Ubuntu"
VERSION="20.04.4 LTS (Focal Fossa)"
ID=ubuntu
ID_LIKE=debian
PRETTY_NAME="Ubuntu 20.04.4 LTS"
VERSION_ID="20.04"
HOME_URL="https://www.ubuntu.com/"
SUPPORT_URL="https://help.ubuntu.com/"
BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
VERSION_CODENAME=focal
UBUNTU_CODENAME=focal

Issue

I want to make it so that clients that connect to the WireGuard VPN will be using NextDNS by default. NextDNS is installed and works with the custom configuration I set, the hostname shows up in the NextDNS control panel logs. However, the DNS does not seem to be working for the client whenever I use NextDNS.

Console output of pivpn add or pivpn add nopass

::: Client Keys generated
::: Client config generated
::: Updated server config
::: WireGuard reloaded
======================================================================
::: Done! test.conf successfully created!
::: test.conf was copied to /home/ubuntu/configs for easy transfer.
::: Please use this profile only on one device and create additional
::: profiles for other devices. You can also use pivpn -qr
::: to generate a QR Code you can scan with the mobile app.
======================================================================

Console output of pivpn debug

::: Generating Debug Output
::::            PiVPN debug              ::::
=============================================
::::            Latest commit            ::::
Branch: master
Commit: f80b0a7962d91862132c0a4abd65c1e67bd37bd7
Author: 4s3ti
Date: Fri Dec 3 21:41:13 2021 +0100
Summary: Update Changelog
=============================================
::::        Installation settings        ::::
PLAT=Ubuntu
OSCN=focal
USING_UFW=0
IPv4dev=ens3
install_user=ubuntu
install_home=/home/ubuntu
VPN=wireguard
pivpnPORT=51820
pivpnDNS1=10.6.0.1
pivpnDNS2=
pivpnHOST=REDACTED
INPUT_CHAIN_EDITED=1
FORWARD_CHAIN_EDITED=1
pivpnPROTO=udp
pivpnMTU=1420
pivpnDEV=wg0
pivpnNET=10.6.0.0
subnetClass=24
ALLOWED_IPS="0.0.0.0/0, ::0/0"
UNATTUPG=1
INSTALLED_PACKAGES=()
=============================================
::::  Server configuration shown below   ::::
[Interface]
PrivateKey = server_priv
Address = 10.6.0.1/24
MTU = 1420
ListenPort = 51820
### begin test ###
[Peer]
PublicKey = test_pub
PresharedKey = test_psk
AllowedIPs = 10.6.0.3/32
### end test ###
=============================================
::::  Client configuration shown below   ::::
[Interface]
PrivateKey = test_priv
Address = 10.6.0.3/24
DNS = 10.6.0.1

[Peer]
PublicKey = server_pub
PresharedKey = test_psk
Endpoint = REDACTED:51820
AllowedIPs = 0.0.0.0/0, ::0/0
=============================================
::::    Recursive list of files in       ::::
::::    /etc/wireguard shown below       ::::
/etc/wireguard:
configs
keys
wg-gen-python
wg0.conf

/etc/wireguard/configs:
clients.txt
test.conf

/etc/wireguard/keys:
server_priv
server_pub
test_priv
test_psk
test_pub

/etc/wireguard/wg-gen-python:
README.md
data.json
wg-gen.py
wgclient_2.conf
wgclient_3.conf
wgclient_4.conf
wghub.conf
=============================================
::::            Self check               ::::
:: [OK] IP forwarding is enabled
:: [OK] Iptables MASQUERADE rule set
:: [OK] Iptables INPUT rule set
:: [OK] Iptables FORWARD rule set
:: [OK] WireGuard is running
:: [OK] WireGuard is enabled (it will automatically start on reboot)
:: [OK] WireGuard is listening on port 51820/udp
=============================================
:::: Having trouble connecting? Take a look at the FAQ:
:::: https://docs.pivpn.io/faq
=============================================
:::: WARNING: This script should have automatically masked sensitive       ::::
:::: information, however, still make sure that PrivateKey, PublicKey      ::::
:::: and PresharedKey are masked before reporting an issue. An example key ::::
:::: that you should NOT see in this log looks like this:                  ::::
:::: YIAoJVsdIeyvXfGGDDadHh6AxsMRymZTnnzZoAb9cxRe                          ::::
=============================================
::::            Debug complete           ::::
:::
::: Debug output completed above.
::: Copy saved to /tmp/debug.log
:::

Have you taken any steps towards solving your issue?

I have tried changing the DNS server IP on WireGuard.

[coolapso]

thanks for reaching out... moving to discussions.

[orazioedoardo]

What address and port does NextDNS listen on? sudo ss -atnup should tell.

[Epikest]

$ sudo ss -atnup | grep nextdns
udp    UNCONN  0       0                0.0.0.0:5353             0.0.0.0:*       users:(("nextdns",pid=848,fd=12))
udp    UNCONN  0       0                      *:53                     *:*       users:(("nextdns",pid=848,fd=11))
udp    UNCONN  0       0                   [::]:5353                [::]:*       users:(("nextdns",pid=848,fd=13))
tcp    LISTEN  0       4096                   *:53                     *:*       users:(("nextdns",pid=848,fd=10))

[orazioedoardo]

It’s listening on *:53 which is OK. Do you have any firewall rules blocking incoming dns request? sudo iptables -vnL INPUT

[Epikest]

$ sudo iptables -vnL INPUT
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
 1867  696K ACCEPT     udp  --  ens3   *       0.0.0.0/0            0.0.0.0/0            udp dpt:51820 /* wireguard-input-rule */
 671K  369M ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
13486  953K ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0
32978 2954K ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0
   15   676 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp spt:123
 8216  477K ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW tcp dpt:22
81956 7904K REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            reject-with icmp-host-prohibited

[orazioedoardo]

DNS is not allowed and you are rejecting everything that doesn’t match. The following rules added after the ssh rule but before the reject should work.

sudo iptables -I INPUT 7 -i wg0 -p udp --dport 53 -j ACCEPT
sudo iptables -I INPUT 8 -i wg0 -p tcp --dport 53 -j ACCEPT

[Epikest]

It works, thanks a lot!