How do I get wireguard to resolve internal dns names on google compute engine

user_8042089 0
Viewed 3436

I have an internal DNS zone on Google Cloud Platform with an A record for dev.internal which points to the IP of the VM say 10.0.0.17. When I am on the GCP VM node/server via ssh I can ping dev.internal and it resolves to 10.0.0.17.

I now setup a wireguard peer with my laptop machine. My server side settings are:

[Interface]
Address = 192.168.69.1/24
ListenPort = 51820
PrivateKey = SERVER_KEY
PostUp = iptables -A FORWARD -i wg0 -o wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o ens4 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -o wg0  -j ACCEPT; iptables -t nat -D POSTROUTING  -o ens4 -j MASQUERADE

[Peer]
PublicKey = CLIENT_KEY
AllowedIPs = 192.168.69.2
PersistentKeepalive = 25

and my client side (laptop -I am using Ubuntu 20.01) settings are

[Interface]
Address = 192.168.69.2/32
PrivateKey = CLIENT_PRIVATE_KEY
DNS = 192.168.69.1

[Peer]
PublicKey = SERVER_PUBLIC_KEY
Endpoint = 35.XX.XX.XX:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 21

I confirm that the client and server peer is up, I go to ifconfig.co or whatsmyip from client and it shows me the 35.XX.XX.XX (server) ip.

On the client side I want to now access the 10.0.0.17 IP by resolving through the dev.internal zone on the VM.

ping dev.internal
ping: dev.internal: Name or service not known

What do I need to set on either the client or the server so that the client will be able to resolve the IP pointed to by the internal zone?

On Google Cloud the internal resolver is at 169.254.169.254.

I have tried it with and without DNS = 192.168.69.1 in the client and get the same result.

google-cloud-vpn wireguard google-cloud-dns vpn google-cloud-platform
1 Answers

To resolve hostnames within a VPC over a WireGuard VPN requires creating a Google Cloud DNS Policy and configuring the VPC DNS server IP address in WireGuard.

Step 1. Create an inbound DNS server policy

gcloud dns policies create NAME ^
    --description=DESCRIPTION ^
    --networks=VPC_NETWORK_LIST ^
    --enable-inbound-forwarding

Applying that policy allocates a DNS IP address in each VPC subnet. To see those addresses:

gcloud compute addresses list ^
--project [PROJECT_ID] ^
--filter="purpose = \"DNS_RESOLVER\"" ^
--format="csv(address, region, subnetwork)"

Make note of the IP address for the zone your instances are in or closest to you.

Step 2. Configure Wireguard running in the VPC.

In the examples below:

  • 192.168.9.x is the WireGuard VPN CIDR
  • 10.138.x.x is the VPC CIDR
  • 10.0.0.x is the local network CIDR.
  • ens4 is the VM ethernet adapter in Ubuntu. Centos is usually eth0.

The VM instance within the VPC needs IP Forwarding enabled (at instance creation) and WireGuard must be configured to route packets received from the VPN.

sysctl -w net.ipv4.ip_forward=1
iptables -D FORWARD -i wg0 -j ACCEPT
iptables -t nat -D POSTROUTING -o ens4 -j MASQUERADE

VPC Side: In wg0.conf configure WireGuard to forward packets

[Interface]
PrivateKey = ...
ListenPort = 51820
Address = 192.168.9.1/24

[Peer]
PublicKey = ...
AllowedIPs = 192.168.9.2/32, 10.138.0.0/16
Endpoint = 34.45.56.67:51820
PersistentKeepalive = 30

Remote Side: The DNS value is from gcloud compute addresses list. Notice the two CIDRs specified for AllowedIPs = 192.168.9.1/32, 10.138.0.0/16.

[Interface]
PrivateKey = ...
ListenPort = 51820
Address = 192.168.9.2/24
DNS = 10.138.0.16

[Peer]
PublicKey = ...
AllowedIPs = 192.168.9.1/32, 10.138.0.0/16
Endpoint = 34.45.56.67:51820
PersistentKeepalive = 30

Assuming that you have a VM named "my-vm-1" in the VPC, you can now ping my-vm-1 and the VPC DNS server will resolve that address.

Note: When WireGuard is up and running, all DNS traffic will flow over the VPN and will be resolved by the Google Cloud DNS server. When you deactivate WireGuard, DNS traffic will flow to the default resolver.

user_80167200
Related