Set Specific DNS servers for VPN Connections

Hello all,

I have serveral WireGuard peers on my router set up to connect to different ProtonVPN peers. I would like to set up these connections to use the Proton provided DNS servers. Currently, connections use the standard DNS from the router. Is there a way to use different DNS servers for a particular WG connection?

Depends............
how is your router currently setup and what are the requirements for users to go out wireguard.
/export file=anynameyouwish (minus router serial number, any public WANIP information, keys )

I knew you would ask for that! :smiley:

You’ve seen my config multiple times and were recently in my router. But I don’t expect you to remember everything! :smiley:

And actually I think I figured it out - at least in a way that satisfies my needs…

Proton has you use the IP address of 10.x.0.2/32 for the MikroTik side of the WG peer. 10.x.0.1/32 is the Gateway and DNS. “x” is any small number. So the first connection in my case is 10.2.0.2/32, the second 10.3.0.2/32, etc.

Now, when creating those, the MT router, creates a dynamic route for that IP address using the WG interface as the gateway. But because it’s a /32 IP address, it does’t give you access to to the 10.x.0.1 DNS address. So I created a new route for 10.x.0.1 with the appropriate WG interface as the gateway. Now I can pin the 10.x.0.1 DNS server. I now have 10.2.0.1, 10.3.0.1 and 10.4.0.1 set up as custom DNS servers on my own pi-hole DNS server.

One thing that does bother me though is that the MT shows my ISPs DNS servers in the configuration and I cannot remove them. Is there a way to disable those? In the image below, 192.168.1.4 is my pi-hole DNS instance.

Regardless how many times Ive seen a config, once an OP touches it, it turns to fairy dust and memory is useless. Thus the only valid config, is the latest one. :-1:

Since I dont have your latest config handy, I am unable to comment.

What I can say is that it appears that
a. proton doenst give you a specific DNS
b. thus yes use the gateway IP for DNS.
c. I always recommend putting in the wireguard IP address as /24 address so that routing is clear.

How to setup DNS is dependent upon user requirements................

:grin: :rofl:

Yeah no worries. I know…

Yeah, we had a big discussion in an earlier thread about /32 vs. /24. Now I understand why you advocate for /24. And yes, it works this way and seems to work pretty well. I’m using their DNS servers now for all my needs regardless of if I am on the VPN or not.

Like I said, the only ones I wish I could eliminate are the “dynamic” ones provided by my ISP with my IP address.

Sure thing, just dont enable them in IP DHCP client.
However, your router needs DNS to go out to make the initial handshake or for any users that are not going out wireguard, so that will dictate what you on the rest of the imaginary config :wink:

Well, since the proton connection is always up and I have a route to the proton DNS server then any client on my LAN can access them.

It all works and works well…it doesn’t matter if the users are not on WireGuard. I am routed into the DNS in the VPN.

For both DHCP client and PPPoE client the checkbox to uncheck is Use Peer DNS.

Only if your ISP IPv6 is provided with Router Advertisement (not DHCPv6 client), then at the moment there is no built-in way to suppress the dynamic ISP DNS servers.

Bingo! Thank you. That did the trick.