Wireguard full tunnel DNS(?) problems

Networking & Firewalls
1

I’m trying to make a full tunnel work with Wireguard on pfSense and a Windows computer. The computer can access the tunnel and get to my servers using IP addresses, but not using the server FQDNs. (I’ve set them up using HAProxy with a wildcard certificate.) I can ping 1.1.1.1, but can’t reach Websites using domains. In these cases the failure message is that the DNS address could not be found.
The Netgate instructions include: " All traffic may be associated with a peer by using 0.0.0.0/0 for IPv4 or ::/0 for IPv6, but this won’t work for a tunnel with multiple peers. Only the last peer in the list will be configured properly." So I’ve removed my phone as a peer for the tunnel, but still get the same result.
I did not create a separate interface for Wireguard. I’m using Unbound as my DNS server. The general settings for DNS Resolver do not show an interface for Wireguard. However, the “Access Lists” tab includes an entry showing the tunnel network.
The Windows Wireguard app has the DNS server set to my pfSense interface (192.168.8.1).
In pfSense, I’ve tried to direct all DNS queries to Unbound. I have this rule in Firewall/NAT/PortForward:

Screenshot 2022-05-01 115040
Screenshot 2022-05-01 1150401137×38 6.3 KB

And these rules in Firewall/Rules/WireGuard:
Screenshot 2022-05-01 115630
Screenshot 2022-05-01 1156301138×77 11 KB

I assume this is a problem of getting Unbound to respond to DNS queries from the remote peer, but I’m at a loss of what else to do. Any suggestions will be apprecieated.

2

If you use another DNS server (let’s say 8.8.8.8), then can you reach websites using domains?

3

Spectre, good idea. When I change the DNS server in the “client” and disable the two rules above, I am able to reach internet Web sites. But obviously not my local servers using their FQDNs. I left the rules disabled and changed back to my pfSense address and can’t reach anything requiring DNS. For some reason, Unbound does not service DNS requests coming through the tunnel.

4

Solved by watching a video from Christian McDonald. The change was to the settings in the peer (client) app. I set the DNS address to the tunnel address (192.168.85.1) rather than my pfSense address.