wireguard · Home Lab Explorers

Ad de Jonge

23h (edited) • General discussion

wireguard

Here is the clear, direct breakdown of my setup and the troubleshooting steps in standard homelab terms.

The Architecture Setup

Edge Router: Asus RT-BE88U acting as the WireGuard VPN server.
DNS Cluster: Two Technitium DNS servers running in Proxmox LXC containers.
High Availability (HA): keepalived managing a Virtual IP (VIP) at 192.168.11.53 for DNS failover.
Upstream Resolution: Pure recursive root server resolution (no upstream forwarders like Cloudflare/Google configured).
Ad-Blocking Action: Configured to drop blocked domains using the NXDOMAIN resolution method.
Reverse Proxy & Auth: Nginx Proxy Manager (NPM) handles local SSL/domains, protected by 2FA/OTP for the dashboards.

Step 1: Configuring the WireGuard Server (Asus)

When spinning up the WireGuard server on the Asus RT-BE88U, the interface was assigned a dedicated tunnel subnet:

Tunnel Subnet: 10.6.0.1/32
Max Clients: 10 (allocating tunnel IPs from 10.6.0.2 to 10.6.0.11 to connecting peers).
Peer DNS Injected: Handed out the keepalived VIP (192.168.11.53) to all VPN clients.

Step 2: Fixing the "No Internet / No Loading" Issue

Once the Android client connected over 5G, the tunnel established successfully but data stopped loading. This was a classic Network Access Control List (ACL) block.

By default, Technitium only allows recursion requests coming from the immediate subnet it sits on. When the phone tried to query the VIP from its WireGuard IP (10.6.0.X), Technitium dropped the packets.

The Fix:

Navigated to both Technitium LXC instances -> Settings > Recursion.
Located the Network Access Control List (ACL).
Added the WireGuard subnet 10.6.0.0/24 to the allowed list (or used the wide-open 0.0.0.0/0 flag, which is perfectly safe since port 53 isn't forwarded to the WAN).
Saved settings on both nodes.

This immediately fixed the recursion block, allowing the 5G client to resolve names and block ads natively via NXDOMAIN.

Step 3: Automating the Client (WG Tunnel App)

To avoid toggling the VPN manually when leaving the house, I use the WG Tunnel Android app (a fork that adds native automation missing from the official client).

To prevent the VPN from firing up inside the house when roaming between the main Asus router and the two standalone Access Points (APs), I lock down the automation via physical hardware profiles:

Provided Location (Always Allow) and Battery (Unrestricted) permissions in Android to prevent the OS from killing the background service.
In the app's Auto-Tunneling (Lightning Bolt) menu, enabled automation.
Mapped Mobile Data to auto-start my home WireGuard profile.
Under the Wi-Fi configuration, walked through the house to each AP and selected "Add Current BSSID".By adding the specific BSSIDs (MAC addresses) of my main router and both APs to the Trusted Networks list, the app now perfectly differentiates between my actual home environment and a spoofed Wi-Fi network.

The Final Workflow

At Home: My phone roams between my Asus APs, matches the trusted BSSIDs, and keeps the VPN asleep. My phone queries 192.168.11.53 directly over local Wi-Fi.
On the Road (5G): The phone drops the home BSSIDs. The app instantly catches this, triggers the WireGuard tunnel, tunnels DNS securely back to the Asus router, and hands it off to my recursive Technitium HA cluster.

0 comments

wireguard