Can't use internet with Wireguard Pi-Vpn

Troubleshooting
,
21

nothing, i’ve also reinstalled everything to have all plain and clean.

dig +cdflag @127.0.0.1 -p 5335 dietpi.com

; <<>> DiG 9.18.33-1~deb12u2-Debian <<>> +cdflag @127.0.0.1 -p 5335 dietpi.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 52935
;; flags: qr rd ra cd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;dietpi.com.                    IN      A
;; Query time: 96 msec
;; SERVER: 127.0.0.1#5335(127.0.0.1) (UDP)
;; WHEN: Tue Feb 11 12:57:02 GMT 2025
;; MSG SIZE  rcvd: 39

also, i’m not able to update to dietpi v 9.10.0

│ Downloading update archive                                                                                           │                      
                     │  - Command: curl -sSfLO https://github.com/MichaIng/DietPi/archive/master.tar.gz                                     │                      
                     │  - Exit code: 6                                                                                                      │                      
                     │  - DietPi version: v9.9.0 (MichaIng/master) | HW_MODEL: 4 | HW_ARCH: 3 | DISTRO: 7                                   │                      
                     │  - Error log:                                                                                                        │                      
                     │ curl: (6) Could not resolve host: github.com
22

I guess you set local DNS on the DietPi device to Pihole? Something you should not do. I recommend using a STATIC ip address and a global public DNS provider. Maybe thats one of the issues?

Can you check

ip a
cat /etc/resolv.conf
23

ip a

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host noprefixroute 
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether dc:a6:32:d2:b3:e7 brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.87/24 brd 192.168.1.255 scope global eth0
       valid_lft forever preferred_lft forever
    inet6 fe80::dea6:32ff:fed2:b3e7/64 scope link 
       valid_lft forever preferred_lft forever
3: wg0: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1420 qdisc noqueue state UNKNOWN group default qlen 1000
    link/none 
    inet 10.245.65.1/24 scope global wg0
       valid_lft forever preferred_lft forever

cat /etc/resolv.conf

nameserver 192.168.1.2
nameserver 192.168.1.2
24

You are using STATIC IP?
You set your router as DNS server inside DietPi?
And your router is using Pihole as upstream DNS?

I would recommend setting a different DNS server in DietPi (Quad9, Cloudflare or Google DNS) if all question has been answered with yes.

25

I have two routers: one is the main and the second one is in bridge mode (my house have two floors). The Pi4 is connected to the latter.

Dietpi have a static IP: 192.168.1.87

My main router is using 192.168.1.87 as primary DNS.

In dietpi-config i see that the static DNS is set to 192.168.1.2 (my bridge router)

26

And what does the bridge router uses as upstream DNS? I guess the main router? Which points you back to PiHole? You see the loop? Again I highly recommend using a public DNS inside DietPi own network configuration. This has no impact on PiHole or any AdBlock blocking inside your network.

27

done what you said, successfully updated dietpi, but still no luck with wireguard

28

Forgot about Wireguard for the moment. First you would need to fix unbound.

Reboot your system and check following again

dig @127.0.0.1 -p 5335 dietpi.com
29 
; <<>> DiG 9.18.33-1~deb12u2-Debian <<>> @127.0.0.1 -p 5335 dietpi.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 18932
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;dietpi.com.                    IN      A

;; Query time: 0 msec
;; SERVER: 127.0.0.1#5335(127.0.0.1) (UDP)
;; WHEN: Tue Feb 11 21:40:46 GMT 2025
;; MSG SIZE  rcvd: 39

looks the same

30

Still something wrong with DNSSEC validation. Does this file has an up-to-date date?

ls -la /var/lib/unbound/root.key
31

-rw-r--r-- 1 unbound unbound 431 May 21 2024 /var/lib/unbound/root.key

32

Lets try updating the file

mv /var/lib/unbound/root.key /var/lib/unbound/root.key.old
systemctl restart unbound
ls -la /var/lib/unbound/root*

Does the file has an up-to-date date now?

33 
-rw-r--r-- 1 root    root    3313 Feb  8 18:46 /var/lib/unbound/root.hints
-rw-r--r-- 1 unbound unbound  431 May 21  2024 /var/lib/unbound/root.key
-rw-r--r-- 1 unbound unbound  431 May 21  2024 /var/lib/unbound/root.key.old
34

What is the content of the file

cat /var/lib/unbound/root.key
35 
.       86400   IN      DNSKEY  257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ;{id = 20326 (ksk), size = 2048b} ;;state=2 [  VALID  ]
36

the file looks complete different to me. Let’s try another way

mv /var/lib/unbound/root.key /var/lib/unbound/root.key.old
apt install unbound-anchor
sudo -u unbound unbound-anchor -va /var/lib/unbound/root.key
cat /var/lib/unbound/root.key
systemctl restart unbound
cat /var/lib/unbound/root.key
37 
/var/lib/unbound/root.key does not exist
fail: the anchor is NOT ok and could not be fixed
38

hmm something strange happen on your system. Actually I don’t know why Unbound is not able to update the file

For me this is working without issue

root@DietPiProd:~# mv /var/lib/unbound/root.key /var/lib/unbound/root.key.old
root@DietPiProd:~# sudo -u unbound unbound-anchor -va /var/lib/unbound/root.key
/var/lib/unbound/root.key does not exist
success: the anchor is ok
root@DietPiProd:~#

For testing, can you move the RPi device directly behind the ISP router? Just to exclude more components. And do you use any specific firewall that could block some sort of requests?

39

still, the same, i’ve also tried a fresh new dietpi install on a new usb stick.

No firewall at all.

I’ve found some threads on reddit, maybe is my ISP (Vodafone, main router) intercepting DNS queries?

My ISP (Vodafone) is the culprit - to be more specific: their router! (EasyBox 804)
Another thread lead me to this conclusion: Is my router intercepting DNS queries?
After reading that, I checked Unbound with another router (unbranded) and there it just works as it should! Problem is sadly, that I can’t use this other router as it is really old and can only get 50% of my normal internet-speed >_<°
I called Vodafone and they can/will not say anything concrete about the issue at hand and only said that I should ask online again and that maybe I need to open some special ports for it to work, but that’s just their ‘guess’/official statement. Could there be some special ports that Unbound needs to work? I tried to find any but nothing special came up - furthermore on the old router it just works without any open (special) ports…
TL;DR: Seems like Vodafone is intercepting my DNS queries and therefore Unbound can not open a secure connection and always fails with SERVFAIL .

40

If you feel like it, you could test this further and run your RPi4 via a WLAN hotspot on your cell phone, for example. (Cell phone not connected to home WLAN :wink: )

As an alternative you can switch off DNSSEC in Unbound. This would then bypass the problem.