From 8629a36278885126a9b85653f85a2ccc7402419c Mon Sep 17 00:00:00 2001 From: Nik Afiq Date: Wed, 26 Aug 2026 20:45:09 +0900 Subject: [PATCH] fix: allow WireGuard road-warrior clients to reach DNS on minisforum UFW allowed 53/udp+tcp from every other internal subnet but not from 10.10.0.0/24 (the WireGuard client subnet), so once the tunnel itself was reachable, decrypted DNS queries still got dropped at minisforum's own INPUT chain before reaching Technitium. Co-Authored-By: Claude Sonnet 5 --- ansible/roles/common/defaults/main.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/ansible/roles/common/defaults/main.yaml b/ansible/roles/common/defaults/main.yaml index 87b4ff9..1d4c8c6 100644 --- a/ansible/roles/common/defaults/main.yaml +++ b/ansible/roles/common/defaults/main.yaml @@ -25,6 +25,8 @@ ufw_allowed_ports: - { port: 6443, proto: tcp, comment: K3s API server } - { port: 10250, proto: tcp, comment: Kubelet, src: 10.10.40.0/24 } - { port: 8472, proto: udp, comment: Flannel VXLAN, src: 10.10.40.0/24 } + - { port: 53, proto: udp, comment: WireGuard road-warrior DNS, src: 10.10.0.0/24 } + - { port: 53, proto: tcp, comment: WireGuard road-warrior DNS, src: 10.10.0.0/24 } data_dirs: - /data/gitea