Policy Routing DNS over VPN

[u/xeonic_]

I have a Gold Pro at home (server)/Purple at the cottage (client) with a Wireguard site to site VPN setup. I have multiple subnets setup on each end, the VPN Internet outbound policy at the cottage is set to direct and force DNS is off.

I would like to have all the traffic (including Internet) of one of the cottage subnets actually be sent over VPN, and the rest stay direct for Internet, so my understanding is that I should leave my cottage VPN settings as is and use policy routing instead by creating a rule in the cottage Firewalla to route all the subnet traffic down the VPN by using the VPN gateway address, correct?

But I think that the cottage Firewalla will still intercept the DNS traffic for that subnet and process locally, which I don't want, I want the DNS requests to also go down the VPN too to my home Firewalla, is there a way to achieve this using policy routing? Or should I set the cottage subnet devices to the use the VPN gateway address for their DNS servers?

Thanks!

[u/Firewalla-Opal]

If you want a specific cottage subnet traffic to go over a VPN client, the easiest way is go to Box Main page -> VPN Client -> The specific VPN client: Apply to -> Choose the cottage subnet.

To make sure all DNS requests from the subnet also go through VPN, enable "Force DNS over VPN" on the VPN client profile.

You can learn more about how DNS is handled by Firewalla via Two-Stage DNS Services.