From: Stephen Larew <stephen@slarew.net>
To: wireguard@lists.zx2c4.com
Subject: Split DNS for macOS
Date: Thu, 28 Oct 2021 00:16:37 -0700 [thread overview]
Message-ID: <20211028071638.88001-1-stephen@slarew.net> (raw)
For many months now, I have been running a patched WireGuard macOS app
that enables a split DNS configuration. I would like to try to upstream
my patches for split DNS.
There has been some interest in this patch:
- "Mac APP DNS Search Domain" thread from July and August 2021 [1]
- A commenter on my GitHub fork of wireguard-apple.
What is split DNS? It allows sending DNS queries to a specific server
based on the domain name. Systemd-resolved calls it a routing domain.
Apple's Network Extension framework calls it a match domain. Split DNS
is especially useful for internal DNS servers.
For example, if corp.example.com is a routing domain for the DNS server
at 192.0.2.1 (only accessible over WireGuard), then
server.corp.example.com is resolved using 192.0.2.1 while
www.example.com is resolved using some other DNS resolver (depending on
the other network settings in macOS).
The proposed patch adds new syntax to the wg-quick DNS= line.
Specifically, a tilde prefixed domain is treated as a routing domain.
Multiple routing domains can be added.
Limitations:
- Needs modifications to iOS UI to work on iOS.
- Only matching routing domains are sent to the DNS servers specified in
the DNS= config line. No separate fallback catch-all DNS server can
be set.
- Routing/match domains are also included in the list of search domains.
This could be changed with the matchDomainsNoSearch API, but lacking
more UI or config file changes to expose this option to the user, I
went with the default.
[1] https://lore.kernel.org/wireguard/20210810074232.aah5ktq5yzysaaey@SvensMacBookAir-2.local/T/
[2] https://github.com/slarew/wireguard-apple/commit/6ebc356d9e11ab91443e06de5e89f1af57fcdff8
next reply other threads:[~2021-10-28 7:25 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-10-28 7:16 Stephen Larew [this message]
2021-10-28 7:16 ` [PATCH] Enable "split DNS" configurations for an interface Stephen Larew
2021-10-28 9:58 ` Split DNS for macOS Bruce Ferrell
2021-10-29 15:33 ` Stephen Larew
2021-10-29 17:03 ` Andrew Fried
2021-10-29 21:07 ` Stephen Larew
2021-10-30 21:00 ` Dusan Zivadinovic
2021-11-03 9:15 ` Harald Dunkel
2021-11-03 9:42 ` Matty Driessen
2021-11-03 11:54 ` Alex Burke
2021-11-06 4:54 ` David Anderson
2021-11-06 9:47 ` Matty Driessen
2022-01-28 5:23 ` Stephen Larew
2022-01-28 9:02 ` Harald Dunkel
2021-10-29 21:06 Matty Driessen
2021-11-03 21:34 ` Andrew Fried
2021-11-03 21:46 ` Alex Burke
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20211028071638.88001-1-stephen@slarew.net \
--to=stephen@slarew.net \
--cc=wireguard@lists.zx2c4.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).