From: Stephen Larew <stephen@slarew.net>
To: Sven Auhagen <sven.auhagen@voleatech.de>
Cc: wireguard@lists.zx2c4.com
Subject: Re: Mac APP DNS Search Domain
Date: Mon, 9 Aug 2021 09:12:05 -0700 [thread overview]
Message-ID: <B8A851EA-FF19-4ED3-836A-92A054028935@slarew.net> (raw)
In-Reply-To: <20210717100909.lzi5mwsv5hb57w3w@svensmacbookair.sven.lan>
On Jul 17, 2021, at 03:09, Sven Auhagen <sven.auhagen@voleatech.de> wrote:
>
> Hi,
>
> the DNS search domain in the Wireguard Mac APP does not seem to work properly.
> The search domain is added properly and I can see it in the DNS configuration
> for the scoped query:
>
> resolver #2
> search domain[0] : mytestdomain.com
> nameserver[0] : 192.168.6.1
> if_index : 17 (utun4)
> flags : Scoped, Request A records
> reach : 0x00000002 (Reachable)
>
> but the global resolver is using a mix of my LAN and Wireguard DNS resolver:
>
> resolver #1
> search domain[0] : sven.lan
> nameserver[0] : 192.168.6.1
> if_index : 17 (utun4)
> flags : Supplemental, Request A records
> reach : 0x00000002 (Reachable)
> order : 102200
>
> I found a discussion on Github about the issue here:
> https://github.com/tailscale/tailscale/issues/101#issuecomment-639286398
>
> suggesting that the following will fix it:
>
> --- a/Sources/WireGuardKit/PacketTunnelSettingsGenerator.swift
> +++ b/Sources/WireGuardKit/PacketTunnelSettingsGenerator.swift
> @@ -88,7 +88,7 @@ class PacketTunnelSettingsGenerator {
> let dnsSettings = NEDNSSettings(servers: dnsServerStrings)
> dnsSettings.searchDomains = tunnelConfiguration.interface.dnsSearch
> if !tunnelConfiguration.interface.dns.isEmpty {
> - dnsSettings.matchDomains = [""] // All DNS queries must first go through the tunnel's DNS
> + dnsSettings.matchDomains = [""] + dnsSettings.searchDomains // All DNS queries must first go through the tunnel's DNS
> }
> networkSettings.dnsSettings = dnsSettings
> }
>
> I do not have an Apple Developer Account so I am not able to compile the code and test it.
> Can anyone take a look as this would be a great help.
>
> Best
> Sven
Sven,
I have a patch for Wireguard Mac app that enables proper split DNS support. It works well in my usage. I should properly submit the patch for review by Wireguard folks. Until then, you can get the patch here:
https://github.com/slarew/wireguard-apple/commit/6ebc356d9e11ab91443e06de5e89f1af57fcdff8
> Enable "split DNS" configurations for an interface
>
> By adding a tilde prefix to a domain name entry in the DNS= line, the
> domain is interpreted as a "matching domain" for DNS routing instead of
> a "search domain." This corresponds to setting a non-empty
> NEDNSSettings.matchDomains property for the network tunnel. Using tilde
> as a prefix is borrowed from systemd-resolved's equivalent usage.
>
> If one or more match domains are specified, then the specified DNS
> resolvers are only used for those matching domains instead of acting as
> the first resolver before the system's primary DNS resolvers.
-Stephen
next prev parent reply other threads:[~2021-08-10 0:24 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-07-17 10:09 Sven Auhagen
2021-08-09 16:12 ` Stephen Larew [this message]
2021-08-10 7:42 ` Sven Auhagen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=B8A851EA-FF19-4ED3-836A-92A054028935@slarew.net \
--to=stephen@slarew.net \
--cc=sven.auhagen@voleatech.de \
--cc=wireguard@lists.zx2c4.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).