Development discussion of WireGuard
 help / color / mirror / Atom feed
From: Stephen Larew <stephen@slarew.net>
To: Sven Auhagen <sven.auhagen@voleatech.de>
Cc: wireguard@lists.zx2c4.com
Subject: Re: Mac APP DNS Search Domain
Date: Mon, 9 Aug 2021 09:12:05 -0700	[thread overview]
Message-ID: <B8A851EA-FF19-4ED3-836A-92A054028935@slarew.net> (raw)
In-Reply-To: <20210717100909.lzi5mwsv5hb57w3w@svensmacbookair.sven.lan>

On Jul 17, 2021, at 03:09, Sven Auhagen <sven.auhagen@voleatech.de> wrote:
> 
> Hi,
> 
> the DNS search domain in the Wireguard Mac APP does not seem to work properly.
> The search domain is added properly and I can see it in the DNS configuration
> for the scoped query:
> 
> resolver #2
> search domain[0] : mytestdomain.com
> nameserver[0] : 192.168.6.1
> if_index : 17 (utun4)
> flags    : Scoped, Request A records
> reach    : 0x00000002 (Reachable)
> 
> but the global resolver is using a mix of my LAN and Wireguard DNS resolver:
> 
> resolver #1
> search domain[0] : sven.lan
> nameserver[0] : 192.168.6.1
> if_index : 17 (utun4)
> flags    : Supplemental, Request A records
> reach    : 0x00000002 (Reachable)
> order    : 102200
> 
> I found a discussion on Github about the issue here:
> https://github.com/tailscale/tailscale/issues/101#issuecomment-639286398
> 
> suggesting that the following will fix it:
> 
> --- a/Sources/WireGuardKit/PacketTunnelSettingsGenerator.swift
> +++ b/Sources/WireGuardKit/PacketTunnelSettingsGenerator.swift
> @@ -88,7 +88,7 @@ class PacketTunnelSettingsGenerator {
>             let dnsSettings = NEDNSSettings(servers: dnsServerStrings)
>             dnsSettings.searchDomains = tunnelConfiguration.interface.dnsSearch
>             if !tunnelConfiguration.interface.dns.isEmpty {
> -                dnsSettings.matchDomains = [""] // All DNS queries must first go through the tunnel's DNS
> +                dnsSettings.matchDomains = [""] + dnsSettings.searchDomains // All DNS queries must first go through the tunnel's DNS
>             }
>             networkSettings.dnsSettings = dnsSettings
>         }
> 
> I do not have an Apple Developer Account so I am not able to compile the code and test it.
> Can anyone take a look as this would be a great help.
> 
> Best
> Sven

Sven,

I have a patch for Wireguard Mac app that enables proper split DNS support. It works well in my usage.  I should properly submit the patch for review by Wireguard folks.  Until then, you can get the patch here:

https://github.com/slarew/wireguard-apple/commit/6ebc356d9e11ab91443e06de5e89f1af57fcdff8

> Enable "split DNS" configurations for an interface
> 
> By adding a tilde prefix to a domain name entry in the DNS= line, the
> domain is interpreted as a "matching domain" for DNS routing instead of
> a "search domain."  This corresponds to setting a non-empty
> NEDNSSettings.matchDomains property for the network tunnel.  Using tilde
> as a prefix is borrowed from systemd-resolved's equivalent usage.
> 
> If one or more match domains are specified, then the specified DNS
> resolvers are only used for those matching domains instead of acting as
> the first resolver before the system's primary DNS resolvers.

-Stephen

  reply	other threads:[~2021-08-10  0:24 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-07-17 10:09 Sven Auhagen
2021-08-09 16:12 ` Stephen Larew [this message]
2021-08-10  7:42   ` Sven Auhagen

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=B8A851EA-FF19-4ED3-836A-92A054028935@slarew.net \
    --to=stephen@slarew.net \
    --cc=sven.auhagen@voleatech.de \
    --cc=wireguard@lists.zx2c4.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).