Re: WireGuard macOS App doesn't set system default DNS

[Alexander Skwar <alexanders.mailinglists+nospam@gmail.com>]

Hello Shulhan

Am Do., 6. Aug. 2020 um 15:18 Uhr schrieb Shulhan <ms@kilabit.info>:
>
> > On 3 Aug 2020, at 19.14, Alexander Skwar <alexanders.mailinglists+nospam@gmail.com> wrote:
> >
> > Hello Erik,
> >
> > yes, I know that the DNS is private. This is why I have that on my macOS
> > configuration:
> >
> > # …
> > AllowedIPs = 10.136.16.0/22, 169.254.169.253/32
> > # …
> >
>
> Did you set DNS servers manually in "Advanced" section? If yes, try to clear it.

No, I haven't set DNS servers in the Advanced section.

> I use macOS too and everything works fine.

Hm. Using the script from https://github.com/myspaghetti/macos-virtualbox/
I created a macOS running in a VirtualBox as a VM. In this VM, I installed
WireGuard and imported my config. The issue could be reproduced.

To make it clear: nothing else, besides WireGuard and the bloat ware from
Apple was installed and the issue exists. This rules out that there is any
conflicting software installed or any bad configuration on my side. It just
leaves macOS and WireGuard.

On my normal (non-VM) system (where I have the same issues), I also
have OpenVPN and the system built-in VPN (IPsec) installed and configured
to use (not so on the VM). These tools are able to set the DNS. So this
also rules out that there's an issue with macOS.

FWIW, "wg-quick" (wireguard-tools) is able to set DNS (but fails to properly
revert, if multiple tunnels had been brought up at the same time - but that's
a different issue).

> Did the DNS server 10.136.16.2 is the same VM as WireGuard server?

No, it's not. And it's not limited to 10.136.16.2 as DNS server, WireGuard
also doesn't set it to e.g. 1.1.1.1 or 5.132.191.104 (OpenNIC). It only sets
it, when AllowedIPs=0.0.0.0/0.

My configuration (where WireGuard does NOT set DNS):

[Interface]
PrivateKey = ...=
Address = 172.31.0.3/24
DNS = 5.132.191.104

[Peer]
PublicKey = ...=
AllowedIPs = 10.136.16.0/22
Endpoint = wg.....ch:51820

That WireGuard does NOT set the DNS is also visible in the output of
the "dig" command. Eg.:

alex@Alexanders-MacBook-Pro ~ % dig ct.de

; <<>> DiG 9.10.6 <<>> ct.de
...
;; SERVER: 192.168.43.2#53(192.168.43.2)
...

(192.168.43.2 is the IP of my router; it shows that the default wasn't
changed.)

When I use AllowedIPs=0.0.0.0/0, the dig output has this line:

;; SERVER: 1.1.1.1#53(1.1.1.1)

Ie. 1.1.1.1 was used as the IP of system DNS.

Thanks again,

Alexander