From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: jonathan@jonathanhult.com Received: from krantz.zx2c4.com (localhost [127.0.0.1]) by krantz.zx2c4.com (ZX2C4 Mail Server) with ESMTP id 746b7b2b for ; Mon, 18 Jun 2018 19:45:43 +0000 (UTC) Received: from mail-lf0-x22e.google.com (mail-lf0-x22e.google.com [IPv6:2a00:1450:4010:c07::22e]) by krantz.zx2c4.com (ZX2C4 Mail Server) with ESMTP id e16f59c1 for ; Mon, 18 Jun 2018 19:45:43 +0000 (UTC) Received: by mail-lf0-x22e.google.com with SMTP id y20-v6so26537069lfy.0 for ; Mon, 18 Jun 2018 12:50:16 -0700 (PDT) MIME-Version: 1.0 From: Jonathan Hult Date: Mon, 18 Jun 2018 15:49:48 -0400 Message-ID: Subject: Is a hostname a valid value value for Endpoint? To: wireguard@lists.zx2c4.com Content-Type: multipart/alternative; boundary="000000000000d1a0dc056eefdf96" List-Id: Development discussion of WireGuard List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , --000000000000d1a0dc056eefdf96 Content-Type: text/plain; charset="UTF-8" Greetings, I would like to know if a hostname is a valid value for *Endpoint*? Today, the documentation all seems to reference an IP address. Today, Mullvad currently sets *EndPoint* to a hostname (see here ) In my case, my host is set to use a DNS server which routes VPN provider domains to a bad IP (in order to block them). 1. If *EndPoint* should never be a hostname, perhaps we should prevent (or at least warn) when it is found to be a hostname (instead of an IP address). 2. If *EndPoint* can be a hostname, then I think we want to ensure DNS is set from the configuration file before attempting to connect. In the wg-quick script , I updated the *cmd_up()* function to call *set_dns()* earlier on than it is currently called. This prevents my host's original DNS server from blocking anything. Jonathan --000000000000d1a0dc056eefdf96 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Greetings,

<= /div>
I would like to know if a hostname is a valid value for=C2=A0= Endpoint? Today, the documentation all seems to reference an IP address= .

Today, Mullvad currently sets EndPoint to a hostname=C2=A0(s= ee here= )

In my case, my = host is set to use a DNS server which routes VPN provider domains to a bad = IP (in order to block them).

1.=C2=A0If EndPoint should never be a hostname, perhaps we should prevent= (or at least warn) when it is found to be a hostname (instead of an IP add= ress).

2. If EndPoint= can be a hostname, then I think we want to ensure DNS is set from the conf= iguration file before attempting to connect. In the wg-quick script= , I updated the cmd_up() function to call set_dns() earlier o= n than it is currently called. This prevents=C2=A0my host's original DNS server f= rom blocking anything.
=
= Jonathan
--000000000000d1a0dc056eefdf96-- From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Jason@zx2c4.com Received: from krantz.zx2c4.com (localhost [127.0.0.1]) by krantz.zx2c4.com (ZX2C4 Mail Server) with ESMTP id b2f06ff5 for ; Thu, 21 Jun 2018 23:51:14 +0000 (UTC) Received: from frisell.zx2c4.com (frisell.zx2c4.com [192.95.5.64]) by krantz.zx2c4.com (ZX2C4 Mail Server) with ESMTP id a006aad4 for ; Thu, 21 Jun 2018 23:51:14 +0000 (UTC) Received: by frisell.zx2c4.com (ZX2C4 Mail Server) with ESMTP id 50c47466 for ; Thu, 21 Jun 2018 23:49:59 +0000 (UTC) Received: by frisell.zx2c4.com (ZX2C4 Mail Server) with ESMTPSA id fcf6cd20 (TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128:NO) for ; Thu, 21 Jun 2018 23:49:59 +0000 (UTC) Received: by mail-ot0-f172.google.com with SMTP id l15-v6so5557718oth.6 for ; Thu, 21 Jun 2018 16:56:10 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: "Jason A. Donenfeld" Date: Fri, 22 Jun 2018 01:55:56 +0200 Message-ID: Subject: Re: Is a hostname a valid value value for Endpoint? To: jonathan@jonathanhult.com Content-Type: text/plain; charset="UTF-8" Cc: WireGuard mailing list List-Id: Development discussion of WireGuard List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , The endpoint can contain a domain, yes. However, the correct behavior is to look up that domain using the DNS server that exists prior to turning on WireGuard. Otherwise you'd have a chicken&egg problem with tunnel-only accessible DNS servers.