Development discussion of WireGuard
 help / color / mirror / Atom feed
* Re: Split DNS for macOS
@ 2021-10-29 21:06 Matty Driessen
  2021-11-03 21:34 ` Andrew Fried
  0 siblings, 1 reply; 16+ messages in thread
From: Matty Driessen @ 2021-10-29 21:06 UTC (permalink / raw)
  To: wireguard

Hello Andrew,

I just want to chime in here and say that I think the current
implementation of search domains is simply not working the way it
should on the MacOS client.

My use case is pretty common, an internal DNS server that has entries
for internal servers. I defined a search domain in the WireGuard
configuration; DNS = 10.13.13.1 mydomain.internal. The search domain
is for convenience, so I can just use the servername instead of
servername.mydomain.internal. Now this works fine when I route all the
traffic through the VPN (AllowedIPs = 0.0.0.0/0) but the search domain
is completely ignored when I only route the traffic I need to
(AllowedIPs = 10.13.13.0/24 192.168.0.0/24).

I don't think this is a configuration error on my side. The DNS
responds fine when using servername.mydomain.internal. This problem is
even mentioned in the "WireGuard macOS & iOS TODO List"
9. matchDomains=[“”] doesn’t do what the documentation says.
Specifically, DNS servers are not used if allowed IPs isn’t 0.0.0.0/0.

The description isn't 100% accurate (or outdated), the DNS server is
used but the search domain isn't being set on the primary resolver.
Some have solved this issue by adding the search domains to the list
of matchDomains; dnsSettings.matchDomains = [""] +
dnsSettings.searchDomains. But that way the DNS server specified in
WireGuard is still the primary resolver for all DNS queries.

Here is a link on how OpenVPN handles this and I think it's how it
should work when not using AllowedIPs 0.0.0.0/0.
https://openvpn.net/faq/how-does-ios-interpret-pushed-dns-servers-and-search-domains/
On a split-tunnel, where redirect-gateway is not pushed by the server,
and at least one pushed DNS server is present:
- route all DNS requests through pushed DNS server(s) if no added
search domains.
- route DNS requests for added search domains only, if at least one
added search domain.

Yours sincerely,
Matty

--

Hi Stephen,

A better solution to your problem would be to deploy DNSDIST:
        https://dnsdist.org/

I for one would hope that esoteric requests that address a solution
for less than 1% of the users would be rejected with the overall goal
of preventing feature creep and bloat.

Andrew

^ permalink raw reply	[flat|nested] 16+ messages in thread
* Split DNS for macOS
@ 2021-10-28  7:16 Stephen Larew
  2021-10-28  9:58 ` Bruce Ferrell
  2022-01-28  5:23 ` Stephen Larew
  0 siblings, 2 replies; 16+ messages in thread
From: Stephen Larew @ 2021-10-28  7:16 UTC (permalink / raw)
  To: wireguard

For many months now, I have been running a patched WireGuard macOS app
that enables a split DNS configuration. I would like to try to upstream
my patches for split DNS.

There has been some interest in this patch:
- "Mac APP DNS Search Domain" thread from July and August 2021 [1]
- A commenter on my GitHub fork of wireguard-apple.

What is split DNS? It allows sending DNS queries to a specific server
based on the domain name. Systemd-resolved calls it a routing domain.
Apple's Network Extension framework calls it a match domain.  Split DNS
is especially useful for internal DNS servers.

For example, if corp.example.com is a routing domain for the DNS server
at 192.0.2.1 (only accessible over WireGuard), then
server.corp.example.com is resolved using 192.0.2.1 while
www.example.com is resolved using some other DNS resolver (depending on
the other network settings in macOS).

The proposed patch adds new syntax to the wg-quick DNS= line.
Specifically, a tilde prefixed domain is treated as a routing domain.
Multiple routing domains can be added.

Limitations:
- Needs modifications to iOS UI to work on iOS.
- Only matching routing domains are sent to the DNS servers specified in
  the DNS= config line.  No separate fallback catch-all DNS server can
  be set.
- Routing/match domains are also included in the list of search domains.
  This could be changed with the matchDomainsNoSearch API, but lacking
  more UI or config file changes to expose this option to the user, I
  went with the default.

[1] https://lore.kernel.org/wireguard/20210810074232.aah5ktq5yzysaaey@SvensMacBookAir-2.local/T/
[2] https://github.com/slarew/wireguard-apple/commit/6ebc356d9e11ab91443e06de5e89f1af57fcdff8



^ permalink raw reply	[flat|nested] 16+ messages in thread

end of thread, other threads:[~2022-01-28  9:02 UTC | newest]

Thread overview: 16+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-10-29 21:06 Split DNS for macOS Matty Driessen
2021-11-03 21:34 ` Andrew Fried
2021-11-03 21:46   ` Alex Burke
  -- strict thread matches above, loose matches on Subject: below --
2021-10-28  7:16 Stephen Larew
2021-10-28  9:58 ` Bruce Ferrell
2021-10-29 15:33   ` Stephen Larew
2021-10-29 17:03     ` Andrew Fried
2021-10-29 21:07       ` Stephen Larew
2021-10-30 21:00         ` Dusan Zivadinovic
2021-11-03  9:15         ` Harald Dunkel
2021-11-03  9:42           ` Matty Driessen
2021-11-03 11:54         ` Alex Burke
2021-11-06  4:54         ` David Anderson
2021-11-06  9:47           ` Matty Driessen
2022-01-28  5:23 ` Stephen Larew
2022-01-28  9:02   ` Harald Dunkel

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).