Development discussion of WireGuard
 help / color / mirror / Atom feed
* DNS setup issues
       [not found] <c866ae33-489b-1075-99ef-953e38566b73.ref@yahoo.com>
@ 2021-09-22 22:33 ` tlhackque
  0 siblings, 0 replies; only message in thread
From: tlhackque @ 2021-09-22 22:33 UTC (permalink / raw)
  To: wireguard


[-- Attachment #1.1: Type: text/plain, Size: 1692 bytes --]

Working my way through setting up a WireGuard (linux) server, starting
with a simple configuration.

I find that I'm unable to configure the clients (Android, Windows) to
resolve the server endpoint.

This seems to be a bug/oversight in wireguard.  Here's why:

When on the VPN, the client needs to use a DNS server that has an
internal IP address. 

This is because the DNS for the server site has split views.

  * From an internal IP address, both internal and external names are
    resolved - recursively if necessary
  * From a public IP address, only not only are internal hosts
    un-resolvable, some (including the vpn server) have different
    internal and public addresses.

Also, the endpoint has multiple addresses (e.g. v4 and v6), so a name is
especially desirable.

Thus:

  * when the tunnel is up, the client must use an internal DNS server,
    which only has an internal IP address
  * when the tunnel is down (or restarting), the client must use some
    DNS server with a public IP address to resolve the tunnel endpoint.
  * when the tunnel changes state, any DNS cache has to be flushed (or
    tagged with VPN state) so that the correct addresses are used.
  * when a WiFi client initially connects to WiFi, it may have to use
    the DHCP-provided DNS server in order to get through the WiFi portal
    process.

The clients seem to use the DNS server specified in the configuration to
resolve the endpoint address at all times.  Obviously, this fails.

I don't see a way to configure the client to accommodate this use case,
which is pretty common. 

Am I missing something?  If not, a fix would be very helpful.



[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 840 bytes --]

^ permalink raw reply	[flat|nested] only message in thread

only message in thread, other threads:[~2021-09-23  2:46 UTC | newest]

Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
     [not found] <c866ae33-489b-1075-99ef-953e38566b73.ref@yahoo.com>
2021-09-22 22:33 ` DNS setup issues tlhackque

Development discussion of WireGuard

This inbox may be cloned and mirrored by anyone:

	git clone --mirror https://inbox.vuxu.org/wireguard/0 wireguard/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 wireguard wireguard/ https://inbox.vuxu.org/wireguard \
		wireguard@lists.zx2c4.com
	public-inbox-index wireguard

Example config snippet for mirrors.
Newsgroup available over NNTP:
	nntp://inbox.vuxu.org/vuxu.archive.wireguard


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git