Mac APP DNS Search Domain

[Stephen Larew]

On Jul 17, 2021, at 03:09, Sven Auhagen <sven.auhagen at voleatech.de> wrote:
> 
> Hi,
> 
> the DNS search domain in the Wireguard Mac APP does not seem to work properly.
> The search domain is added properly and I can see it in the DNS configuration
> for the scoped query:
> 
> resolver #2
> search domain[0] : mytestdomain.com
> nameserver[0] : 192.168.6.1
> if_index : 17 (utun4)
> flags    : Scoped, Request A records
> reach    : 0x00000002 (Reachable)
> 
> but the global resolver is using a mix of my LAN and Wireguard DNS resolver:
> 
> resolver #1
> search domain[0] : sven.lan
> nameserver[0] : 192.168.6.1
> if_index : 17 (utun4)
> flags    : Supplemental, Request A records
> reach    : 0x00000002 (Reachable)
> order    : 102200
> 
> I found a discussion on Github about the issue here:
> https://github.com/tailscale/tailscale/issues/101#issuecomment-639286398
> 
> suggesting that the following will fix it:
> 
> --- a/Sources/WireGuardKit/PacketTunnelSettingsGenerator.swift
> +++ b/Sources/WireGuardKit/PacketTunnelSettingsGenerator.swift
> @@ -88,7 +88,7 @@ class PacketTunnelSettingsGenerator {
>             let dnsSettings = NEDNSSettings(servers: dnsServerStrings)
>             dnsSettings.searchDomains = tunnelConfiguration.interface.dnsSearch
>             if !tunnelConfiguration.interface.dns.isEmpty {
> -                dnsSettings.matchDomains = [""] // All DNS queries must first go through the tunnel's DNS
> +                dnsSettings.matchDomains = [""] + dnsSettings.searchDomains // All DNS queries must first go through the tunnel's DNS
>             }
>             networkSettings.dnsSettings = dnsSettings
>         }
> 
> I do not have an Apple Developer Account so I am not able to compile the code and test it.
> Can anyone take a look as this would be a great help.
> 
> Best
> Sven

Sven,

I have a patch for Wireguard Mac app that enables proper split DNS support. It works well in my usage.  I should properly submit the patch for review by Wireguard folks.  Until then, you can get the patch here:

https://github.com/slarew/wireguard-apple/commit/6ebc356d9e11ab91443e06de5e89f1af57fcdff8

> Enable "split DNS" configurations for an interface
> 
> By adding a tilde prefix to a domain name entry in the DNS= line, the
> domain is interpreted as a "matching domain" for DNS routing instead of
> a "search domain."  This corresponds to setting a non-empty
> NEDNSSettings.matchDomains property for the network tunnel.  Using tilde
> as a prefix is borrowed from systemd-resolved's equivalent usage.
> 
> If one or more match domains are specified, then the specified DNS
> resolvers are only used for those matching domains instead of acting as
> the first resolver before the system's primary DNS resolvers.

-Stephen