DNS setup issues

[tlhackque]

Working my way through setting up a WireGuard (linux) server, starting
with a simple configuration.

I find that I'm unable to configure the clients (Android, Windows) to
resolve the server endpoint.

This seems to be a bug/oversight in wireguard.  Here's why:

When on the VPN, the client needs to use a DNS server that has an
internal IP address. 

This is because the DNS for the server site has split views.

  * From an internal IP address, both internal and external names are
    resolved - recursively if necessary
  * From a public IP address, only not only are internal hosts
    un-resolvable, some (including the vpn server) have different
    internal and public addresses.

Also, the endpoint has multiple addresses (e.g. v4 and v6), so a name is
especially desirable.

Thus:

  * when the tunnel is up, the client must use an internal DNS server,
    which only has an internal IP address
  * when the tunnel is down (or restarting), the client must use some
    DNS server with a public IP address to resolve the tunnel endpoint.
  * when the tunnel changes state, any DNS cache has to be flushed (or
    tagged with VPN state) so that the correct addresses are used.
  * when a WiFi client initially connects to WiFi, it may have to use
    the DHCP-provided DNS server in order to get through the WiFi portal
    process.

The clients seem to use the DNS server specified in the configuration to
resolve the endpoint address at all times.  Obviously, this fails.

I don't see a way to configure the client to accommodate this use case,
which is pretty common. 

Am I missing something?  If not, a fix would be very helpful.


-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature
Type: application/pgp-signature
Size: 840 bytes
Desc: OpenPGP digital signature
URL: <http://lists.zx2c4.com/pipermail/wireguard/attachments/20210922/d0c9241a/attachment.sig>