DNS setup issues
tlhackque at yahoo.com
Wed Sep 22 22:33:54 UTC 2021
Working my way through setting up a WireGuard (linux) server, starting
with a simple configuration.
I find that I'm unable to configure the clients (Android, Windows) to
resolve the server endpoint.
This seems to be a bug/oversight in wireguard. Here's why:
When on the VPN, the client needs to use a DNS server that has an
internal IP address.
This is because the DNS for the server site has split views.
* From an internal IP address, both internal and external names are
resolved - recursively if necessary
* From a public IP address, only not only are internal hosts
un-resolvable, some (including the vpn server) have different
internal and public addresses.
Also, the endpoint has multiple addresses (e.g. v4 and v6), so a name is
* when the tunnel is up, the client must use an internal DNS server,
which only has an internal IP address
* when the tunnel is down (or restarting), the client must use some
DNS server with a public IP address to resolve the tunnel endpoint.
* when the tunnel changes state, any DNS cache has to be flushed (or
tagged with VPN state) so that the correct addresses are used.
* when a WiFi client initially connects to WiFi, it may have to use
the DHCP-provided DNS server in order to get through the WiFi portal
The clients seem to use the DNS server specified in the configuration to
resolve the endpoint address at all times. Obviously, this fails.
I don't see a way to configure the client to accommodate this use case,
which is pretty common.
Am I missing something? If not, a fix would be very helpful.
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 840 bytes
Desc: OpenPGP digital signature
More information about the WireGuard