Split DNS for macOS

[Stephen Larew]

> On Oct 28, 2021, at 00:16, Stephen Larew <stephen at slarew.net> wrote:
> 
> For many months now, I have been running a patched WireGuard macOS app
> that enables a split DNS configuration. I would like to try to upstream
> my patches for split DNS.
> 
> There has been some interest in this patch:
> - "Mac APP DNS Search Domain" thread from July and August 2021 [1]
> - A commenter on my GitHub fork of wireguard-apple.
> 
> What is split DNS? It allows sending DNS queries to a specific server
> based on the domain name. Systemd-resolved calls it a routing domain.
> Apple's Network Extension framework calls it a match domain.  Split DNS
> is especially useful for internal DNS servers.
> 
> For example, if corp.example.com is a routing domain for the DNS server
> at 192.0.2.1 (only accessible over WireGuard), then
> server.corp.example.com is resolved using 192.0.2.1 while
> www.example.com is resolved using some other DNS resolver (depending on
> the other network settings in macOS).
> 
> The proposed patch adds new syntax to the wg-quick DNS= line.
> Specifically, a tilde prefixed domain is treated as a routing domain.
> Multiple routing domains can be added.
> 
> Limitations:
> - Needs modifications to iOS UI to work on iOS.
> - Only matching routing domains are sent to the DNS servers specified in
>  the DNS= config line.  No separate fallback catch-all DNS server can
>  be set.
> - Routing/match domains are also included in the list of search domains.
>  This could be changed with the matchDomainsNoSearch API, but lacking
>  more UI or config file changes to expose this option to the user, I
>  went with the default.
> 
> [1] https://lore.kernel.org/wireguard/20210810074232.aah5ktq5yzysaaey@SvensMacBookAir-2.local/T/
> [2] https://github.com/slarew/wireguard-apple/commit/6ebc356d9e11ab91443e06de5e89f1af57fcdff8

Thanks everyone for your opinions and feedback. Here’s my summary:

- DNS configuration is nuanced, fragmented, and platform dependent.

- Split DNS can be accomplished in several ways:
  - Via the native macOS DNS resolution machinery (NEDNSSettings.matchDomains in my patch)
  - Via a local or upstream non-platform-native DNS resolver

- Demand for split DNS exists. Other VPN apps (e.g. Tailscale and DNSCloak) allow setting split DNS.

--

I would appreciate some feedback from the WireGuard maintainers on next steps. Thanks ahead.

I’ll address some feedback below.

> On Nov 3, 2021, at 02:15, Harald Dunkel <harald.dunkel at aixigo.com> wrote:
> 
> Hi folks,
> 
> I really like this patch. Currently DNS on MacOS is unable to resolve
> both my local DNS names and the domain in the office in parallel, if
> Wireguard is enabled. I have to use somehost.local to fall back to
> zeroconf for my LAN as a workaround, which is pretty annoying.
> 
> My suggestion would be to set SupplementalMatchDomains instead(!) of
> SearchDomains, using the current config file syntax without '~'. Since
> SupplementalMatchDomainsNoSearch is disabled by default, setting
> SupplementalMatchDomains is sufficient to configure both lists. See
> 
> https://developer.apple.com/business/documentation/Configuration-Profile-Reference.pdf
> 
> This has to be verified, of course.
> 
> Regards
> Harri


Harri, it sounds to me like SupplementalMatchDomains is functionally the same as NEDNSSettings.matchDomains. The difference is that SupplementalMatchDomains is specified in Apple’s configuration profiles instead of thru the NEDNSSettings.matchDomains API (by way of a wg-quick syntax extension in my patch). If the WireGuard macOS app supported Apple’s configuration profiles (I don’t believe it does but I may be mistaken), then a configuration profile would conveniently avoid the extended wg-quick syntax in my patch. However, I think configuration profiles are less accessible to the average user.

> On Nov 3, 2021, at 14:34, Andrew Fried <afried at spamteq.com> wrote:
> 
> Basically, what I'm suggesting is that DNS servers handle DNS and wireguard handle routing/transport.  Adding VPN functionality to a nameserver or dns capabilities to Wireguard adds complexities that can be better handled elsewhere.
> 
> What makes Wireguard so good is that it does one thing and does it really, really well.
> 
> Andrew

Andrew, to your point, alternative DNS solutions exist and can be deployed in many ways.  WireGuard itself is not a DNS solution.  That said, wg-quick style configuration (used by the WireGuard macOS app) already does basic DNS configuration.  My patch adds a small extension to wg-quick syntax (tilde prefixed domains) to make certain split DNS scenarios possible.

Crucially, my patch actually integrates directly into macOS’s DNS machinery. No third party software or external network DNS servers need apply.

> On Nov 5, 2021, at 21:54, David Anderson <dave at natulte.net> wrote:
> 
> Hi, Tailscale person here.

Dave, your technical details sound right based on what I remember from my own experimentation.

-Stephen