wireguard.lists.zx2c4.com archive mirror
 help / color / mirror / Atom feed
From: tlhackque <tlhackque@yahoo.com>
To: wireguard@lists.zx2c4.com
Subject: DNS setup issues
Date: Wed, 22 Sep 2021 18:33:54 -0400	[thread overview]
Message-ID: <c866ae33-489b-1075-99ef-953e38566b73@yahoo.com> (raw)
In-Reply-To: <c866ae33-489b-1075-99ef-953e38566b73.ref@yahoo.com>


[-- Attachment #1.1: Type: text/plain, Size: 1692 bytes --]

Working my way through setting up a WireGuard (linux) server, starting
with a simple configuration.

I find that I'm unable to configure the clients (Android, Windows) to
resolve the server endpoint.

This seems to be a bug/oversight in wireguard.  Here's why:

When on the VPN, the client needs to use a DNS server that has an
internal IP address. 

This is because the DNS for the server site has split views.

  * From an internal IP address, both internal and external names are
    resolved - recursively if necessary
  * From a public IP address, only not only are internal hosts
    un-resolvable, some (including the vpn server) have different
    internal and public addresses.

Also, the endpoint has multiple addresses (e.g. v4 and v6), so a name is
especially desirable.

Thus:

  * when the tunnel is up, the client must use an internal DNS server,
    which only has an internal IP address
  * when the tunnel is down (or restarting), the client must use some
    DNS server with a public IP address to resolve the tunnel endpoint.
  * when the tunnel changes state, any DNS cache has to be flushed (or
    tagged with VPN state) so that the correct addresses are used.
  * when a WiFi client initially connects to WiFi, it may have to use
    the DHCP-provided DNS server in order to get through the WiFi portal
    process.

The clients seem to use the DNS server specified in the configuration to
resolve the endpoint address at all times.  Obviously, this fails.

I don't see a way to configure the client to accommodate this use case,
which is pretty common. 

Am I missing something?  If not, a fix would be very helpful.



[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 840 bytes --]

           reply	other threads:[~2021-09-23  2:46 UTC|newest]

Thread overview: expand[flat|nested]  mbox.gz  Atom feed
 [parent not found: <c866ae33-489b-1075-99ef-953e38566b73.ref@yahoo.com>]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=c866ae33-489b-1075-99ef-953e38566b73@yahoo.com \
    --to=tlhackque@yahoo.com \
    --cc=wireguard@lists.zx2c4.com \
    --subject='Re: DNS setup issues' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).