On Jul 17, 2021, at 03:09, Sven Auhagen <[email protected]> wrote: > > Hi, > > the DNS search domain in the Wireguard Mac APP does not seem to work properly. > The search domain is added properly and I can see it in the DNS configuration > for the scoped query: > > resolver #2 > search domain[0] : mytestdomain.com > nameserver[0] : 192.168.6.1 > if_index : 17 (utun4) > flags : Scoped, Request A records > reach : 0x00000002 (Reachable) > > but the global resolver is using a mix of my LAN and Wireguard DNS resolver: > > resolver #1 > search domain[0] : sven.lan > nameserver[0] : 192.168.6.1 > if_index : 17 (utun4) > flags : Supplemental, Request A records > reach : 0x00000002 (Reachable) > order : 102200 > > I found a discussion on Github about the issue here: > https://github.com/tailscale/tailscale/issues/101#issuecomment-639286398 > > suggesting that the following will fix it: > > --- a/Sources/WireGuardKit/PacketTunnelSettingsGenerator.swift > +++ b/Sources/WireGuardKit/PacketTunnelSettingsGenerator.swift > @@ -88,7 +88,7 @@ class PacketTunnelSettingsGenerator { > let dnsSettings = NEDNSSettings(servers: dnsServerStrings) > dnsSettings.searchDomains = > tunnelConfiguration.interface.dnsSearch > if !tunnelConfiguration.interface.dns.isEmpty { > - dnsSettings.matchDomains = [""] // All DNS queries must > first go through the tunnel's DNS > + dnsSettings.matchDomains = [""] + dnsSettings.searchDomains > // All DNS queries must first go through the tunnel's DNS > } > networkSettings.dnsSettings = dnsSettings > } > > I do not have an Apple Developer Account so I am not able to compile the code > and test it. > Can anyone take a look as this would be a great help. > > Best > Sven
Sven, I have a patch for Wireguard Mac app that enables proper split DNS support. It works well in my usage. I should properly submit the patch for review by Wireguard folks. Until then, you can get the patch here: https://github.com/slarew/wireguard-apple/commit/6ebc356d9e11ab91443e06de5e89f1af57fcdff8 > Enable "split DNS" configurations for an interface > > By adding a tilde prefix to a domain name entry in the DNS= line, the > domain is interpreted as a "matching domain" for DNS routing instead of > a "search domain." This corresponds to setting a non-empty > NEDNSSettings.matchDomains property for the network tunnel. Using tilde > as a prefix is borrowed from systemd-resolved's equivalent usage. > > If one or more match domains are specified, then the specified DNS > resolvers are only used for those matching domains instead of acting as > the first resolver before the system's primary DNS resolvers. -Stephen
