TransWikia.com

DNS problems with Wireguard VPN

Ask Different Asked by nick2k3 on October 30, 2021

I am using wireguard Application to establish a VPN between my Mac running (Catalina 10.15.6) and my home.
At home I run two RPi:

  • one with wireguard in docker
  • one with Pihole in docker (IP 192.168.178.120)

The wireguard configuration i am using specifies the use of the Pihole as DNS):

[Interface]
PrivateKey = [private_key]
ListenPort = [public_port]
Address = 10.13.14.3/32
DNS = 192.168.178.120

[Peer]
PublicKey = [public_key]
AllowedIPs = 192.168.178.0/24
Endpoint = [endpoint hostname]

The same configuration is in use on all my devices (iOS, Windows 10 etc) and I can always use the specified DNS to resolve all the domains.

Under OSX instead using that DNS is hit or miss:

  • I can ping correctly the IP of the DNS and any other internal IP without any packet loss
  • I can use nslookup to specify 192.168.178.120 as a server and correctly query for both external and internal names
  • Safari might be able to resolve one internal name, but after some time tries to use the router-defined DNS (192.168.1.1) thus not resolving internal names anymore (I notice this from the presence of Ads that would normally be blocked by PiHole)
  • Network utility shows the same hit/miss scenario: sometimes it is resolving internal names,sometimes it is not
  • adding the 192.168.178.120 in the network settings of the Wifi in OSX might help for a while but is not 100% reliable

So I am asking for help on what to do to diagnose the problem further.
DNS resolution on Mac seems really strange to me to be honest.

One Answer

This is a known problem in WireGuard / OSX:

matchDomains=[“”] doesn’t do what the documentation says. Specifically, DNS servers are not used if allowed IPs isn’t 0.0.0.0/0.

For now, I am just manually setting DNS from a script:

sudo /usr/sbin/networksetup -setdnsservers Wi-Fi 1.1.1.1

Looks like Tunnelblick is doing scutil manipulations for openvpn (https://github.com/Tunnelblick/Tunnelblick/blob/master/tunnelblick/client.2.up.tunnelblick.sh) -- which is working on my mac

Answered by Luca Gibelli on October 30, 2021

Add your own answers!

Ask a Question

Get help from others!

© 2024 TransWikia.com. All rights reserved. Sites we Love: PCI Database, UKBizDB, Menu Kuliner, Sharing RPP