4 ms·
About the only issue I've had with wireguard is that it leaks DNS so I'm constantly getting alerts from AWS GuardDuty about suspicious DNS queries. The only way
by zxcvbn4038 5y ago
About the only issue I've had with wireguard is that it leaks DNS so I'm constantly getting alerts from AWS GuardDuty about suspicious DNS queries. The only way around that I can see is to run my own DNS and forward the queries that don't look like they are AWS related to a public resolver like 1.1.1.1.
I am really eager to hear details how the VPNs are implementing Wireguard - particularly the address management portion.
- rndgermandude 5y agoIt doesn't really "leak" DNS, because it has no concept really of DNS resolution. It's a virtual network interface. It will not mess with your resolv.conf. Are you tunneling out of AWS, or are you using some AWS node as a wireguard server? Sounds like the former with wireguard interface being the default gateway (I am not an AWS user and am just guessing)... Adding a route for the AWS DNS server IP(s) to use the real network interface for traffic instead of the wireguard interface might work. Something like ip route add <AWS DNS server IP, or AWS subnet) dev <normal network interface such as eth0> e.g. ip route add 10.0.0/24 dev eth0 Of course, that will make DNS traffic bypass wireguard. If your goal is to hide your DNS queries from AWS except for internal AWS queries, then you will indeed have to run some local resolver that is set up to use the AWS DNS server for AWS-internal queries and some other server (be it a local one or some public one) for everything else.