4 ms·

WireGuard DNS Configuration for Systemd

65 points by carride 5y ago

xrd 5y ago
Are there other references on using DNS with wireguard? Wireguard is so easy to setup but I don't feel like I've got the equivalent ease for a local DNS system. I end up putting lots of names inside cloudflare DNS which seems totally wrong. What are other people doing, no one can be running their own BIND servers, right? Is there a good complementary docker image for DNS with wireguard?
- 3np 5y ago
  Run a DNS server, either shared one(s) inside the tunnel or locally on each host. In case of the latter you don't even need systemd-resolved anymore. Unless you have reasons to prefer BIND, I'd recommend dnsmasq (most popular lightweight) or coredns (intuitive straightforward conf, also lightweight). You can set them as authoritative for your own domain and forward the rest to whatever you use for DNS otherwise.
VTimofeenko 5y ago
An alternative solution is to use Linux namespaces to move the Wireguard into a dedicated namespace[1] and use /etc/netns/$NAMESPACE_NAME/resolv.conf for DNS configuration dedicated to that namespace[2]. AFAIK that also plays well with systemd-resolved. [1]: https://www.wireguard.com/netns/ https://www.wireguard.com/netns/ [2]: https://man7.org/linux/man-pages/man8/ip-netns.8.html https://man7.org/linux/man-pages/man8/ip-netns.8.html
- VTimofeenko 5y ago
  Correction: in case of specific nsswitch configuration it may not play well with resolved. But nsswitch.conf also gets bind-mounted per network namespace: https://www.philipdeljanov.com/posts/2019/05/31/dns-leaks-with-network-namespaces/ https://www.philipdeljanov.com/posts/2019/05/31/dns-leaks-wi...
3np 5y ago
If you're on systemd anyway, rather than wg-quick, consider defining your wireguard networks through the more powerful systemd-networkd. It has native support and you can define routes, policies, and fwmarks etc in the same files rather than mucking around with ip-route and iptables commands. wg-quick is really that - quickly get a simple tunnel up and running which works fine when you just want to route all IPs in a single subnet or 0.0.0.0/0 and nothing more, but anything more complex (split tunneling for example) and it quickly (!) becomes cumbersome. Slightly OT but I personally very much prefer systemd-networkd over NetworkManager, which I find unpredictable. https://elou.world/en/tutorial/wireguard https://elou.world/en/tutorial/wireguard https://www.man7.org/linux/man-pages/man5/systemd.netdev.5.html#%5BWIREGUARD%5D_SECTION_OPTIONS https://www.man7.org/linux/man-pages/man5/systemd.netdev.5.h...
- 0x38B 5y ago
  Correct me if I'm wrong, but controlling WireGuard with systemd-networkd makes it 'always on', which means you can't easily turn it on and off. This was a deal-breaker for me, as I don't need it active all the time.
  - genghizkhan 5y ago
    $ networkctl down wg0 $ networkctl up wg0 I’d you’ve changed the WireGuard config then: $ systemctl reload systemd-networkd
oriettaxx 5y ago
the "Override DNS Globally" does not work for me (Fedora)
- vetinari 5y ago
  On fedora, import your wg.conf into NetworkManager (`nmcli connection import type wireguard wg0.conf`) and set up DNS using nm connection properties (ipv4.dns-search supports the ~.domain notation, see resolved.conf(5) for details). The connection will auto-start; if you do now want that and you want manually start/stop ip, set ipv4.autoconnect=no. Fedora uses systemd-resolved by default since the 33 release; if you installed older and then upgraded, check the network manager config if you are using it or not.
  - oriettaxx 5y ago
    I see, thanks (bwt the `file` tag is missing) nmcli connection import type wireguard file wg0.conf
    - vetinari 5y ago
      yeah, sorry :)
- aaaaaaaaata 5y ago
  It's almost tradition at this point for older distros to have misleading/inaccurate GUI for NetworkManager...
oriettaxx 5y ago
I've lost the whole day trying to understand the pretty complicated logic on how to have control of my linux (fedora) DNS with the many internet/connections nad wireguard's profile, and once again I went back to https://www.ctrl.blog/entry/resolvconf-tutorial.html https://www.ctrl.blog/entry/resolvconf-tutorial.html (disable everything and just handle /etc/resolv.conf the 'old' way, and now finally I have no more leaks https://dnsleaktest.com https://dnsleaktest.com as for wireguard, a pretty brutal settings in all wireguard profiles: PostUp = echo "nameserver <DNS IP in wireguard>" > /etc/resolv.conf PostDown = echo "nameserver 127.0.0.1" > /etc/resolv.conf and even a dns=none in /etc/NetworkManager/NetworkManager.conf p.s. I am aware of the great discussion in https://news.ycombinator.com/item?id=19435631 https://news.ycombinator.com/item?id=19435631 especially usr1106 comment
oriettaxx 5y ago
btw: the cited https://www.quad9.net https://www.quad9.net is really great! (I did not know about it!)
Spivak 5y ago
The author missed the “real” solution to resolvconf missing which is to install systemd-resolvconf [1] because resolvctl actually has a full resolvconf implementation already there, you just have to call it using that name. https://archlinux.org/packages/?name=systemd-resolvconf https://archlinux.org/packages/?name=systemd-resolvconf

65 points by carride 5y ago

xrd 5y ago

Are there other references on using DNS with wireguard? Wireguard is so easy to setup but I don't feel like I've got the equivalent ease for a local DNS system. I end up putting lots of names inside cloudflare DNS which seems totally wrong. What are other people doing, no one can be running their own BIND servers, right? Is there a good complementary docker image for DNS with wireguard?

3np 5y ago
Run a DNS server, either shared one(s) inside the tunnel or locally on each host. In case of the latter you don't even need systemd-resolved anymore. Unless you have reasons to prefer BIND, I'd recommend dnsmasq (most popular lightweight) or coredns (intuitive straightforward conf, also lightweight). You can set them as authoritative for your own domain and forward the rest to whatever you use for DNS otherwise.

VTimofeenko 5y ago

An alternative solution is to use Linux namespaces to move the Wireguard into a dedicated namespace[1] and use /etc/netns/$NAMESPACE_NAME/resolv.conf for DNS configuration dedicated to that namespace[2]. AFAIK that also plays well with systemd-resolved. [1]: https://www.wireguard.com/netns/ https://www.wireguard.com/netns/ [2]: https://man7.org/linux/man-pages/man8/ip-netns.8.html https://man7.org/linux/man-pages/man8/ip-netns.8.html

VTimofeenko 5y ago
Correction: in case of specific nsswitch configuration it may not play well with resolved. But nsswitch.conf also gets bind-mounted per network namespace: https://www.philipdeljanov.com/posts/2019/05/31/dns-leaks-with-network-namespaces/ https://www.philipdeljanov.com/posts/2019/05/31/dns-leaks-wi...

3np 5y ago

If you're on systemd anyway, rather than wg-quick, consider defining your wireguard networks through the more powerful systemd-networkd. It has native support and you can define routes, policies, and fwmarks etc in the same files rather than mucking around with ip-route and iptables commands. wg-quick is really that - quickly get a simple tunnel up and running which works fine when you just want to route all IPs in a single subnet or 0.0.0.0/0 and nothing more, but anything more complex (split tunneling for example) and it quickly (!) becomes cumbersome. Slightly OT but I personally very much prefer systemd-networkd over NetworkManager, which I find unpredictable. https://elou.world/en/tutorial/wireguard https://elou.world/en/tutorial/wireguard https://www.man7.org/linux/man-pages/man5/systemd.netdev.5.html#%5BWIREGUARD%5D_SECTION_OPTIONS https://www.man7.org/linux/man-pages/man5/systemd.netdev.5.h...

0x38B 5y ago
Correct me if I'm wrong, but controlling WireGuard with systemd-networkd makes it 'always on', which means you can't easily turn it on and off. This was a deal-breaker for me, as I don't need it active all the time.
- genghizkhan 5y ago
  $ networkctl down wg0 $ networkctl up wg0 I’d you’ve changed the WireGuard config then: $ systemctl reload systemd-networkd

oriettaxx 5y ago

the "Override DNS Globally" does not work for me (Fedora)

vetinari 5y ago
On fedora, import your wg.conf into NetworkManager (`nmcli connection import type wireguard wg0.conf`) and set up DNS using nm connection properties (ipv4.dns-search supports the ~.domain notation, see resolved.conf(5) for details). The connection will auto-start; if you do now want that and you want manually start/stop ip, set ipv4.autoconnect=no. Fedora uses systemd-resolved by default since the 33 release; if you installed older and then upgraded, check the network manager config if you are using it or not.
- oriettaxx 5y ago
  I see, thanks (bwt the `file` tag is missing) nmcli connection import type wireguard file wg0.conf
  - vetinari 5y ago
    yeah, sorry :)
aaaaaaaaata 5y ago
It's almost tradition at this point for older distros to have misleading/inaccurate GUI for NetworkManager...

oriettaxx 5y ago

I've lost the whole day trying to understand the pretty complicated logic on how to have control of my linux (fedora) DNS with the many internet/connections nad wireguard's profile, and once again I went back to https://www.ctrl.blog/entry/resolvconf-tutorial.html https://www.ctrl.blog/entry/resolvconf-tutorial.html (disable everything and just handle /etc/resolv.conf the 'old' way, and now finally I have no more leaks https://dnsleaktest.com https://dnsleaktest.com as for wireguard, a pretty brutal settings in all wireguard profiles: PostUp = echo "nameserver <DNS IP in wireguard>" > /etc/resolv.conf PostDown = echo "nameserver 127.0.0.1" > /etc/resolv.conf and even a dns=none in /etc/NetworkManager/NetworkManager.conf p.s. I am aware of the great discussion in https://news.ycombinator.com/item?id=19435631 https://news.ycombinator.com/item?id=19435631 especially usr1106 comment

oriettaxx 5y ago

btw: the cited https://www.quad9.net https://www.quad9.net is really great! (I did not know about it!)

Spivak 5y ago

The author missed the “real” solution to resolvconf missing which is to install systemd-resolvconf [1] because resolvctl actually has a full resolvconf implementation already there, you just have to call it using that name. https://archlinux.org/packages/?name=systemd-resolvconf https://archlinux.org/packages/?name=systemd-resolvconf