6 ms·

I really want to like WireGuard, and these get so close to what I want. I think as soon as Headscale gets the iOS story sorted out I'll be able to switch away

I really want to like WireGuard, and these get so close to what I want. I think as soon as Headscale gets the iOS story sorted out I'll be able to switch away from IKEv2/IPSec. Right now the thing that's stopping me is the lack of Split-DNS. I'd even be happy if I could configure this in the official client, I've only got a handful of devices so distributing the configuration by hand is fine. My IKEv2/IPSec set up does this perfectly, and using MDM profiles lets me set up connect-on-demand. WireGuard already does connect-on-demand and my limited testing suggests that it works well enough. I don't want to use Tailscale since I'd like to keep everything self-hosted. It sounds like Headscale is almost there - it just needs the iOS client to be able to point to an arbitrary endpoint.

j0057 4y ago
You can use openresolv to configure a local DNS server to do split DNS, or let do systemd-resolved do it. Or did you mean Android/iOS with 'official client'?
- Mister_Snuggles 4y ago
  In my case I mean the iOS official client.
belthesar 4y ago
This is feasible to config in WireGuard, but it’s somewhat up to the host to leverage it appropriately, and the config is certainly not clear about that fact. If you append the DNS config of a peer with the search domains you want sent over the private horizon (eg: 192.168.1.10, 192.168.1.11, internal.domain, other.domain) this is intended to configure conditional forwarding for those zones you specify. Again, it’s dependent on the peer host OS to be able to do that, but that’s how I do it with my client access VPN.
- Mister_Snuggles 4y ago
  That's the biggest challenge - it's not really a WireGuard problem, but "something" needs to be able to tell iOS "use server X for *.blah, otherwise use whatever servers you got from the WiFi connection".
gorkish 4y ago
FYI macOS (/etc/resolver/*) and windows (Set-DnsClientNrtpPolicy) resolvers support split dns out of the box. Suggestion for mobile is less ideal, but just tunnel to a DNS server that takes care of split resolution and use that server when wg interface is up. Wireguard itself will always consider authentication, dns, routing, etc. out of scope which IMO is really for the best
- Mister_Snuggles 4y ago
  My mental model of WireGuard is that it wants to replace IPSec (the encryption/tunneling), not IKE/IKEv2 (authentication, session setup, etc). It's not a perfect mental model, but it serves me well. On the official client I can specify DNS servers for a particular connection, so one "easy" solution would be to specify domains that need to go to that set of DNS servers. e.g., when connected to home use 192.168.x.y to resolve *.blah, otherwise use the system resolvers.
afeiszli 4y ago
Split DNS is super complicated to implement client side. We halfway implemented a solution and backtracked, eventually settling on just setting /etc/hosts. There's way too many variables involved across all the different operating systems.
- sph 4y ago
  These days it's pretty simple to achieve with systemd-resolved. I've been playing with split DNS and VPNs for a while and it seems it's a solved problem on Linux, finally. The big hurdle is understanding the concept of search domain vs routing domain and the interaction with resolved and NetworkManager.
  - Fnoord 4y ago
    Funny, systemd is like an opposite of wireguard in design goal. I believe the UNIX way would be /etc/hosts but some way to sync these within clients. Like etcd or whatever.
    - jeltz 4y ago
      An issue with /etc/hosts is that it is just one file and you do not want etcd to own all the config you would need to use something like NIS instead.
      - Fnoord 4y ago
        Ah yes, my bad. /etc/nsswitch.conf (which is also a Linux-ism but BSDs have something similar) supports LDAP. However, an advantage of /etc/hosts is the low latency since its not networked, while LDAP would result to overhead. Still, I believe that would be a suitable alternative. There's some non-bloated alternatives to OpenLDAP, and also an option could be caching.
- afeiszli 4y ago
  Yeah that’s what we used, but not all Linux supports it, and that still leaves non-Linux as well. But hosts files are universal.

j0057 4y ago

You can use openresolv to configure a local DNS server to do split DNS, or let do systemd-resolved do it. Or did you mean Android/iOS with 'official client'?

Mister_Snuggles 4y ago
In my case I mean the iOS official client.

belthesar 4y ago

This is feasible to config in WireGuard, but it’s somewhat up to the host to leverage it appropriately, and the config is certainly not clear about that fact. If you append the DNS config of a peer with the search domains you want sent over the private horizon (eg: 192.168.1.10, 192.168.1.11, internal.domain, other.domain) this is intended to configure conditional forwarding for those zones you specify. Again, it’s dependent on the peer host OS to be able to do that, but that’s how I do it with my client access VPN.

Mister_Snuggles 4y ago
That's the biggest challenge - it's not really a WireGuard problem, but "something" needs to be able to tell iOS "use server X for *.blah, otherwise use whatever servers you got from the WiFi connection".

gorkish 4y ago

FYI macOS (/etc/resolver/*) and windows (Set-DnsClientNrtpPolicy) resolvers support split dns out of the box. Suggestion for mobile is less ideal, but just tunnel to a DNS server that takes care of split resolution and use that server when wg interface is up. Wireguard itself will always consider authentication, dns, routing, etc. out of scope which IMO is really for the best

Mister_Snuggles 4y ago
My mental model of WireGuard is that it wants to replace IPSec (the encryption/tunneling), not IKE/IKEv2 (authentication, session setup, etc). It's not a perfect mental model, but it serves me well. On the official client I can specify DNS servers for a particular connection, so one "easy" solution would be to specify domains that need to go to that set of DNS servers. e.g., when connected to home use 192.168.x.y to resolve *.blah, otherwise use the system resolvers.

afeiszli 4y ago

Split DNS is super complicated to implement client side. We halfway implemented a solution and backtracked, eventually settling on just setting /etc/hosts. There's way too many variables involved across all the different operating systems.

sph 4y ago
These days it's pretty simple to achieve with systemd-resolved. I've been playing with split DNS and VPNs for a while and it seems it's a solved problem on Linux, finally. The big hurdle is understanding the concept of search domain vs routing domain and the interaction with resolved and NetworkManager.
- Fnoord 4y ago
  Funny, systemd is like an opposite of wireguard in design goal. I believe the UNIX way would be /etc/hosts but some way to sync these within clients. Like etcd or whatever.
  - jeltz 4y ago
    An issue with /etc/hosts is that it is just one file and you do not want etcd to own all the config you would need to use something like NIS instead.
    - Fnoord 4y ago
      Ah yes, my bad. /etc/nsswitch.conf (which is also a Linux-ism but BSDs have something similar) supports LDAP. However, an advantage of /etc/hosts is the low latency since its not networked, while LDAP would result to overhead. Still, I believe that would be a suitable alternative. There's some non-bloated alternatives to OpenLDAP, and also an option could be caching.
afeiszli 4y ago
Yeah that’s what we used, but not all Linux supports it, and that still leaves non-Linux as well. But hosts files are universal.