How can I fix resolving domain names with wireguard?

Question

I've installed Wireguard and I successfully connect to my VPN network but I can't resolve domain names using DNS of the VPN network. I can ping internal nodes and I can get IP address that is bound to the domain by nslookup but ping, curl etc can't do this.

I use openvpn also so resolving of domain names works using openvpn connection works fine.

How can I fix resolving domain names with wireguard?

OS: Ubuntu 18.10

Answer 1

From the CONFIGURATION section of wg-quick man page, worded in a not so obvious way:

   •      DNS — a comma-separated list of IP (v4 or v6) addresses to be set as the interface's DNS servers, or non-IP hostnames to be set as  the  in‐
          terface's  DNS  search domains. May be specified multiple times. Upon bringing the interface up, this runs `resolvconf -a tun.INTERFACE -m 0
          -x` and upon bringing it down, this runs `resolvconf -d tun.INTERFACE`. If these particular invocations of  resolvconf(8)  are  undesirable,
          the PostUp and PostDown keys below may be used instead.

Which states that you can include a search domain in the [Interface] section of your /etc/wireguard/wg.conf file, along with your DNS server entry:

[Interface]
DNS = 10.10.10.1, localdomain

Change the IP 10.10.10.1 to the DNS server IP in your remote wg network, update the localdomain to reflect the domain name used in the remote wg network.

eg. if you have a [Peer] section that contains, for example, RFC1918 addresses:

[Peer]
AllowedIPs = 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16

Then a query for myserver will be send to 10.10.10.1 as myserver.localdomain (your remote DNS server will obviously needs to be able to resolve that host)

If you have multiple domains that can be resolved by the remote DNS server, then they can also be apended to the DNS = entry above, each entry separated by a comma.

All this is handled outside of your regular host /etc/resolv.conf and uses resolvconf behind the scenes to add additional DNS details that are added/removed dynamically upon a wg interface going up/down.

Caveat: I don't know (haven't tested) what presedence is used when sending queries, so you may be sending queries to multiple wg remote DNS servers, if you have more than one active, and thus you could be leaking host details to that remote DNS server that may be undesirable.

HTH