DNS resolution not working - local DNS being used rather then VPN

[vithusel]

I have a DNS server within my WireGuard network. For some reason machines are defaulting to their local DNS. Manually setting the remote DNS under network device properties resolves the issue however this isn't ideal as it exists even when not using the VPN.

Just to add a bit more info. This is on machines that don't have local admin privileges. Not sure if that makes a difference.

[brendanosborne]

Can you post up your TunnlTo config with keys and endpoints removed.

Is it working correctly on machines that do have local admin privileges?

[vithusel]

[Interface]
PrivateKey =
Address = 14.8.0.8/24
DNS = 14.8.0.2

[Peer]
PublicKey =
PresharedKey =
AllowedIPs = 0.0.0.0/0, ::/0
PersistentKeepalive = 0
Endpoint =

This is my config that i imported.

I've not yet tested on a machine with Admin permissions. Ill do that tomorrow when i have users available and report back.

[vithusel]

My DNS server has some static entries that exist on it. (ex resolving test.hkjsdhgjkhsdg.fdsfjhkdshf to 14.8.0.2 which works when i manually set the DNS)

I ping the addresses and see what they resolve to. I've also done ipconfig /flushdns with no change.

On my DNS server i can view DNS queries and the system in question never makes any attempt at querying the server.

I can also confirm the tunnel itself is working as accessing external sites goes via the VPN and what is my IP showed the endpoint IP. I can also access resources on the VPN via IP.

[brendanosborne]

(deleted another reply as it had incorrect info)

I'll see if @wiresock can provide some input.

[wiresock]

Try to execute the Wiresock CLI using the command '-log-level all' and perform several DNS queries. Since DNS traffic is processed independently, its activity will be displayed in the console log.

[vithusel]

I figured out the issue!

So what i had not realised is my actual config has disallowed IP's which effectively stops any traffic on my local network from being pushed through the VPN. This is useful for users where they have newer HP printers which don't allow a static IP and require their special "HP" app to print.

Having run the config thats stored in AppData\Local\TunnlTo via wiresock with log level set to all i can see this -
Skipping ignored IP: PROTOCOL 17 : 11.0.1.76 -> 11.0.0.13

Because my local DNS is within the disallowed IP range it doesn't forward DNS requests to the one on the VPN.
In my config i have this DisallowedIPs = 11.0.0.0/23 and my local DNS server is 11.0.0.13.

Is there a better way to configure this so traffic on my local IP range never goes through the VPN but at the same time DNS rules are honored?

[wiresock]

Thank you for sharing the findings from your investigation. Based on the information, it seems prudent to modify the behavior such that if DNS settings are included in the configuration, then the DisallowedIps setting will not apply to DNS packets. Should time permit this weekend, I plan to prepare an update for the WireSock VPN Client.

[wiresock]

I have addressed this issue in WireSock VPN Client v1.2.37, could you please give it a try?

[vithusel]

I've just run a test. works perfectly now. Thank you for the quick turnaround!

[vithusel]

@brendanosborne can we potentially get a update to TunnelTo so the recent wiresock fixes can be included?

[brendanosborne]

👍 I'm working on it this morning. Looking to push a new release this afternoon with some other improvements.

[brendanosborne]

@vithusel 1.0.3 includes support for 1.2.37.1 which resolve the DNS issue: https://github.com/TunnlTo/desktop-app/releases/tag/v1.0.3

Thanks for following up with the diagnosis so we could get this sorted out.