5

I am using wireguard Application to establish a VPN between my Mac running (Catalina 10.15.6) and my home. At home I run two RPi:

  • one with wireguard in docker
  • one with Pihole in docker (IP 192.168.178.120)

The wireguard configuration i am using specifies the use of the Pihole as DNS):

[Interface]
PrivateKey = [private_key]
ListenPort = [public_port]
Address = 10.13.14.3/32
DNS = 192.168.178.120

[Peer]
PublicKey = [public_key]
AllowedIPs = 192.168.178.0/24
Endpoint = [endpoint hostname]

The same configuration is in use on all my devices (iOS, Windows 10 etc) and I can always use the specified DNS to resolve all the domains.

Under OSX instead using that DNS is hit or miss:

  • I can ping correctly the IP of the DNS and any other internal IP without any packet loss
  • I can use nslookup to specify 192.168.178.120 as a server and correctly query for both external and internal names
  • Safari might be able to resolve one internal name, but after some time tries to use the router-defined DNS (192.168.1.1) thus not resolving internal names anymore (I notice this from the presence of Ads that would normally be blocked by PiHole)
  • Network utility shows the same hit/miss scenario: sometimes it is resolving internal names,sometimes it is not
  • adding the 192.168.178.120 in the network settings of the Wifi in OSX might help for a while but is not 100% reliable

So I am asking for help on what to do to diagnose the problem further. DNS resolution on Mac seems really strange to me to be honest.

Improve this question
2
  • Which DNS servers have you added to the list in Network Settings?
    – nohillside ♦
    Commented Jul 20, 2020 at 10:57
  • didn't add any DNS specifically. In the DNS section of the Wifi connection there is a greyed out text which is the one received by the router through DHCP: 192.168.1.1 If I add there the Pihole address, as I wrote, is hit or miss, sometime it resolves names other don't.
    – nick2k3
    Commented Jul 20, 2020 at 22:25

2 Answers 2

Reset to default
2

This is a known problem in WireGuard / OSX:

matchDomains=[“”] doesn’t do what the documentation says. Specifically, DNS servers are not used if allowed IPs isn’t 0.0.0.0/0.

For now, I am just manually setting DNS from a script:

sudo /usr/sbin/networksetup -setdnsservers Wi-Fi 1.1.1.1

Looks like Tunnelblick is doing scutil manipulations for openvpn (https://github.com/Tunnelblick/Tunnelblick/blob/master/tunnelblick/client.2.up.tunnelblick.sh) -- which is working on my mac

Improve this answer
0

I had the same DNS problems with WireGuard on macOS. I could ping all ip addresses (with allowed IPs: 0.0.0.0/0, ::/0) but no resolving of domain names on macOS.

Before I found the solution I noticed that macOS switched the DNS in resolv.conf to the Endpoint ip of the WireGuard server.

Solution: On macOS I created a new Network profile in System settings under Network with the exact samme DNS address as used in the Wireguard tunnel profile (thus making sure that macOS uses the exact same DNS as the WireGuard tunnel).

On the WireGuard server I setup a Local DNS Resolver using Dnsmasq ( https://www.howtoforge.com/how-to-setup-local-dns-server-using-dnsmasq-on-ubuntu-20-04/ ). I believe you could use Pihole as DNS resolver in the same way.

Yes, DNS resolving is strange, but maybe particularly strange on macOS.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .