I am using wireguard Application to establish a VPN between my Mac running (Catalina 10.15.6) and my home. At home I run two RPi:

  • one with wireguard in docker
  • one with Pihole in docker (IP

The wireguard configuration i am using specifies the use of the Pihole as DNS):

PrivateKey = [private_key]
ListenPort = [public_port]
Address =

PublicKey = [public_key]
AllowedIPs =
Endpoint = [endpoint hostname]

The same configuration is in use on all my devices (iOS, Windows 10 etc) and I can always use the specified DNS to resolve all the domains.

Under OSX instead using that DNS is hit or miss:

  • I can ping correctly the IP of the DNS and any other internal IP without any packet loss
  • I can use nslookup to specify as a server and correctly query for both external and internal names
  • Safari might be able to resolve one internal name, but after some time tries to use the router-defined DNS ( thus not resolving internal names anymore (I notice this from the presence of Ads that would normally be blocked by PiHole)
  • Network utility shows the same hit/miss scenario: sometimes it is resolving internal names,sometimes it is not
  • adding the in the network settings of the Wifi in OSX might help for a while but is not 100% reliable

So I am asking for help on what to do to diagnose the problem further. DNS resolution on Mac seems really strange to me to be honest.

  • Which DNS servers have you added to the list in Network Settings? – nohillside Jul 20 '20 at 10:57
  • didn't add any DNS specifically. In the DNS section of the Wifi connection there is a greyed out text which is the one received by the router through DHCP: If I add there the Pihole address, as I wrote, is hit or miss, sometime it resolves names other don't. – nick2k3 Jul 20 '20 at 22:25

This is a known problem in WireGuard / OSX:

matchDomains=[“”] doesn’t do what the documentation says. Specifically, DNS servers are not used if allowed IPs isn’t

For now, I am just manually setting DNS from a script:

sudo /usr/sbin/networksetup -setdnsservers Wi-Fi

Looks like Tunnelblick is doing scutil manipulations for openvpn (https://github.com/Tunnelblick/Tunnelblick/blob/master/tunnelblick/client.2.up.tunnelblick.sh) -- which is working on my mac

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .