WireGuard DNS Configuration for Systemd

If you're on systemd anyway, rather than wg-quick, consider defining your wireguard networks through the more powerful systemd-networkd. It has native support and you can define routes, policies, and fwmarks etc in the same files rather than mucking around with ip-route and iptables commands.

wg-quick is really that - quickly get a simple tunnel up and running which works fine when you just want to route all IPs in a single subnet or 0.0.0.0/0 and nothing more, but anything more complex (split tunneling for example) and it quickly (!) becomes cumbersome.

Slightly OT but I personally very much prefer systemd-networkd over NetworkManager, which I find unpredictable.

https://elou.world/en/tutorial/wireguard

https://www.man7.org/linux/man-pages/man5/systemd.netdev.5.h...

An alternative solution is to use Linux namespaces to move the Wireguard into a dedicated namespace[1] and use /etc/netns/$NAMESPACE_NAME/resolv.conf for DNS configuration dedicated to that namespace[2]. AFAIK that also plays well with systemd-resolved.

[1]: https://www.wireguard.com/netns/

[2]: https://man7.org/linux/man-pages/man8/ip-netns.8.html

I've lost the whole day trying to understand the pretty complicated logic on how to have control of my linux (fedora) DNS with the many internet/connections nad wireguard's profile, and once again I went back to https://www.ctrl.blog/entry/resolvconf-tutorial.html (disable everything and just handle /etc/resolv.conf the 'old' way, and now finally I have no more leaks https://dnsleaktest.com

as for wireguard, a pretty brutal settings in all wireguard profiles:

PostUp = echo "nameserver <DNS IP in wireguard>" > /etc/resolv.conf

PostDown = echo "nameserver 127.0.0.1" > /etc/resolv.conf

and even a

dns=none

in /etc/NetworkManager/NetworkManager.conf

p.s. I am aware of the great discussion in https://news.ycombinator.com/item?id=19435631 especially usr1106 comment

The author missed the “real” solution to resolvconf missing which is to install systemd-resolvconf [1] because resolvctl actually has a full resolvconf implementation already there, you just have to call it using that name.

https://archlinux.org/packages/?name=systemd-resolvconf

Are there other references on using DNS with wireguard? Wireguard is so easy to setup but I don't feel like I've got the equivalent ease for a local DNS system. I end up putting lots of names inside cloudflare DNS which seems totally wrong. What are other people doing, no one can be running their own BIND servers, right? Is there a good complementary docker image for DNS with wireguard?

btw: the cited https://www.quad9.net is really great! (I did not know about it!)

the "Override DNS Globally" does not work for me (Fedora)