Hacker News Reader

Comment by Mister_Snuggles | Hacker News Reader

I really want to like WireGuard, and these get so close to what I want. I think as soon as Headscale gets the iOS story sorted out I'll be able to switch away from IKEv2/IPSec.

Right now the thing that's stopping me is the lack of Split-DNS. I'd even be happy if I could configure this in the official client, I've only got a handful of devices so distributing the configuration by hand is fine. My IKEv2/IPSec set up does this perfectly, and using MDM profiles lets me set up connect-on-demand. WireGuard already does connect-on-demand and my limited testing suggests that it works well enough.

I don't want to use Tailscale since I'd like to keep everything self-hosted. It sounds like Headscale is almost there - it just needs the iOS client to be able to point to an arbitrary endpoint.

View on HN

FYI macOS (/etc/resolver/*) and windows (Set-DnsClientNrtpPolicy) resolvers support split dns out of the box. Suggestion for mobile is less ideal, but just tunnel to a DNS server that takes care of split resolution and use that server when wg interface is up.

Wireguard itself will always consider authentication, dns, routing, etc. out of scope which IMO is really for the best

My mental model of WireGuard is that it wants to replace IPSec (the encryption/tunneling), not IKE/IKEv2 (authentication, session setup, etc). It's not a perfect mental model, but it serves me well.

On the official client I can specify DNS servers for a particular connection, so one "easy" solution would be to specify domains that need to go to that set of DNS servers. e.g., when connected to home use 192.168.x.y to resolve *.blah, otherwise use the system resolvers.

Split DNS is super complicated to implement client side. We halfway implemented a solution and backtracked, eventually settling on just setting /etc/hosts. There's way too many variables involved across all the different operating systems.

These days it's pretty simple to achieve with systemd-resolved. I've been playing with split DNS and VPNs for a while and it seems it's a solved problem on Linux, finally.

The big hurdle is understanding the concept of search domain vs routing domain and the interaction with resolved and NetworkManager.

Funny, systemd is like an opposite of wireguard in design goal. I believe the UNIX way would be /etc/hosts but some way to sync these within clients. Like etcd or whatever.

An issue with /etc/hosts is that it is just one file and you do not want etcd to own all the config you would need to use something like NIS instead.

Ah yes, my bad. /etc/nsswitch.conf (which is also a Linux-ism but BSDs have something similar) supports LDAP. However, an advantage of /etc/hosts is the low latency since its not networked, while LDAP would result to overhead. Still, I believe that would be a suitable alternative. There's some non-bloated alternatives to OpenLDAP, and also an option could be caching.

Yeah that’s what we used, but not all Linux supports it, and that still leaves non-Linux as well. But hosts files are universal.

This is feasible to config in WireGuard, but it’s somewhat up to the host to leverage it appropriately, and the config is certainly not clear about that fact. If you append the DNS config of a peer with the search domains you want sent over the private horizon (eg: 192.168.1.10, 192.168.1.11, internal.domain, other.domain) this is intended to configure conditional forwarding for those zones you specify. Again, it’s dependent on the peer host OS to be able to do that, but that’s how I do it with my client access VPN.

That's the biggest challenge - it's not really a WireGuard problem, but "something" needs to be able to tell iOS "use server X for *.blah, otherwise use whatever servers you got from the WiFi connection".

You can use openresolv to configure a local DNS server to do split DNS, or let do systemd-resolved do it. Or did you mean Android/iOS with 'official client'?

In my case I mean the iOS official client.

Reply on news.ycombinator.com