amnezia-vpn / amnezia-client

Amnezia VPN Client (Desktop+Mobile)
https://amnezia.org
GNU General Public License v3.0
4.47k stars 291 forks source link

DNS is weird #1052

Closed qumuq-til closed 1 week ago

qumuq-til commented 3 weeks ago

Can somebody explain what's exactly going on with Amnezia client's DNS?

For starters, I have this reference Ubuntu 24 desktop that's set to acquire its DNS address via DHCP and it's 192.168.1.1, because it's a LAN-based resolver/forwarder. That forwarder is configured to use NextDNS service which has its own DNS servers but in a format that's impossible to input into Amnezia. Here's how it looks like: 45.90.28.0#3312ax.dns.nextdns.io

If I set Amnezia client to use AmneziaDNS (already installed on the VPS) then resolvectl reports that DNS IP changes to 172.29.172.254. Where's that address coming from? Certainly Amnezia's internal IP is in a different subnet. I could in theory log into the server, dig up how exactly AmneziaDNS is managed and tweak it to forward requests to a DNS server of my choosing, but there's absolutely no documentation on that, AmneziaDNS is broken for me, and it's probably not the best solution in general. Same thing happens on macOS, but there's no 172.29.172.254 in this case, it just sticks to the internal LAN address.

In Ubuntu a working solution is to amend /etc/systemd/resolved.conf according to NextDNS instructions which supplies a "Global" setting independent of the interface and having a top priority.

So to recap, the main question I need an answer to is how to properly use a service like NextDNS with AmneziaVPN. And second, why AmneziaDNS isn't being used or isn't working.

PS. Looking at AmneziaDNS logs during installation one line attracts particular attention: 2024-09-06 19:58:10 debug Warning: script missing ":/server_scripts/dns/start.sh"

Nethius commented 1 week ago

172.29.172.254 its local IP of AmneziaDNS container https://github.com/amnezia-vpn/amnezia-client/blob/dev/client/server_scripts/dns/run_container.sh#L6

qumuq-til commented 1 week ago

So what is the way to check that AmneziaDNS is actually being used for resolving and that it's not falling back to whatever secondary resolver configured in the system? Is there a command to test it?