search

netbirdio / netbird

Connect your devices into a secure WireGuard®-based overlay network with SSO, MFA and granular access controls.
https://netbird.io
BSD 3-Clause "New" or "Revised" License
10.61k stars 474 forks source link

FR: EDNS option support #2241

Open mrbluecoat opened 2 months ago

mrbluecoat commented 2 months ago

What are you trying to do?

Set EDNS option 65002 per machine.

Some may be interested in other EDNS options than 65002, such as dnsmasq and Cisco Umbrella: https://github.com/vttale/edns0-clientid/blob/master/README.md?plain=1#L104-L112

EDNS0 ranges per RFC6891
*  0-4 assigned, per references in the registry
*  5-65000 Available for assignment, unassigned
*  65001-65534 Local/Experimental use
*  65535 Reserved for future expansion

How should we solve this?

https://github.com/Safe-Surfer/Core/blob/main/guides/per-user-and-device-filtering.md#using-dns-tokens shows an example of including it in a dig lookup. Here's an example for CoreDNS: https://coredns.io/plugins/rewrite/#edns0-options

What is the impact of not solving this?

The current NetBird DNS nameserver options only support IPv4 and IPv6. We can use this option but then all traffic appears to come from either the exit node (if used) or a constantly changing IP address (if a roaming mobile device).

Anything else?

Supporting custom DNS over HTTPS (DoH) or DNS over TLS (DoT) would also solve this use case.