search

tasket / Qubes-vpn-support

VPN configuration in Qubes OS
GNU General Public License v3.0
126 stars 28 forks source link

Wireguard section: extract DNS from wg config #27

Closed conorsch closed 5 years ago

conorsch commented 5 years ago

The docs here are great: https://github.com/tasket/Qubes-vpn-support/wiki/Wireguard-VPN-connections-in-Qubes-OS The example includes reference to a Mullvad DNS server, then gives examples on how to permit resolution via the DNAT chain.

Since the DNS servers are likely to be specified in the wg0.conf file, how about we update that script to parse them out? A simple '.' check for IPv4 and ':' check for IPv6 will make sure the proper iptables calls are made.

Happy to submit a docs PR, just wanted to mention first. Thanks for your hard work, @tasket, the guides are invaluable!

tasket commented 5 years ago

Since a working wg example config has been added to qubes-vpn-handler.service there's really no need follow the steps in the old wiki entry. In '10_wg.conf.example' you'll see it takes advantage of wg-quick's function override point to add a new set_dns() function which takes care of the DNS parsing (it exports the address as vpn_dns variable and calls the qubes-vpn-ns script).

So if you install Qubes-vpn-support and rename '10_wg.conf.example' to '10_wg.conf' (this is in /lib/systemd/system/qubes-vpn-handler.service.d) you should have DNS covered.