News for hackers. Stuff that matters.

A comment on Identity management for WireGuard networks. Parent comment

Re:Identity management for WireGuard networks by gorkish on Wednesday October 19, 2022 @02:15PM (#33265905)
FYI macOS (/etc/resolver/*) and windows (Set-DnsClientNrtpPolicy) resolvers support split dns out of the box. Suggestion for mobile is less ideal, but just tunnel to a DNS server that takes care of split resolution and use that server when wg interface is up.

Wireguard itself will always consider authentication, dns, routing, etc. out of scope which IMO is really for the best

[ Parent | on HN ]
Re:Identity management for WireGuard networks by Mister_Snuggles on Wednesday October 19, 2022 @02:48PM (#33266300)
My mental model of WireGuard is that it wants to replace IPSec (the encryption/tunneling), not IKE/IKEv2 (authentication, session setup, etc). It's not a perfect mental model, but it serves me well.

On the official client I can specify DNS servers for a particular connection, so one "easy" solution would be to specify domains that need to go to that set of DNS servers. e.g., when connected to home use 192.168.x.y to resolve *.blah, otherwise use the system resolvers.

[ Parent | on HN ]