Double-tunnel mode: both tunnels claim the ~. routing domain #59

New issue

Open

opened 2026-08-19 12:20:04 -04:00 by mysticalsoap · 0 comments

mysticalsoap commented

2026-08-19 12:20:04 -04:00

Owner

Both set_dns call sites for tunnels hand the link the ~. routing
domain (dns_manager.py applies it to any tun it is given). With the
experimental second-VPN bypass mode active, the main tunnel and
tun_bypass both claim ~. — and resolved distributes queries across
all links carrying the same routing domain, so system-wide DNS
round-robins between the two tunnels.

The ~. fix predates thinking about the double-tunnel path. Probably:
only the main tunnel should get ~.; the bypass tunnel's resolver is
reached through the port-53 redirect, not through resolved's routing.

Low urgency: the double-tunnel mode is inherited-experimental and has
never been exercised here.

Both `set_dns` call sites for tunnels hand the link the `~.` routing domain (dns_manager.py applies it to any tun it is given). With the experimental second-VPN bypass mode active, the main tunnel *and* `tun_bypass` both claim `~.` — and resolved distributes queries across all links carrying the same routing domain, so system-wide DNS round-robins between the two tunnels. The `~.` fix predates thinking about the double-tunnel path. Probably: only the main tunnel should get `~.`; the bypass tunnel's resolver is reached through the port-53 redirect, not through resolved's routing. Low urgency: the double-tunnel mode is inherited-experimental and has never been exercised here.

mysticalsoap referenced this issue

2026-08-19 13:25:38 -04:00

Decide whether aqomui should manage split-horizon DNS exemptions #34

mysticalsoap referenced this issue

2026-08-20 15:11:26 -04:00

Decide whether aqomui should manage split-horizon DNS exemptions #34