Bypass resolver should follow the physical link's DNS #60
Loading…
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
With #58 merged, bypass DNS queries leave through the physical link —
but they still go to the configured
alt_dnsservers (Quad9 bydefault), not to whatever resolver the host would use with the VPN off.
The ideal for split tunneling is that a bypassed app resolves exactly as
if the VPN weren't running: DHCP/LAN resolver, split-horizon answers,
captive portals. That means discovering the physical link's DNS at
runtime (
resolvectl dns <iface>under resolved, the saved resolv.confotherwise) and refreshing it on network change, instead of the static
alt_dnsvalues.Workaround until then: set
alt_dns1to the LAN resolver — with #58those queries already arrive over the physical link.
Boundary that stays either way: apps resolving via nss-resolve/varlink
never hit port 53 and keep getting resolved's tunnel answer (see #58's
description). Mullvad/Proton don't solve that either.