change: bypass resolver follows the physical network's DNS #97

Merged

mysticalsoap merged 1 commit from change/bypass-follows-host-dns into trunk

2026-08-20 16:58:35 -04:00

mysticalsoap commented

2026-08-20 16:43:49 -04:00

Owner

Problem

#60: with #58 merged, the bypass dnsmasq's queries leave through the physical link — but they still go to the configured alternative servers (Quad9 by default), not whatever resolver the host would use with the VPN off. Bypassed apps got the wrong geo answers and no split-horizon unless the user pointed alt_dns at the LAN resolver by hand.

Fix

dns_manager.bypass_upstreams(interface, fallback_1, fallback_2): discovers the physical network's own DNS and returns the upstream pair, falling back to the alternative servers when nothing is discoverable. Discovery is physical_dns(): under resolved, the link's own per-link DNS (existing link_dns), then resolved's Global list; on resolv.conf systems, the /etc/resolv.conf.aqomui.bak backup the service already takes at GUI start and on every network change — before any tunnel rewrites the live file.
Both bypass-dnsmasq spawn sites use it. A bypass riding its own second tunnel keeps that tunnel's servers — its traffic exits there, not the physical link.
Refresh on network change comes free: the GUI already re-invokes bypass() per network change, which kills and respawns dnsmasq, so discovery re-runs each time.
Guards: loopback nameservers in the backup are skipped (a local stub is outside the bypass cgroup, so its upstream queries would ride the tunnel), and a backup carrying aqomui's own #modified by aqomui marker is not a source.
README: the alt-DNS bullet now describes bypass as network-first with these servers as fallback.

Verification

151 passed (141 existing + 10 new): backup parsing (nameservers, loopback skip, self-written-marker rejection, missing file), discovery precedence (link over Global, backup on resolv.conf systems), and the upstream pair packing/fallback.
Live on the real host: physical_dns("enp5s0") returns the LAN resolver from the link's resolved config; a nonexistent interface logs and falls back to the alternative servers cleanly.
The boundary from #58's description stays: apps resolving via nss-resolve/varlink never hit port 53 and keep resolved's tunnel answer — untouched here.

Closes #60

**Problem** #60: with #58 merged, the bypass dnsmasq's queries leave through the physical link — but they still go to the configured alternative servers (Quad9 by default), not whatever resolver the host would use with the VPN off. Bypassed apps got the wrong geo answers and no split-horizon unless the user pointed alt_dns at the LAN resolver by hand. **Fix** - `dns_manager.bypass_upstreams(interface, fallback_1, fallback_2)`: discovers the physical network's own DNS and returns the upstream pair, falling back to the alternative servers when nothing is discoverable. Discovery is `physical_dns()`: under resolved, the link's own per-link DNS (existing `link_dns`), then resolved's Global list; on resolv.conf systems, the `/etc/resolv.conf.aqomui.bak` backup the service already takes at GUI start and on every network change — before any tunnel rewrites the live file. - Both bypass-dnsmasq spawn sites use it. A bypass riding its own second tunnel keeps that tunnel's servers — its traffic exits there, not the physical link. - Refresh on network change comes free: the GUI already re-invokes `bypass()` per network change, which kills and respawns dnsmasq, so discovery re-runs each time. - Guards: loopback nameservers in the backup are skipped (a local stub is outside the bypass cgroup, so its upstream queries would ride the tunnel), and a backup carrying aqomui's own `#modified by aqomui` marker is not a source. - README: the alt-DNS bullet now describes bypass as network-first with these servers as fallback. **Verification** - 151 passed (141 existing + 10 new): backup parsing (nameservers, loopback skip, self-written-marker rejection, missing file), discovery precedence (link over Global, backup on resolv.conf systems), and the upstream pair packing/fallback. - Live on the real host: `physical_dns("enp5s0")` returns the LAN resolver from the link's resolved config; a nonexistent interface logs and falls back to the alternative servers cleanly. - The boundary from #58's description stays: apps resolving via nss-resolve/varlink never hit port 53 and keep resolved's tunnel answer — untouched here. Closes #60

mysticalsoap added 1 commit

2026-08-20 16:43:49 -04:00

change: bypass resolver follows the physical network's DNS

ci / test (pull_request) Successful in 29s

Details

ci / test (push) Successful in 31s

Details

54106152ef

Closes #60. With #58 the bypass dnsmasq's queries leave through the
physical link, but they still went to the configured alternative
servers - geo answers from the wrong resolver and no split-horizon for
bypassed apps unless the user pointed alt_dns at the LAN resolver by
hand.

The bypass resolver's upstreams are now discovered at spawn time: the
physical link's own per-link DNS under resolved (falling back to
resolved's Global list), or the pre-tunnel resolv.conf backup the
service already takes on every network change - so a bypassed app
resolves as if the VPN were off. The alternative servers remain the
fallback when nothing is discoverable, and a bypass that rides its own
second tunnel keeps that tunnel's servers, since its traffic exits
there. Discovery re-runs wherever dnsmasq already respawned: every
network change and every bypass rebuild.

Loopback nameservers in the backup are skipped - a local stub is not in
the bypass cgroup, so its upstream queries would ride the tunnel - and
a backup carrying aqomui's own '#modified by aqomui' marker is not a
source.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

mysticalsoap merged commit 54106152ef into trunk

2026-08-20 16:58:35 -04:00

mysticalsoap deleted branch change/bypass-follows-host-dns

2026-08-20 16:58:35 -04:00

mysticalsoap referenced this pull request from a commit

2026-08-20 17:17:16 -04:00

docs: reframe the DNS options as intents

mysticalsoap referenced this pull request

2026-08-20 17:17:28 -04:00

docs: reframe the DNS options as intents #98

mysticalsoap referenced this pull request from a commit

2026-08-20 17:24:57 -04:00