WG Tunnel only works with global/public dns servers

jd603

Coming from AOSP - I normally configure my own DNS servers in WG tunnel so all dns traffic goes through the tunnel to my DNS servers. I used termux to check if the name servers were reachable and can look up names when connected to the tunnel and it worked fine. Unfortunately when using apps in grapheneos - it cannot look up any DNS names. If I enable DNS Settings -> Global DNS Servers in WG Tunnel it then works while connected to the tunnel but all requests are going to public DNS servers, ie leaking DNS.

Does anyone know why this might be happening or how I may be able to fix?

Thanks!

Probably9857

jd603

This is just a shot in the dark, but what is Network & internet > Private DNS set to?

GrapheneOS recommends Off when using a VPN, otherwise there can be leaks. But I have not heard of it actually blocking DNS.

r134a

jd603 What vpn providor are u using? Some do dns hijacking unless u specifically configure it not to (if providor allows it).

jd603

It's disabled. That's not it. It's odd. DNS servers are set by the wifi/ISP but you can also set name servers in Wireguard and it will use those when connected. This seems to work at the shell/OS level, in termux but when using apps in GrapheneOS all DNS requests are being blocked in all apps when I try to use wireguard DNS servers. Really odd. What is grapheneOS doing that would cause this?

jd603

r134a This is my own wireguard VPN set up on my own network entirely, my own servers and networks. Also - the dns problem is occurring when moving from wifi to mobile networks with wireguard tunnel active, even when using "public dns servers" option in WG tunnel. What did ytou guys change with dns resolution in grapheneos?

I will try IPsec/strongswan next and see if I run into the same problems.

jd603

It looks like Strongswan VPN client / IPsec is working after disabling WG tunnel and rebooting. Roaming between networks also works fine. so this appears to be an issue with WG Tunnel / Wireguard only so far.

jd603

Just wanted to update for anyone that searches for help with this - the official Wireguard android app seems to work just fine. The issue seems to be a compatibility issue with the WG Tunnel app and GrapheneOS.