DefGuard / DefGuard/defguard

Add Split-DNS support for Defguard clients

Open
#1,423 2 comments 13 reactions 0 assignees View on GitHub
feature t3
Dominant language
Rust
Stars
2.8k
Forks
115
Avg merge
1d 4h
Merged PRs (30d)
51

Description

**Is your feature request related to a problem? Please describe.**
Currently, Defguard allows specifying a DNS server for all VPN clients, but it does not support split-DNS.
For example:
- I want internal.exemple.com to be resolved via my internal DNS server (accessible only through the VPN).
- I want all other domains, such as google.com, to be resolved using the client’s regular DNS (local network or ISP).

Without split-DNS support, configuring an internal DNS in Defguard forces all queries through it, which is not desired in many setups and can cause client internet issue in some case.

**Describe the solution you'd like**
Add ability to configure DNS rules per domain or suffix for Defguard clients in Locaction configuration. For example:
- internal.exemple.com → Internal DNS (10.x.x.x)
- . (all other domains) → Keep client’s existing DNS configuration

This could be implemented by:
- Providing domain-specific DNS entries in the Defguard location settings.

**Additional context**
Split-DNS is a common requirement in corporate VPN setups and would make Defguard more flexible for mixed internal/external access scenarios. Implementing this feature would improve security and performance by ensuring that only relevant traffic is sent to the internal DNS server and make sense for clients configured with "Predefined traffic".

See you - Axel

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.