Add Split-DNS support for Defguard clients
- Dominant language
- Rust
- Stars
- 2.8k
- Forks
- 115
- Avg merge
- 1d 4h
- Merged PRs (30d)
- 51
Description
**Is your feature request related to a problem? Please describe.**
Currently, Defguard allows specifying a DNS server for all VPN clients, but it does not support split-DNS.
For example:
- I want internal.exemple.com to be resolved via my internal DNS server (accessible only through the VPN).
- I want all other domains, such as google.com, to be resolved using the client’s regular DNS (local network or ISP).
Without split-DNS support, configuring an internal DNS in Defguard forces all queries through it, which is not desired in many setups and can cause client internet issue in some case.
**Describe the solution you'd like**
Add ability to configure DNS rules per domain or suffix for Defguard clients in Locaction configuration. For example:
- internal.exemple.com → Internal DNS (10.x.x.x)
- . (all other domains) → Keep client’s existing DNS configuration
This could be implemented by:
- Providing domain-specific DNS entries in the Defguard location settings.
**Additional context**
Split-DNS is a common requirement in corporate VPN setups and would make Defguard more flexible for mixed internal/external access scenarios. Implementing this feature would improve security and performance by ensuring that only relevant traffic is sent to the internal DNS server and make sense for clients configured with "Predefined traffic".
See you - Axel
Contributor guide
Assessment
This issue has not been assessed yet.