DefGuard / DefGuard/defguard

Handle multiple locations with DNS configuration connected simultaneously

Open
#2,772 2 comments 0 reactions 2 assignees Claimed by @wojcik91 View on GitHub
feature t3
Dominant language
Rust
Stars
2.8k
Forks
115
Avg merge
1d 4h
Merged PRs (30d)
51

Description

Defguard currently does not correctly handle DNS resolution when multiple VPN locations are active simultaneously, each with its own DNS resolver and domain configuration.

While multi-location connectivity is supported from a networking perspective, DNS behavior becomes unreliable or incorrect in this scenario.

When multiple locations are connected:

Each location may define:

- its own DNS resolver(s)
- its own domain(s)

Defguard currently configures DNS using resolvconf, writing:

```
nameserver
search
```

This approach:

- does not support routing-only domains (~domain)
- does not allow proper DNS scoping per interface
- leads to conflicting DNS routes when multiple interfaces are active

On Linux with systemd-resolved, this results in:

- multiple interfaces competing as DNS default routes
- unpredictable resolution
- queries for a given domain being sent to the wrong resolver

On Windows:

- DNS is applied differently (adapter-level suffixes)
- there is no concept equivalent to ~domain
- behavior differs but similar ambiguity may arise

TODO: Investigate a cross-platform approach to solving this issue.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.