Handle multiple locations with DNS configuration connected simultaneously
- Dominant language
- Rust
- Stars
- 2.8k
- Forks
- 115
- Avg merge
- 1d 4h
- Merged PRs (30d)
- 51
Description
Defguard currently does not correctly handle DNS resolution when multiple VPN locations are active simultaneously, each with its own DNS resolver and domain configuration.
While multi-location connectivity is supported from a networking perspective, DNS behavior becomes unreliable or incorrect in this scenario.
When multiple locations are connected:
Each location may define:
- its own DNS resolver(s)
- its own domain(s)
Defguard currently configures DNS using resolvconf, writing:
```
nameserver
search
```
This approach:
- does not support routing-only domains (~domain)
- does not allow proper DNS scoping per interface
- leads to conflicting DNS routes when multiple interfaces are active
On Linux with systemd-resolved, this results in:
- multiple interfaces competing as DNS default routes
- unpredictable resolution
- queries for a given domain being sent to the wrong resolver
On Windows:
- DNS is applied differently (adapter-level suffixes)
- there is no concept equivalent to ~domain
- behavior differs but similar ambiguity may arise
TODO: Investigate a cross-platform approach to solving this issue.
Contributor guide
Assessment
This issue has not been assessed yet.