You can use Windows' NRPT (Network Policy Response Table) to route domain names in specific zones to specific DNS servers. The NRPT has loads of other features we'll for this use case.
We will use the Procedure: Configure the NRPT using Powershell for this, making use of some light Powershell scripting and the Add-DnsClientNrptRule
, Get-DnsClientNrptRule
and Remove-DnsClientNrptRule
cmdlets, documented in Powershell dnsclient reference.
So let's configure the NRPT for a tunnel named example-tunnel
(the tunnel name doesn't really matter), where we want to route all DNS names under example.com
to a DNS server listening at 172.16.2.53
:
[Interface]
PrivateKey = KGtxx2By12kE/Ru0qkhM/41H0Lu2JzvCSB8dM61MIX0=
Address = 172.16.1.2/32
PostUp = powershell.exe -Command "& { Add-DnsClientNrptRule -Comment 'wg-example-tunnel' -Namespace '.example.com' -NameServers 172.16.2.53 }"
PostDown = powershell.exe -Command "& { Get-DnsClientNrptRule | where Comment -eq 'wg-example-tunnel' | foreach { Remove-DnsClientNrptRule -Name $_.Name -Force } }"
[Peer]
PublicKey = +ZDFdUwa6NZwI8YVQewnl1bBi1D2qKor8/JPLwj6m0=
Endpoint = 203.0.113.234:51820
AllowedIPs = 172.16.1.0/24, 172.16.2.0/24
After enabling the tunnel, there should be an NRPT rule, that should look like this:
PS C:\Users\joost> Get-DnsClientNrptRule | fl -Property Name,Namespace,NameServers,Comment
Name : {6105290F-37C2-439C-A25E-F62A8DCE22AC}
Namespace : {.example.com}
NameServers : 172.16.2.53
Comment : wg-example-tunnel
So this is the PostUp=
command:
Add-DnsClientNrptRule -Comment 'wg-example-tunnel' -Namespace '.example.com' -NameServers 172.16.2.53
It sets up the routing rule with an administrative comment that allows us to find and remove it later.
And this is the PostDown=
command:
Get-DnsClientNrptRule `
| where Comment -eq 'wg-example-tunnel' `
| foreach { Remove-DnsClientNrptRule -Name $_.Name -Force }
This is a pipeline that enumerates all NRPT rules, filters them down to those that match the administrative comment in the PostUp=
command, and removes them.
If Wireguard is blocking script execution, create a registry key to enable Dangerous script execution.
if (-not (Test-Path -Path HKLM:\SOFTWARE\Wireguard)) {
New-Item -Path HKLM:\SOFTWARE\Wireguard -ItemType Directory -ErrorAction Stop
}
Set-ItemProperty -Path HKLM:\SOFTWARE\Wireguard -Name DangerousScriptExecution -Type DWord -Value 1
Get-ItemProperty -Path HKLM:\SOFTWARE\Wireguard
Do read the security warning at Wireguard-Windows' admin-registry.md documentation before enabling this!