6

I want to achieve 'split DNS' using Wireguard on Windows, where DNS requests for specific domains are resolved by specific DNS servers reachable through the Wireguard tunnel, and other DNS requests get resolved by the normal DNS server.

How do I do this on Windows? On Linux I would use custom invocations to resolvconf instead of using the DNS= option for wg-quick (see wg-quick(8)).

1 Answer 1

8

You can use Windows' NRPT (Network Policy Response Table) to route domain names in specific zones to specific DNS servers. The NRPT has loads of other features we'll for this use case.

We will use the Procedure: Configure the NRPT using Powershell for this, making use of some light Powershell scripting and the Add-DnsClientNrptRule, Get-DnsClientNrptRule and Remove-DnsClientNrptRule cmdlets, documented in Powershell dnsclient reference.


So let's configure the NRPT for a tunnel named example-tunnel (the tunnel name doesn't really matter), where we want to route all DNS names under example.com to a DNS server listening at 172.16.2.53:

[Interface]
PrivateKey = KGtxx2By12kE/Ru0qkhM/41H0Lu2JzvCSB8dM61MIX0=
Address = 172.16.1.2/32
PostUp = powershell.exe -Command "& { Add-DnsClientNrptRule -Comment 'wg-example-tunnel' -Namespace '.example.com' -NameServers 172.16.2.53 }"
PostDown = powershell.exe -Command "& { Get-DnsClientNrptRule | where Comment -eq 'wg-example-tunnel' | foreach { Remove-DnsClientNrptRule -Name $_.Name -Force } }"

[Peer]
PublicKey = +ZDFdUwa6NZwI8YVQewnl1bBi1D2qKor8/JPLwj6m0=
Endpoint = 203.0.113.234:51820
AllowedIPs = 172.16.1.0/24, 172.16.2.0/24

After enabling the tunnel, there should be an NRPT rule, that should look like this:

PS C:\Users\joost> Get-DnsClientNrptRule | fl -Property Name,Namespace,NameServers,Comment


Name        : {6105290F-37C2-439C-A25E-F62A8DCE22AC}
Namespace   : {.example.com}
NameServers : 172.16.2.53
Comment     : wg-example-tunnel

So this is the PostUp= command:

Add-DnsClientNrptRule -Comment 'wg-example-tunnel' -Namespace '.example.com' -NameServers 172.16.2.53

It sets up the routing rule with an administrative comment that allows us to find and remove it later.


And this is the PostDown= command:

Get-DnsClientNrptRule `
    | where Comment -eq 'wg-example-tunnel' `
    | foreach { Remove-DnsClientNrptRule -Name $_.Name -Force }

This is a pipeline that enumerates all NRPT rules, filters them down to those that match the administrative comment in the PostUp= command, and removes them.


If Wireguard is blocking script execution, create a registry key to enable Dangerous script execution.

if (-not (Test-Path -Path HKLM:\SOFTWARE\Wireguard)) {
    New-Item -Path HKLM:\SOFTWARE\Wireguard -ItemType Directory -ErrorAction Stop
}
Set-ItemProperty -Path HKLM:\SOFTWARE\Wireguard -Name DangerousScriptExecution -Type DWord -Value 1
Get-ItemProperty -Path HKLM:\SOFTWARE\Wireguard

Do read the security warning at Wireguard-Windows' admin-registry.md documentation before enabling this!

4
  • What's the reason for removing the NRPT rule afterwards?
    – kapsiR
    Commented Dec 1, 2023 at 9:20
  • In the PostDown command you mean? That is executed when the tunnel is shut down. Presumably, you won't be able to reach the configured DNS server if the tunnel is not running, so you would want to resolve the names in the namespace through the regular DNS server.
    – j0057
    Commented Dec 2, 2023 at 12:13
  • Yes. Ok, I understand. So you are assuming that the specific suffix is also reachable without the VPN connection. Without this assumption you wouldn't it remove it, right?
    – kapsiR
    Commented Dec 4, 2023 at 7:42
  • 2
    Not sure about that; if an authoritative DNS server for the suffix isn't reachable without the VPN, a fast NXDOMAIN response over the public internet might be better than slow SERVFAIL response due to a DNS request timing out. It might be a security leak to send a name to a public DNS; this seems a dangerous way to live though. You could also have a split-horizon DNS setup where a domain has different records depending on from where the request is coming, outside or inside the network. So I guess yes, there are some assumptions to be made depending on how network and DNS are laid out.
    – j0057
    Commented Dec 5, 2023 at 8:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .