amnezia-vpn/amnezia-client

Fork 0

mirror of https://github.com/amnezia-vpn/amnezia-client.git synced 2026-10-15 05:42:07 +00:00

[PR #3144] feat: preserve system DNS for desktop WireGuard connections #3098

New issue

Open

opened 2026-10-14 21:07:29 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-14 21:07:29 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/amnezia-vpn/amnezia-client/pull/3144
Author: @DenisKoleda
Created: 9/7/2026
Status: 🔄 Open

Base: dev ← Head: feat/preserve-system-dns

📝 Commits (1)

ec997de feat: preserve system DNS for desktop WireGuard connections

📊 Changes

27 files changed (+661 additions, -6 deletions)

View changed files

📝 client/core/controllers/connectionController.cpp (+8 -0)
📝 client/core/controllers/coreSignalHandlers.cpp (+1 -0)
📝 client/core/controllers/settingsController.cpp (+19 -0)
📝 client/core/controllers/settingsController.h (+4 -0)
📝 client/core/repositories/secureAppSettingsRepository.cpp (+15 -0)
📝 client/core/repositories/secureAppSettingsRepository.h (+4 -1)
📝 client/core/utils/constants/configKeys.h (+1 -0)
📝 client/daemon/daemon.cpp (+67 -2)
📝 client/daemon/dnsutils.h (+4 -0)
📝 client/daemon/interfaceconfig.cpp (+2 -1)
📝 client/daemon/interfaceconfig.h (+3 -0)
📝 client/mozilla/localsocketcontroller.cpp (+1 -0)
📝 client/platforms/macos/daemon/dnsutilsmacos.cpp (+62 -0)
📝 client/platforms/macos/daemon/dnsutilsmacos.h (+1 -0)
📝 client/platforms/macos/daemon/wireguardutilsmacos.cpp (+4 -1)
📝 client/platforms/windows/daemon/dnsutilswindows.cpp (+53 -0)
📝 client/platforms/windows/daemon/dnsutilswindows.h (+1 -0)
📝 client/translations/amneziavpn_ru_RU.ts (+8 -0)
📝 client/ui/controllers/serversUiController.cpp (+17 -0)
📝 client/ui/controllers/settingsUiController.cpp (+16 -0)

...and 7 more files

📄 Description

Enabling a VPN currently replaces the operating system's DNS configuration. This adds an opt-in Use system DNS mode for desktop AmneziaWG/WireGuard connections on Windows and macOS. The default behavior stays the same.

The daemon discovers the current adapter/network-service DNS addresses at activation, skips resolver replacement, and adds those addresses to the existing DNS firewall allowlist. DNS route exclusions are separate from general traffic exclusions, so they do not grant access to other ports on a DNS server. Reconnection rereads the addresses after teardown; mode changes and activation failures clean up the DNS routes.

The change also forwards allowedDnsServers to the macOS WireGuard firewall path and validates/canonicalizes those IPC addresses before they reach platform firewall commands. The settings page warns that DNS may leave the VPN even with Kill Switch enabled, includes a Russian translation, and updates the server description when the mode changes. Saved application/imported DNS values are retained for the normal mode.

Related to #1972.

Validation

Windows Release builds of both the client and service succeeded with Qt 6.10.3 / MSVC 19.44.
The standalone QtTest suite reported 19 passed, 0 failed, 0 skipped, including initialization/cleanup and a read-only native Windows DNS discovery check. CTest passed 1/1 suite. The daemon/parser/serializer are production sources; network and firewall operations use fake backends.
A manual Windows test used the matching patched client and service; the tester confirmed the VPN/DNS scenario works. Detailed per-scenario packet captures and negative Kill Switch checks were not independently recorded.
Changed QML parsed successfully, the Russian translation compiled, and git diff --check passed.
macOS has not been built or run locally. Its native implementation needs platform validation.

Scope and remaining validation

The mode is disabled by default and is limited to the desktop WireGuard daemon. Other protocols reject connection preparation while it is enabled. Mobile platforms and macOS Network Extension do not expose it. Testing requires matching patched client and service versions.

The readers enumerate adapter/network-service DNS servers. Corporate NRPT rules, macOS /etc/resolver, nonstandard DNS ports, local DoH/DoT proxies, and complex routing across multiple uplinks need separate work. macOS uses the existing default-route exclusion mechanism for remote DNS. The unit tests do not establish reachability or Kill Switch behavior for those cases.

Reproducible test commands and the remaining integration matrix are in tests/systemdns/README.md.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/amnezia-vpn/amnezia-client/pull/3144 **Author:** [@DenisKoleda](https://github.com/DenisKoleda) **Created:** 9/7/2026 **Status:** 🔄 Open **Base:** `dev` ← **Head:** `feat/preserve-system-dns` --- ### 📝 Commits (1) - [`ec997de`](https://github.com/amnezia-vpn/amnezia-client/commit/ec997def91e0a0bfae8a20c496a3672cb34eacda) feat: preserve system DNS for desktop WireGuard connections ### 📊 Changes **27 files changed** (+661 additions, -6 deletions) <details> <summary>View changed files</summary> 📝 `client/core/controllers/connectionController.cpp` (+8 -0) 📝 `client/core/controllers/coreSignalHandlers.cpp` (+1 -0) 📝 `client/core/controllers/settingsController.cpp` (+19 -0) 📝 `client/core/controllers/settingsController.h` (+4 -0) 📝 `client/core/repositories/secureAppSettingsRepository.cpp` (+15 -0) 📝 `client/core/repositories/secureAppSettingsRepository.h` (+4 -1) 📝 `client/core/utils/constants/configKeys.h` (+1 -0) 📝 `client/daemon/daemon.cpp` (+67 -2) 📝 `client/daemon/dnsutils.h` (+4 -0) 📝 `client/daemon/interfaceconfig.cpp` (+2 -1) 📝 `client/daemon/interfaceconfig.h` (+3 -0) 📝 `client/mozilla/localsocketcontroller.cpp` (+1 -0) 📝 `client/platforms/macos/daemon/dnsutilsmacos.cpp` (+62 -0) 📝 `client/platforms/macos/daemon/dnsutilsmacos.h` (+1 -0) 📝 `client/platforms/macos/daemon/wireguardutilsmacos.cpp` (+4 -1) 📝 `client/platforms/windows/daemon/dnsutilswindows.cpp` (+53 -0) 📝 `client/platforms/windows/daemon/dnsutilswindows.h` (+1 -0) 📝 `client/translations/amneziavpn_ru_RU.ts` (+8 -0) 📝 `client/ui/controllers/serversUiController.cpp` (+17 -0) 📝 `client/ui/controllers/settingsUiController.cpp` (+16 -0) _...and 7 more files_ </details> ### 📄 Description Enabling a VPN currently replaces the operating system's DNS configuration. This adds an opt-in **Use system DNS** mode for desktop AmneziaWG/WireGuard connections on Windows and macOS. The default behavior stays the same. The daemon discovers the current adapter/network-service DNS addresses at activation, skips resolver replacement, and adds those addresses to the existing DNS firewall allowlist. DNS route exclusions are separate from general traffic exclusions, so they do not grant access to other ports on a DNS server. Reconnection rereads the addresses after teardown; mode changes and activation failures clean up the DNS routes. The change also forwards `allowedDnsServers` to the macOS WireGuard firewall path and validates/canonicalizes those IPC addresses before they reach platform firewall commands. The settings page warns that DNS may leave the VPN even with Kill Switch enabled, includes a Russian translation, and updates the server description when the mode changes. Saved application/imported DNS values are retained for the normal mode. Related to #1972. ### Validation - Windows Release builds of both the client and service succeeded with Qt 6.10.3 / MSVC 19.44. - The standalone QtTest suite reported **19 passed, 0 failed, 0 skipped**, including initialization/cleanup and a read-only native Windows DNS discovery check. CTest passed 1/1 suite. The daemon/parser/serializer are production sources; network and firewall operations use fake backends. - A manual Windows test used the matching patched client and service; the tester confirmed the VPN/DNS scenario works. Detailed per-scenario packet captures and negative Kill Switch checks were not independently recorded. - Changed QML parsed successfully, the Russian translation compiled, and `git diff --check` passed. - **macOS has not been built or run locally.** Its native implementation needs platform validation. ### Scope and remaining validation The mode is disabled by default and is limited to the desktop WireGuard daemon. Other protocols reject connection preparation while it is enabled. Mobile platforms and macOS Network Extension do not expose it. Testing requires matching patched client and service versions. The readers enumerate adapter/network-service DNS servers. Corporate NRPT rules, macOS `/etc/resolver`, nonstandard DNS ports, local DoH/DoT proxies, and complex routing across multiple uplinks need separate work. macOS uses the existing default-route exclusion mechanism for remote DNS. The unit tests do not establish reachability or Kill Switch behavior for those cases. Reproducible test commands and the remaining integration matrix are in `tests/systemdns/README.md`. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi added the

pull-request

label

2026-10-14 21:07:29 +00:00

No labels

pull-request

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

amnezia-vpn/amnezia-client#3098

No description provided.

Rows
Columns