Local DNS resolution doeesn&#39;t work on macOS with MagicDNS enabled #284

@mlincett commented on GitHub (Sep 15, 2022):

Your network must have at least one DNS nameserver enabled in the admin console. These nameservers will receive all DNS queries not handled by MagicDNS. This restriction will be relaxed in the future.

I think it's basically says that to use magic DNS, you need override local DNS.

This is incorrect, at least when using resolved.

MagicDNS sets in-addr.arpa records for all the IP address space used by tailscale.

Override local DNS enabled sets +DefaultRoute for the tailscale interface (meaning this should be the default DNS unless a more specific is found) and the global DNS domain ~.

The two settings are independent - however I have no idea how this works in systems pre-resolved.

@mlincett commented on GitHub (Sep 15, 2022): > > Your network must have [at least one DNS nameserver](https://tailscale.com/kb/1054/dns/#using-dns-settings-in-the-admin-console) enabled in the [admin console](https://login.tailscale.com/admin/dns). These nameservers will receive all DNS queries not handled by MagicDNS. This restriction will be relaxed in the future. > > I think it's basically says that to use magic DNS, you need override local DNS. This is incorrect, at least when using `resolved`. MagicDNS sets `in-addr.arpa` records for all the IP address space used by tailscale. Override local DNS enabled sets `+DefaultRoute` for the tailscale interface (meaning this should be the default DNS unless a more specific is found) and the global DNS domain `~.` The two settings are independent - however I have no idea how this works in systems pre-resolved.

adam commented

@kradalby commented on GitHub (Oct 31, 2022):

@mlincett @huskyii @felixscheinost

I think I have added support for this correctly in https://github.com/juanfont/headscale/pull/905, can you please help me test it?

@kradalby commented on GitHub (Oct 31, 2022): @mlincett @huskyii @felixscheinost I think I have added support for this correctly in https://github.com/juanfont/headscale/pull/905, can you please help me test it?

adam commented

@felixscheinost commented on GitHub (Nov 10, 2022):

Sorry, I just got around to try out the new version.

BTW: Awesome that you have a flake.nix!

@kradalby If I set dns_config.override_local_dns = false then I can again use local resolvers but I can no longer resolve MagicDNS names

@felixscheinost commented on GitHub (Nov 10, 2022): Sorry, I just got around to try out the new version. BTW: Awesome that you have a `flake.nix`! @kradalby If I set `dns_config.override_local_dns = false` then I can again use local resolvers but I can no longer resolve MagicDNS names

adam commented

@felixscheinost commented on GitHub (Nov 10, 2022):

My config looks like this

db_path: /var/lib/headscale/db.sqlite
db_type: sqlite3
derp:
  auto_update_enable: false
  paths: []
  server:
    enabled: 'true'
    region_code: headscale
    region_id: '999'
    region_name: Headscale Embedded DERP
    stun_listen_addr: 0.0.0.0:3478
  update_frequency: 24h
  urls: []
disable_check_updates: true
dns_config:
  base_domain: example.com
  domains: []
  magic_dns: true
  nameservers:
  - 1.1.1.1
  override_local_dns: false
ephemeral_node_inactivity_timeout: 30m
listen_addr: 0.0.0.0:443
log_level: info
noise:
  private_key_path: /var/lib/headscale/noise_private.key
oidc:
  client_id: ''
  domain_map: {}
  issuer: ''
private_key_path: /var/lib/headscale/private.key
server_url: https://headscale.example.com:443
tls_letsencrypt_cache_dir: /var/lib/headscale/.cache
tls_letsencrypt_challenge_type: HTTP-01
tls_letsencrypt_hostname: headscale.example.com
tls_letsencrypt_listen: :http
unix_socket: /run/headscale/headscale.sock

@felixscheinost commented on GitHub (Nov 10, 2022): My config looks like this ``` db_path: /var/lib/headscale/db.sqlite db_type: sqlite3 derp: auto_update_enable: false paths: [] server: enabled: 'true' region_code: headscale region_id: '999' region_name: Headscale Embedded DERP stun_listen_addr: 0.0.0.0:3478 update_frequency: 24h urls: [] disable_check_updates: true dns_config: base_domain: example.com domains: [] magic_dns: true nameservers: - 1.1.1.1 override_local_dns: false ephemeral_node_inactivity_timeout: 30m listen_addr: 0.0.0.0:443 log_level: info noise: private_key_path: /var/lib/headscale/noise_private.key oidc: client_id: '' domain_map: {} issuer: '' private_key_path: /var/lib/headscale/private.key server_url: https://headscale.example.com:443 tls_letsencrypt_cache_dir: /var/lib/headscale/.cache tls_letsencrypt_challenge_type: HTTP-01 tls_letsencrypt_hostname: headscale.example.com tls_letsencrypt_listen: :http unix_socket: /run/headscale/headscale.sock ```

adam commented

@felixscheinost commented on GitHub (Nov 10, 2022):

Output of scutil --dns

DNS configuration

resolver #1
  <my local router>
  if_index : 10 (en6)
  flags    : Request A records, Request AAAA records
  reach    : 0x00020002 (Reachable,Directly Reachable Address)

resolver #2
  <other VPN>
  if_index : 34 (utun5)
  flags    : Supplemental, Request A records, Request AAAA records
  reach    : 0x00000003 (Reachable,Transient Connection)
  order    : 100400

resolver #3
  domain   : local
  options  : mdns
  timeout  : 5
  flags    : Request A records, Request AAAA records
  reach    : 0x00000000 (Not Reachable)
  order    : 300000

resolver #4
  domain   : 254.169.in-addr.arpa
  options  : mdns
  timeout  : 5
  flags    : Request A records, Request AAAA records
  reach    : 0x00000000 (Not Reachable)
  order    : 300200

resolver #5
  domain   : 8.e.f.ip6.arpa
  options  : mdns
  timeout  : 5
  flags    : Request A records, Request AAAA records
  reach    : 0x00000000 (Not Reachable)
  order    : 300400

resolver #6
  domain   : 9.e.f.ip6.arpa
  options  : mdns
  timeout  : 5
  flags    : Request A records, Request AAAA records
  reach    : 0x00000000 (Not Reachable)
  order    : 300600

resolver #7
  domain   : a.e.f.ip6.arpa
  options  : mdns
  timeout  : 5
  flags    : Request A records, Request AAAA records
  reach    : 0x00000000 (Not Reachable)
  order    : 300800

resolver #8
  domain   : b.e.f.ip6.arpa
  options  : mdns
  timeout  : 5
  flags    : Request A records, Request AAAA records
  reach    : 0x00000000 (Not Reachable)
  order    : 301000

DNS configuration (for scoped queries)

resolver #1
  <my local router>
  if_index : 10 (en6)
  flags    : Scoped, Request A records, Request AAAA records
  reach    : 0x00020002 (Reachable,Directly Reachable Address)

resolver #2
  <my local router>
  if_index : 14 (en0)
  flags    : Scoped, Request A records, Request AAAA records
  reach    : 0x00020002 (Reachable,Directly Reachable Address)

resolver #3
  <internal other VPN>
  if_index : 34 (utun5)
  flags    : Scoped, Request A records
  reach    : 0x00000003 (Reachable,Transient Connection)

So now it seems as if the Tailscale client isn't configuring any DNS settings at all.

@felixscheinost commented on GitHub (Nov 10, 2022): Output of `scutil --dns` ``` DNS configuration resolver #1 <my local router> if_index : 10 (en6) flags : Request A records, Request AAAA records reach : 0x00020002 (Reachable,Directly Reachable Address) resolver #2 <other VPN> if_index : 34 (utun5) flags : Supplemental, Request A records, Request AAAA records reach : 0x00000003 (Reachable,Transient Connection) order : 100400 resolver #3 domain : local options : mdns timeout : 5 flags : Request A records, Request AAAA records reach : 0x00000000 (Not Reachable) order : 300000 resolver #4 domain : 254.169.in-addr.arpa options : mdns timeout : 5 flags : Request A records, Request AAAA records reach : 0x00000000 (Not Reachable) order : 300200 resolver #5 domain : 8.e.f.ip6.arpa options : mdns timeout : 5 flags : Request A records, Request AAAA records reach : 0x00000000 (Not Reachable) order : 300400 resolver #6 domain : 9.e.f.ip6.arpa options : mdns timeout : 5 flags : Request A records, Request AAAA records reach : 0x00000000 (Not Reachable) order : 300600 resolver #7 domain : a.e.f.ip6.arpa options : mdns timeout : 5 flags : Request A records, Request AAAA records reach : 0x00000000 (Not Reachable) order : 300800 resolver #8 domain : b.e.f.ip6.arpa options : mdns timeout : 5 flags : Request A records, Request AAAA records reach : 0x00000000 (Not Reachable) order : 301000 DNS configuration (for scoped queries) resolver #1 <my local router> if_index : 10 (en6) flags : Scoped, Request A records, Request AAAA records reach : 0x00020002 (Reachable,Directly Reachable Address) resolver #2 <my local router> if_index : 14 (en0) flags : Scoped, Request A records, Request AAAA records reach : 0x00020002 (Reachable,Directly Reachable Address) resolver #3 <internal other VPN> if_index : 34 (utun5) flags : Scoped, Request A records reach : 0x00000003 (Reachable,Transient Connection) ``` So now it seems as if the Tailscale client isn't configuring any DNS settings at all.

adam commented

@CNLHC commented on GitHub (Nov 15, 2022):

same problem here

@CNLHC commented on GitHub (Nov 15, 2022): same problem here

adam commented

@brian-maloney commented on GitHub (Mar 29, 2023):

I'm trying out headscale this week and just ran into this problem myself. It seems like the only working options using the official macOS Tailscale client are:

Run all DNS through Tailscale/Headscale
Run no DNS through Tailscale/Headscale

I guess maybe most users are intentionally routing DNS through the overlay network for added security so this is an uncommon issue? My long-term plans for this do involve DNS so if there's not a workaround it's probably fine but was wondering if anyone had discovered anything new on this issue?

@brian-maloney commented on GitHub (Mar 29, 2023): I'm trying out headscale this week and just ran into this problem myself. It seems like the only working options using the official macOS Tailscale client are: - Run all DNS through Tailscale/Headscale - Run _no_ DNS through Tailscale/Headscale I guess maybe most users are intentionally routing DNS through the overlay network for added security so this is an uncommon issue? My long-term plans for this do involve DNS so if there's not a workaround it's probably fine but was wondering if anyone had discovered anything new on this issue?

adam commented

@hrtkpf commented on GitHub (Sep 10, 2023):

I am currently having the issue that MagicDNS breaks when override_local_dns is set to false (on Linux, Tailscale client v1.48.1). I am not sure if this is exactly the same issue, but at least it seems to be somehow related (and I did not want to open yet another issue for this).

MagicDNS only works with override_local_dns=true, but then all DNS queries are obviously sent through the resolvers configured in Headscale, which might not be what you want.
When override_local_dns=false, all DNS queries are sent through the client's resolver (whichever that is), including queries designated for MagicDNS, making the resolution fail. I verified both observations using tcpdump.

A manual dig host1.magicdns.example.com @100.100.100.100 works.

Someone also seems to have the same issue since #905 (https://github.com/juanfont/headscale/pull/905#issuecomment-1377224539).

@hrtkpf commented on GitHub (Sep 10, 2023): I am currently having the issue that MagicDNS breaks when override_local_dns is set to false (on Linux, Tailscale client v1.48.1). I am not sure if this is exactly the same issue, but at least it seems to be somehow related (and I did not want to open yet another issue for this). MagicDNS only works with override_local_dns=true, but then all DNS queries are obviously sent through the resolvers configured in Headscale, which might not be what you want. When override_local_dns=false, all DNS queries are sent through the client's resolver (whichever that is), including queries designated for MagicDNS, making the resolution fail. I verified both observations using tcpdump. A manual `dig host1.magicdns.example.com @100.100.100.100` works. Someone also seems to have the same issue since #905 (https://github.com/juanfont/headscale/pull/905#issuecomment-1377224539).

adam commented

@letitfly commented on GitHub (Sep 26, 2023):

Same here. Might have to stop using MagicDNS.

@letitfly commented on GitHub (Sep 26, 2023): Same here. Might have to stop using MagicDNS.

adam commented

@mlincett commented on GitHub (Sep 26, 2023):

I am currently having the issue that MagicDNS breaks when override_local_dns is set to false (on Linux, Tailscale client v1.48.1). I am not sure if this is exactly the same issue, but at least it seems to be somehow related (and I did not want to open yet another issue for this).

MagicDNS only works with override_local_dns=true, but then all DNS queries are obviously sent through the resolvers configured in Headscale, which might not be what you want. When override_local_dns=false, all DNS queries are sent through the client's resolver (whichever that is), including queries designated for MagicDNS, making the resolution fail. I verified both observations using tcpdump.

A manual dig host1.magicdns.example.com @100.100.100.100 works.

Someone also seems to have the same issue since #905 (#905 (comment)).

I am not currently using headscale but I guess it could be helpful if you could say something more about your DNS configuration. In case you are using systemd-resolved you may want to attach the output of resolvectl status.

@mlincett commented on GitHub (Sep 26, 2023): > I am currently having the issue that MagicDNS breaks when override_local_dns is set to false (on Linux, Tailscale client v1.48.1). I am not sure if this is exactly the same issue, but at least it seems to be somehow related (and I did not want to open yet another issue for this). > > MagicDNS only works with override_local_dns=true, but then all DNS queries are obviously sent through the resolvers configured in Headscale, which might not be what you want. When override_local_dns=false, all DNS queries are sent through the client's resolver (whichever that is), including queries designated for MagicDNS, making the resolution fail. I verified both observations using tcpdump. > > A manual `dig host1.magicdns.example.com @100.100.100.100` works. > > Someone also seems to have the same issue since #905 ([#905 (comment)](https://github.com/juanfont/headscale/pull/905#issuecomment-1377224539)). I am not currently using `headscale` but I guess it could be helpful if you could say something more about your DNS configuration. In case you are using `systemd-resolved` you may want to attach the output of `resolvectl status`.

adam commented

@github-actions[bot] commented on GitHub (Dec 26, 2023):

This issue is stale because it has been open for 90 days with no activity.

@github-actions[bot] commented on GitHub (Dec 26, 2023): This issue is stale because it has been open for 90 days with no activity.

adam commented

@github-actions[bot] commented on GitHub (Jan 2, 2024):

This issue was closed because it has been inactive for 14 days since being marked as stale.

@github-actions[bot] commented on GitHub (Jan 2, 2024): This issue was closed because it has been inactive for 14 days since being marked as stale.

adam commented