Keep DNS on the intended path

Routing packets is half the job. Name resolution decides which packets exist in the first place, and it deserves the same attention.

Two situations force you to care where DNS goes. First, a private service may need a private DNS resolver. wiki.internal exists only in the company’s DNS, and no public resolver has ever heard of it. Second, an Internet egress VPN may want DNS queries to use the same trusted path as the traffic. Otherwise the local network still sees every hostname you look up, and that is most of what you were trying to hide.

A DNS leak happens when queries take a path you did not intend. The tunnel carries your traffic while your queries still flow to the home router’s resolver. The observer you were avoiding reads your browsing intentions from the query stream.

wg-quick can point the system at a resolver while the tunnel is up. Add one line to the [Interface] section:

[Interface]
Address = 10.14.0.2/24
PrivateKey = LAPTOP_PRIVATE_KEY
DNS = 10.14.0.1

Then check where queries really go, because intent and reality diverge here all the time:

resolvectl status wg0
#   DNS Servers: 10.14.0.1

dig example.com | grep SERVER
# ;; SERVER: 10.14.0.1#53(10.14.0.1)

The SERVER line names the resolver that answered. If it shows your home router instead of 10.14.0.1, you have a leak, whatever the VPN app’s interface claims.

IPv6 is the second trap. An IPv4-only tunnel does nothing for IPv6. When a destination publishes an IPv6 address and your device has working IPv6, the operating system may prefer it. Your traffic sails straight past the IPv4 routes you built. Either carry IPv6 in the tunnel too, with ::/0 in AllowedIPs, or decide on purpose how IPv6 should behave.

You can spot this one quickly. Run curl -6 https://ifconfig.me. If it prints your home IPv6 address while the tunnel is up, IPv6 is bypassing it.

The third trap is disconnection. A kill switch blocks selected traffic when the tunnel disappears. Without one, the operating system may fall back to its ordinary default route. It happens silently, in the middle of a session, while you keep working under assumptions that stopped being true.

So test everything, not just the connection. Test addresses, DNS answers, IPv4, IPv6, and what happens when you pull the tunnel down. A connected icon proves very little. A “connected” VPN can leak every DNS query for months if nobody runs dig.