Issue - Pifi wireguard not using tunnel DNS

[jot7305]

When connecting to wireguard servers from Pifi, the DNS server used should be the one defined in the wireguard config file under the interface section. However, this is not the behavior I’m seeing. In testing the DNS servers, I see multiple cloudflare DNS servers listed, Notably, the DNS server defined in the wireguard config file is ignored. This represents a serious DNS leak. Please note, the same config files when used with the wireguard app or my router do properly use the tunnel DNS. So it’s not the config files, it has something to do with the way PiFi is handling the DNS.

How can I fix this so Pifi uses the tunnel DNS as defined in the interface section of the config file which is the DNS it should be using.

Thanks

[pifi]

@jot7305

This is a Pifi issue as when I connect to the same wg server using the wg app or through my own router, the DNS servers resolve correctly and I don’t see any cloudflare DNS servers. I only see the cloudflare servers when I connect to the wg servers from Pifi. Where are these cloudflare DNS servers coming from? Is this somehow hard coded into Pifi?

Would you be able to share the config file with everything removed apart from the DNS line for both commercial + your own

So something like this:

[Interface]
Address = REMOVED
PrivateKey = REMOVED
DNS = 162.252.172.57, 149.154.159.92
[Peer]
PublicKey = REMOVED
AllowedIPs = 0.0.0.0/0
Endpoint = REMOVED

Please do not upload the config with PrivateKey / PublicKey shown. But I do need the DNS to be present

Also which commercial VPN provider is it as I’ve got access to many but not all so helps when replicating

[jot7305]

Let’s start with the torguard conf file: Here is what I’m using with info redacted per your request:

TorGuard WireGuard Config
[Interface]
PrivateKey =
ListenPort =
MTU = 1390
DNS = 10.8.0.1
Address =

[Peer]
PublicKey =
AllowedIPs = 0.0.0.0/0
Endpoint =
PersistentKeepalive = 25

Note, if you’re able to replicate with your own torguard, for DNS please select use VPN DNS when creating your conf file.

[pifi]

Hi,

There is indeed a bug when AdGuard is completely off, not just protection disabled, that it is pushing Cloudflare and not VPN DNS on WireGuard

If you want to route with VPN DNS at the moment I suggest enabling AdGuard

With AdGuard enabled - unless Overrule DNS is also turned on which it is not by default - it will always push VPN DNS

So VPN will always use VPN DNS with the stock implementation with AdGuard enabled unless you force AdGuard to run over VPN via Settings > More Settings > VPN Client > Overrule DNS

*Pushing a fix for this issue in the app so should be resolved when approved by App Stores

[jot7305]

Thanks so much for the quick fix. You’re awesome. Are you aware of obtanium? It was recommended to me by the devs of one of my other open source apps. I have been using obtanium for some time and it’s fantastic. I love getting my app and updates directly from the source. Please consider adding PiFi app here which makes it really easy to add to obtanium. However, most Apps can be added easily to Obtainium by pasting the source link directly into Obtainium’s “Add App” page. If you can please provide the source link I can add it and get the update now without waiting on the app store approval. Thanks so much!

[jot7305]

Tested with adguard enabled and DNS working perfectly.

[jot7305]

…“*Pushing a fix for this issue in the app so should be resolved when approved by App Stores”…

23 days have past and I have not seen an app update with this fix pushed on android. This is why I’m hopeful you will decide to offer updates via obtanium.

In the meantime, do you have an ETA on when this update will be available?

Thank you.

[pifi]

Hey, in testing there was some new bugs introduced so it got pushed back till next update

Right now, I’m working flat on finalising the 24.10 firmware which has a lot of demand (introduces Pi 5 mainline support, Pi 5 2Gb + 16Gb model support) - I’m hoping a release of that is very soon - there has been a lot of work on driver support on this new firmware. There are also some new DNS upstream scripts on this build - that independently of the app handle DNS in a different way when the default AdGuard configuration is removed.

I hesitate to say an exact ETA because issues can get thrown up and then it takes longer than expected but hopefully that’s not the case. I’m not sure (or I doubt) obtanium would see updates faster than the popular Google/Apple app stores either way - I’d still want well tested and robust updates regardless of the channel.