Repository navigation
v058: DNS queries to find Wireguard peers only uses DoH which is problematic on hostile networks #3183
Description
Until v058, I had no issues connecting to my Wireguard peers using Rethink. With 0.5.8, as far as I can tell Rethink only uses DNS over HTTPS to find the IP addresses of the Wireguard peers. This is problematic on networks that only allow DNS over standard port 53, not DoT over port 853, and blocks HTTPS traffic to known DoH providers like Quad9 and Cloudflare. I can no longer connect to my Wireguard peers
Please add an option to change this behavior to use standard DNS over port 53
Activity
ignoramous commentedon Oct 14, 2026
This feature exists: Change Configure -> Network -> Choose bootstrap DNS to None or System and see if things work?
seonwoolee commentedon Oct 14, 2026
That does work, but then that prevents me from enabling the proxy lockdown option
ignoramous commentedon Oct 14, 2026
I am afraid we can't have it both ways. Either all traffic is "lockdown" and sent over proxy (which is what Configure -> Network -> Proxy Lockdown is) or is dropped. System DNS cannot be sent over proxies (as usually, System DNS is local to a network & is unlikely to be available over remote proxies).
seonwoolee commentedon Oct 14, 2026
I'm not quite sure I understand
ignoramous commentedon Oct 15, 2026
You can consider it as a "Proxy Lockdown leak" that was fixed in
v058. That said, we can consider letting users set Bootstrap DNS to System DNS despite Proxy Lockdown (but the queries to System DNS may fail regardless as the "killswitch" / "Lockdown" wouldn't allow those but instead block them). I'll speak with the lead developer about what it means to carve out an exception for this...That's not what "Lockdown" (also called "killswitch") is or does. It is a very specific feature for a very specific threat model.
seonwoolee commentedon Oct 16, 2026
Could you explain what lockdown is meant to do then? It says "all traffic is forced through proxy or blocked"
But clearly you can't do that before the connection to the proxy is established. If the Wireguard peer is defined not by a static IP address but by a hostname like peer.example.com, then you must resolve the DNS for peer.example.com
All I'm asking is that DNS resolution be allowed over port 53, as opposed to over port 443 via DoH which is what v058 seems to do (from my observations of the logs). I'm not asking that it has to be done via System DNS, just that it's done over port 53.
ignoramous commentedon Oct 16, 2026
That's a catch-22 in this situation, sure. But, Rethink bypassing proxy for DNS resolution using System DNS, with the "killswitch" engaged, would be a "leak".
Gotcha; similar to: