Console9

WireGuard: DNS resolution fails over tunnel

Fix DNS resolution failures over a WireGuard tunnel caused by missing DNS server configuration.

WireGuard: DNS resolution fails over tunnel

DNS queries fail when the client's DNS configuration does not use a DNS server reachable through the WireGuard tunnel.

When WireGuard Produces This Error

The tunnel is active and IP connectivity works (e.g., ping 1.1.1.1 succeeds), but domain names do not resolve ( ping example.com fails with "Name or service not known").

What Causes DNS Failure Over WireGuard

The client's /etc/resolv.conf still points to the local network's DNS server, which is not reachable through the tunnel when AllowedIPs = 0.0.0.0/0 routes all traffic through WireGuard.

How to Fix DNS Over WireGuard

  1. Add a DNS directive to the client's [Interface] section in wg0.conf:

    [Interface]
DNS = 1.1.1.1, 8.8.8.8

  2. Restart the tunnel:

    sudo wg-quick down wg0 && sudo wg-quick up wg0

    wg-quick updates /etc/resolv.conf automatically when the DNS directive is present.

How to Verify the Fix

dig example.com

The query should return an IP address using the DNS server specified in the WireGuard config.

© 2026 - Console9