jacob-pro / wsl2-dns-agent

Agent to automatically update your WSL2 resolv.conf when using a VPN

WSL2 DNS Agent for Cisco AnyConnect Users

An agent that automatically patches your WSL2 DNS configuration when using Cisco AnyConnect (or similar VPNs that block split-tunneling).

Thanks to @pyther for the inspiration for this tool.

⚠ As of September 2023, WSL2 now has an experimental dnsTunneling option that makes this tool unnecessary.

There is also a new mirrored networking mode that means you don't need to modify the route table either (although this has some limitations).

How it works

1. The agent detects when you connect/disconnect from a VPN.
2. The agent finds the highest priority DNS servers being used by Windows.
3. The agent detects your WSL2 distributions, for each distribution it ensures that generateResolvConf is disabled, and then writes the DNS servers to /etc/resolv.conf.

Usage

Ensure you have first fixed the route table for WSL2, and not broken the Windows DNS server priority in the process. See the guide for how to do this.

Ensure you have the chattr command present within your WSL2 distribution. For RHEL-family distributions you can use sudo yum install e2fsprogs.

Download wsl2-dns-agent.exe from the releases page

(Optionally) save it to your startup folder (%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup), so it is automatically launched when you log in.

Launch the wsl2-dns-agent.exe application.

Diagnostics

You can view the application log by clicking on the tray icon and "View Log".

Note that this tool should apply DNS servers based on their priority in Windows.

For example, from Windows Command Prompt try running:

C:\Users\jdhalsey>nslookup.exe google.com
Server:  OpenWrt.lan
Address:  10.2.9.254

Non-authoritative answer: ...

Therefore 10.2.9.254 will be the first server written to /etc/resolv.conf. If the server is not what you expected then please look at the DNS guide

Advanced options

For advanced use cases you can edit the config file in %APPDATA%\WSL2 DNS Agent\config.toml

Example config:

show_notifications = false

# Default options for distributions
[defaults]
apply_dns = true
patch_wsl_conf = true
# If the distribution was previously Stopped, then shutdown once the DNS update is complete
# Note: This option is usually not needed on Windows 11 (because vmIdleTimeout will do it for you)
shutdown = false

# Set options for a specific distribution
[distributions.Ubuntu]
apply_dns = false

Note: the default configuration will ignore Docker Desktop, since the changes are unnecessary.

wsl2-dns-agent's Issues

Having to Manually Set InterfaceMetric

First off, big thanks to you for putting together this little helper agent, it has saved me a great deal of headache 😄

Anyway, I was curious if you could provide some insight with something that I'm seeing.

When I connect to the VPN (Cisco AnyConnect), WSL's /etc/resolv.conf gets updated correctly, but resolution continues to fail.

Looking at the output of this command:

Get-NetIPInterface | Where-Object {$_.ConnectionState -eq 'Connected'} | Sort-Object -Property InterfaceMetric

I see this (truncated for brevity):

ifIndex InterfaceAlias                  AddressFamily NlMtu(Bytes) InterfaceMetric Dhcp     ConnectionState PolicyStore
------- --------------                  ------------- ------------ --------------- ----     --------------- -----------
5       Ethernet 2                      IPv4                  1390               1 Disabled Connected       ActiveStore
5       Ethernet 2                      IPv6                  1390            6000 Enabled  Connected       ActiveStore

Note the Ethernet 2 interface at the top of the list has an InterfaceMetric of 1 instead of 6000. Previously I did set the value here to 6000 (as indicated by the second entry). Now it seems that I need to come back in each time and run the command you'd provided in your documentation:

Set-NetIPInterface -InterfaceAlias "Ethernet 2" -InterfaceMetric 6000

Once I do this manually, things continue to work wonderfully.

I was under the impression that the agent would watch for this and handle it, but I figured I'd check and see if that understanding was correct or if I misunderstood and it's simply a fact of life that I'll need to do this manually (which at least gets me a working session, which I'm glad to have!)

Rare crash: panicked at Result::unwrap(), Error { code: 0x800705B4, message: This operation returned because the timeout period expired. } at src/tray.rs:191:56

I'm not sure, but I think this happens when waking up from sleep and/or hibernation.

[QUESTION] How can we disable an IPv6-DNS response at all?

In your example with 1 Ethernet-Adapater:
https://github.com/jacob-pro/wsl2-dns-agent/blob/master/docs/DNS_PRIORITY.md#dns-servers-on-the-same-interface

How would you prevent that you get an IPv6-Response at all?
If you are in a situation where it is necessary to only get an IPv4, how can we disable the IPv6-DNS at all?