Wireguard - Adding Nameserver entries to Client Configs

How to add PostUp and PostDown scripts to WireGuard client configurations for DNS nameserver resolution on Windows and Linux.

The following are instructions for adding a PostUp and PostDown script to the Wireguard config. For Windows, this adds Powershell commands for adding and removing a DNS Client Rule when the client connects and disconnects.

Windows Clients

1. In the Windows Wireguard client, edit the config.
2. Add the following commands in the [Interface] section:

PostUp = powershell -command "Add-DnsClientNrptRule -Namespace 'domainname.com' -NameServers '10.1.10.2'"
PostDown = powershell -command "Get-DnsClientNrptRule | Where { $_.Namespace -match '.*domainname\.com' } | Remove-DnsClientNrptRule -force"

1. Change the following entries to match your setup:

   • Namespace: A comma-separated list of domain names to add.
   • NameServers: A comma-separated list of nameserver IP addresses.

For the -match, make sure to include a backslash (\) before each period (.)

---

Linux Clients

This may vary based on your Linux distribution.

1. Edit the config file on the Linux client.
2. In the [Interface] section, add the following:

PostUp = resolvectl dns %i 10.1.10.2; resolvectl domain %i domainname.com
PreUp = iptables -A INPUT -i wg -m state --state ESTABLISHED,RELATED -j ACCEPT
PreUp = iptables -A INPUT -i wg -j REJECT
PostDown = iptables -D INPUT -i wg -m state --state ESTABLISHED,RELATED -j ACCEPT
PostDown = iptables -D INPUT -i wg -j REJECT

1. Replace 10.1.10.2 with the correct IP of your nameserver.
2. Replace domainname.com with your domain name.

---

Document Information

• Last Updated: 2024-08-29
• vergeOS Version: 4.12.6