WireGuard

After connecting to WireGuard, you may sometimes want only internal domain names to be resolved through the DNS in the tunnel, while other domain names continue to use public DNS. On Linux systems already using systemd-resolved, you can directly configure DNS routing domains and then apply them automatically through wg-quick’s PostUp, without installing an additional DNS forwarding service. ...

On an Armbian machine used as a bypass router, both sing-box and WireGuard are running side by side. The router itself resolves internal domain names fine, yet downstream clients that point at it as their DNS server time out every time. The root cause turned out not to be the DNS matching rules, but rather that the traffic sing-box sends to its upstream DNS was choosing the wrong egress interface. ...