Wireguard VPN setup (4.2 and 4.3)

[barto]

Speaking of DNS in wireguard VPN qubes, I always use this:

Wireguard VPN qube DNS

I’ve been using @solene 's guide/setup for a long time, with all the leak prevention features, and noticed an annoying feature: on vpn qube boot, most of the times, first 1-2 DNS queries fail. I’m talking about DNS queries coming from qubes using this VPN qube on the upstream (through another sys-firewall-prevpn qube, but that is not important here). Long story short, it happens because the Network Manager is always adding the default Qubes resolvers to /etc/resolv.conf, resulting in two non-fu…

Actually nowadays I have a slightly different convoluted setup in the sys-vpn-* qubes, checking for the existence of the zzz-my-hook in /rw/config, and copying it to the correct location if it exists, combined with some qubesdb vm-config magic… but the principle is the same.
Removing 10.139.1.[1-2] also acts as a “poor man’s DNS leaks preventer” although only specific traffic is allowed in the upstream firewall qube - I mean, it’s an unneeded bonus feature.