Wireguard VPN w/ namespace killswitch

Community Guides
,
6

This rule:

ip daddr 10.139.1.1 udp dport 53 dnat to { XX.XX.XX.XX, YY.YY.YY.YY }

Is the same as these rules:

ip daddr 10.139.1.1 udp dport 53 dnat to XX.XX.XX.XX
ip daddr 10.139.1.1 udp dport 53 dnat to YY.YY.YY.YY

So only the first rule will work, second rule won’t ever be triggered (if XX.XX.XX.XX != 10.139.1.1).
You need to add rules for 10.139.1.1/10.139.1.2 DNS servers:

ip daddr 10.139.1.1 meta l4proto {tcp, udp} th dport 53 dnat to XX.XX.XX.XX
ip daddr 10.139.1.2 meta l4proto {tcp, udp} th dport 53 dnat to YY.YY.YY.YY
1 Like