Wireguard issues

Bugs
,
7

FQDN comes with a few issues:

  1. If the name can’t be resolved during the tunnel creation, the tunnel can’t be created and will fail.
  2. If the FQDN is set up in /ect/hosts, that’s gonna be the IP the tunnel will be connected during the tunnel creation
  3. If you DNS flaps, or A, AAAA records are modified after the tunnel creation, the tunnel will stick to the old A record resolved during the tunnel creation. (unless you do the dynamic recreation)
  4. dynamic re-creation, if you have DNS issues resolving A, AAAA records your tunnel will fail, flap or needs to resync (packet loss).

There are more negative issues than benefits for a FQDN implementation don’t you think?
I think it’s not a good idea to use FQDN, it has been the choice of the user in the past which I think shouldn’t be a big issue to allow again, but again a tunnel (regardless what tunnel type) in general shouldn’t rely on any external service such as DNS.

1 Like