FR: Exclusive Proxy Relay

[actionated]

Using the current implementation of WireGuard with relays and with Split DNS enabled, the entry node's DNS server, as well as the exit's, are active and determinable.

This functionality undermines the purpose of relays, as they're used to make traffic harder to track. In this case, with the entry DNS server usually associated with the entry server, it allows an adversary to identify the route taken. To address this, I recommend that the only active configured WireGuard DNS server is the exit's while using relays.

[ignoramous]

To address this, I recommend that the only active configured WireGuard DNS server is the exit's while using relays.

Sorry, I don't quite understand. A relay's DNS is never used by apps routed to exit. Are you reporting that they're being used?

[actionated]

I'm reporting that in the following configuration:
WG 1 - Lockdown + always-on
WG 2 - App selected for relay
Relay WG 2 set under WG 1, so, WG 1 -> WG 2
Split DNS = On

The public IP is sometimes reported as WG 2's and both associated DNS servers are resolving queries. If this relay feature is meant to route WireGuard traffic through another WireGuard tunnel, the only resolving DNS server should be the final relay's, as if the entry server is resolving as well, the receiver of the traffic can reasonably assume that traffic is flowing through the initial point, which defeats the purpose of this feature and removes any potential privacy gain by using relays.

For example, popular services like Mullvad VPN or IVPN publicly list their own server IP addresses and their associated DNS servers. If one can see information tied to the previous hop, it visibly ties the next hop to the previous, which nullifies any benefit and is the opposite intention of multi-hop features.

[ignoramous]

Thanks for the detailed writeup.

WG 1 - Lockdown + always-on
WG 2 - App selected for relay
...
The public IP is sometimes reported as WG 2's and both associated DNS servers are resolving queries ...

That's because:

• Load balance same app across multiple active WireGuards  #2394

I mean, we either load balance or we don't (:

That said, we can probably introduce an "exclusively relay" WireGuard, which can't be used to route apps (or in load balancing).