Keep the DNS interception hooks installed when the firewall is disabled

client/internal/engine.go

@@ -732,6 +732,14 @@ func (e *Engine) Start(netbirdConfig *mgmProto.NetbirdConfig, mgmtURL *url.URL)
 func (e *Engine) createFirewall() error {
 	if e.config.DisableFirewall {
 		log.Infof("firewall is disabled")
+
+		// The DNS hooks are not firewall rules. Without the filter that carries
+		// them the resolver never receives a query, while the system is still
+		// pointed at it.
+		if err := firewall.InstallDNSHooksFilter(e.wgInterface); err != nil {
+			log.Errorf("failed to install DNS hooks filter, DNS will not work: %v", err)
+		}
+
 		return nil
 	}
 

client/internal/engine_firewall_test.go

@@ -0,0 +1,53 @@
+package internal
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/client/firewall/uspfilter"
+	"github.com/netbirdio/netbird/client/iface/device"
+)
+
+// A disabled firewall must still leave the DNS interception hooks in place on a
+// userspace bind: the in-process resolver receives queries through them, and the
+// system is pointed at that resolver either way.
+func TestCreateFirewallDisabledInstallsDNSHooksOnUserspaceBind(t *testing.T) {
+	var installed device.PacketFilter
+	iface := &MockWGIface{
+		IsUserspaceBindFunc: func() bool { return true },
+		SetFilterFunc: func(filter device.PacketFilter) error {
+			installed = filter
+			return nil
+		},
+	}
+
+	engine := &Engine{
+		config:      &EngineConfig{DisableFirewall: true},
+		wgInterface: iface,
+	}
+
+	require.NoError(t, engine.createFirewall())
+	assert.Nil(t, engine.firewall, "no firewall manager should be created")
+	assert.IsType(t, &uspfilter.HooksFilter{}, installed)
+}
+
+// A kernel bind has no device filter, so nothing should be installed on it.
+func TestCreateFirewallDisabledSkipsDNSHooksOnKernelBind(t *testing.T) {
+	iface := &MockWGIface{
+		IsUserspaceBindFunc: func() bool { return false },
+		SetFilterFunc: func(device.PacketFilter) error {
+			t.Error("SetFilter called for a kernel bind")
+			return nil
+		},
+	}
+
+	engine := &Engine{
+		config:      &EngineConfig{DisableFirewall: true},
+		wgInterface: iface,
+	}
+
+	require.NoError(t, engine.createFirewall())
+	assert.Nil(t, engine.firewall, "no firewall manager should be created")
+}