Feature/dns client configuration (#563)

Added host configurators for Linux, Windows, and macOS.

The host configurator will update the peer system configuration
 directing DNS queries according to its capabilities.

Some Linux distributions don't support split (match) DNS or custom ports,
 and that will be reported to our management system in another PR

.gitignore

@@ -10,4 +10,5 @@ infrastructure_files/management.json
 infrastructure_files/docker-compose.yml
 *.syso
 client/.distfiles/
-infrastructure_files/setup.env
+infrastructure_files/setup.env
+.vscode

README.md

@@ -99,6 +99,12 @@ See a complete [architecture overview](https://netbird.io/docs/overview/architec
 ### Community projects
 -  [NetBird on OpenWRT](https://github.com/messense/openwrt-netbird)
 
+### Support acknowledgement
+
+In November 2022, NetBird joined the [StartUpSecure program](https://www.forschung-it-sicherheit-kommunikationssysteme.de/foerderung/bekanntmachungen/startup-secure) sponsored by The Federal Ministry of Education and Research of The Federal Republic of Germany. Together with [CISPA Helmholtz Center for Information Security](https://cispa.de/en) NetBird brings the security best practices and simplicity to private networking.
+
+![CISPA_Logo_BLACK_EN_RZ_RGB (1)](https://user-images.githubusercontent.com/700848/203091324-c6d311a0-22b5-4b05-a288-91cbc6cdcc46.png)
+
 ### Testimonials
 We use open-source technologies like [WireGuard®](https://www.wireguard.com/), [Pion ICE (WebRTC)](https://github.com/pion/ice), and [Coturn](https://github.com/coturn/coturn). We very much appreciate the work these guys are doing and we'd greatly appreciate if you could support them in any way (e.g. giving a star or a contribution).
 

client/cmd/service.go

@@ -32,6 +32,7 @@ func newSVCConfig() *service.Config {
 		Name:        name,
 		DisplayName: "Netbird",
 		Description: "A WireGuard-based mesh network that connects your devices into a single private network.",
+		Option:      make(service.KeyValue),
 	}
 }
 

client/cmd/service_installer.go

@@ -2,6 +2,7 @@ package cmd
 
 import (
 	"context"
+	"path/filepath"
 	"runtime"
 
 	"github.com/spf13/cobra"
@@ -32,8 +33,13 @@ var installCmd = &cobra.Command{
 		}
 
 		if managementURL != "" {
-			svcConfig.Arguments = append(svcConfig.Arguments, "--management-url")
-			svcConfig.Arguments = append(svcConfig.Arguments, managementURL)
+			svcConfig.Arguments = append(svcConfig.Arguments, "--management-url", managementURL)
+		}
+
+		if logFile != "console" {
+			svcConfig.Arguments = append(svcConfig.Arguments, "--log-file", logFile)
+			svcConfig.Option["LogOutput"] = true
+			svcConfig.Option["LogDirectory"] = filepath.Dir(logFile)
 		}
 
 		if runtime.GOOS == "linux" {

client/internal/config.go

@@ -3,6 +3,9 @@ package internal
 import (
 	"context"
 	"fmt"
+	"net/url"
+	"os"
+
 	"github.com/netbirdio/netbird/client/ssh"
 	"github.com/netbirdio/netbird/iface"
 	mgm "github.com/netbirdio/netbird/management/client"
@@ -11,8 +14,6 @@ import (
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
-	"net/url"
-	"os"
 )
 
 var managementURLDefault *url.URL
@@ -32,15 +33,33 @@ func init() {
 // Config Configuration type
 type Config struct {
 	// Wireguard private key of local peer
-	PrivateKey     string
-	PreSharedKey   string
-	ManagementURL  *url.URL
-	AdminURL       *url.URL
-	WgIface        string
-	WgPort         int
-	IFaceBlackList []string
+	PrivateKey           string
+	PreSharedKey         string
+	ManagementURL        *url.URL
+	AdminURL             *url.URL
+	WgIface              string
+	WgPort               int
+	IFaceBlackList       []string
+	DisableIPv6Discovery bool
 	// SSHKey is a private SSH key in a PEM format
-	SSHKey string
+	SSHKey         string
+
+	// ExternalIP mappings, if different than the host interface IP
+	//
+	//   External IP must not be behind a CGNAT and port-forwarding for incoming UDP packets from WgPort on ExternalIP
+	//   to WgPort on host interface IP must be present. This can take form of single port-forwarding rule, 1:1 DNAT
+	//   mapping ExternalIP to host interface IP, or a NAT DMZ to host interface IP.
+	//
+	//   A single mapping will take the form of: external[/internal]
+	//    external (required): either the external IP address or "stun" to use STUN to determine the external IP address
+	//    internal (optional): either the internal/interface IP address or an interface name
+	//
+	//   examples:
+	//      "12.34.56.78"          => all interfaces IPs will be mapped to external IP of 12.34.56.78
+	//      "12.34.56.78/eth0"     => IPv4 assigned to interface eth0 will be mapped to external IP of 12.34.56.78
+	//      "12.34.56.78/10.1.2.3" => interface IP 10.1.2.3 will be mapped to external IP of 12.34.56.78
+
+	NATExternalIPs []string
 }
 
 // createNewConfig creates a new config generating a new Wireguard key and saving to file
@@ -51,11 +70,12 @@ func createNewConfig(managementURL, adminURL, configPath, preSharedKey string) (
 		return nil, err
 	}
 	config := &Config{
-		SSHKey:         string(pem),
-		PrivateKey:     wgKey,
-		WgIface:        iface.WgInterfaceDefault,
-		WgPort:         iface.DefaultWgPort,
-		IFaceBlackList: []string{},
+		SSHKey:               string(pem),
+		PrivateKey:           wgKey,
+		WgIface:              iface.WgInterfaceDefault,
+		WgPort:               iface.DefaultWgPort,
+		IFaceBlackList:       []string{},
+		DisableIPv6Discovery: false,
 	}
 	if managementURL != "" {
 		URL, err := ParseURL("Management URL", managementURL)

client/internal/connect.go

@@ -3,11 +3,12 @@ package internal
 import (
 	"context"
 	"fmt"
-	"github.com/netbirdio/netbird/client/ssh"
-	nbStatus "github.com/netbirdio/netbird/client/status"
 	"strings"
 	"time"
 
+	"github.com/netbirdio/netbird/client/ssh"
+	nbStatus "github.com/netbirdio/netbird/client/status"
+
 	"github.com/netbirdio/netbird/client/system"
 
 	"github.com/netbirdio/netbird/iface"
@@ -184,12 +185,14 @@ func RunClient(ctx context.Context, config *Config, statusRecorder *nbStatus.Sta
 func createEngineConfig(key wgtypes.Key, config *Config, peerConfig *mgmProto.PeerConfig) (*EngineConfig, error) {
 
 	engineConf := &EngineConfig{
-		WgIfaceName:    config.WgIface,
-		WgAddr:         peerConfig.Address,
-		IFaceBlackList: config.IFaceBlackList,
-		WgPrivateKey:   key,
-		WgPort:         config.WgPort,
-		SSHKey:         []byte(config.SSHKey),
+		WgIfaceName:          config.WgIface,
+		WgAddr:               peerConfig.Address,
+		IFaceBlackList:       config.IFaceBlackList,
+		DisableIPv6Discovery: config.DisableIPv6Discovery,
+		WgPrivateKey:         key,
+		WgPort:               config.WgPort,
+		SSHKey:               []byte(config.SSHKey),
+		NATExternalIPs:	config.NATExternalIPs,
 	}
 
 	if config.PreSharedKey != "" {

client/internal/dns/dbus_linux.go

@@ -0,0 +1,41 @@
+package dns
+
+import (
+	"context"
+	"github.com/godbus/dbus/v5"
+	log "github.com/sirupsen/logrus"
+	"time"
+)
+
+const dbusDefaultFlag = 0
+
+func isDbusListenerRunning(dest string, path dbus.ObjectPath) bool {
+	obj, closeConn, err := getDbusObject(dest, path)
+	if err != nil {
+		return false
+	}
+	defer closeConn()
+
+	ctx, cancel := context.WithTimeout(context.TODO(), 5*time.Second)
+	defer cancel()
+
+	err = obj.CallWithContext(ctx, "org.freedesktop.DBus.Peer.Ping", 0).Store()
+	return err == nil
+}
+
+func getDbusObject(dest string, path dbus.ObjectPath) (dbus.BusObject, func(), error) {
+	conn, err := dbus.SystemBus()
+	if err != nil {
+		return nil, nil, err
+	}
+	obj := conn.Object(dest, path)
+
+	closeFunc := func() {
+		closeErr := conn.Close()
+		if closeErr != nil {
+			log.Warnf("got an error closing dbus connection, err: %s", closeErr)
+		}
+	}
+
+	return obj, closeFunc, nil
+}

client/internal/dns/file_linux.go

@@ -0,0 +1,154 @@
+package dns
+
+import (
+	"bytes"
+	"fmt"
+	log "github.com/sirupsen/logrus"
+	"os"
+)
+
+const (
+	fileGeneratedResolvConfContentHeader      = "# Generated by NetBird"
+	fileGeneratedResolvConfSearchBeginContent = "search "
+	fileGeneratedResolvConfContentFormat      = fileGeneratedResolvConfContentHeader +
+		"\n# If needed you can restore the original file by copying back %s\n\nnameserver %s\n" +
+		fileGeneratedResolvConfSearchBeginContent + "%s\n"
+)
+const (
+	fileDefaultResolvConfBackupLocation = defaultResolvConfPath + ".original.netbird"
+	fileMaxLineCharsLimit               = 256
+	fileMaxNumberOfSearchDomains        = 6
+)
+
+var fileSearchLineBeginCharCount = len(fileGeneratedResolvConfSearchBeginContent)
+
+type fileConfigurator struct {
+	originalPerms os.FileMode
+}
+
+func newFileConfigurator() (hostManager, error) {
+	return &fileConfigurator{}, nil
+}
+
+func (f *fileConfigurator) applyDNSConfig(config hostDNSConfig) error {
+	backupFileExist := false
+	_, err := os.Stat(fileDefaultResolvConfBackupLocation)
+	if err == nil {
+		backupFileExist = true
+	}
+
+	if !config.routeAll {
+		if backupFileExist {
+			err = f.restore()
+			if err != nil {
+				return fmt.Errorf("unable to configure DNS for this peer using file manager without a Primary nameserver group. Restoring the original file return err: %s", err)
+			}
+		}
+		return fmt.Errorf("unable to configure DNS for this peer using file manager without a Primary nameserver group")
+	}
+	managerType, err := getOSDNSManagerType()
+	if err != nil {
+		return err
+	}
+	switch managerType {
+	case fileManager, netbirdManager:
+		if !backupFileExist {
+			err = f.backup()
+			if err != nil {
+				return fmt.Errorf("unable to backup the resolv.conf file")
+			}
+		}
+	default:
+		// todo improve this and maybe restart DNS manager from scratch
+		return fmt.Errorf("something happened and file manager is not your prefered host dns configurator, restart the agent")
+	}
+
+	var searchDomains string
+	appendedDomains := 0
+	for _, dConf := range config.domains {
+		if dConf.matchOnly {
+			continue
+		}
+		if appendedDomains >= fileMaxNumberOfSearchDomains {
+			// lets log all skipped domains
+			log.Infof("already appended %d domains to search list. Skipping append of %s domain", fileMaxNumberOfSearchDomains, dConf.domain)
+			continue
+		}
+		if fileSearchLineBeginCharCount+len(searchDomains) > fileMaxLineCharsLimit {
+			// lets log all skipped domains
+			log.Infof("search list line is larger than %d characters. Skipping append of %s domain", fileMaxLineCharsLimit, dConf.domain)
+			continue
+		}
+
+		searchDomains += " " + dConf.domain
+		appendedDomains++
+	}
+	content := fmt.Sprintf(fileGeneratedResolvConfContentFormat, fileDefaultResolvConfBackupLocation, config.serverIP, searchDomains)
+	err = writeDNSConfig(content, defaultResolvConfPath, f.originalPerms)
+	if err != nil {
+		err = f.restore()
+		if err != nil {
+			log.Errorf("attempt to restore default file failed with error: %s", err)
+		}
+		return err
+	}
+	log.Infof("created a NetBird managed %s file with your DNS settings", defaultResolvConfPath)
+	return nil
+}
+
+func (f *fileConfigurator) restoreHostDNS() error {
+	return f.restore()
+}
+
+func (f *fileConfigurator) backup() error {
+	stats, err := os.Stat(defaultResolvConfPath)
+	if err != nil {
+		return fmt.Errorf("got an error while checking stats for %s file. Error: %s", defaultResolvConfPath, err)
+	}
+
+	f.originalPerms = stats.Mode()
+
+	err = copyFile(defaultResolvConfPath, fileDefaultResolvConfBackupLocation)
+	if err != nil {
+		return fmt.Errorf("got error while backing up the %s file. Error: %s", defaultResolvConfPath, err)
+	}
+	return nil
+}
+
+func (f *fileConfigurator) restore() error {
+	err := copyFile(fileDefaultResolvConfBackupLocation, defaultResolvConfPath)
+	if err != nil {
+		return fmt.Errorf("got error while restoring the %s file from %s. Error: %s", defaultResolvConfPath, fileDefaultResolvConfBackupLocation, err)
+	}
+
+	return os.RemoveAll(fileDefaultResolvConfBackupLocation)
+}
+
+func writeDNSConfig(content, fileName string, permissions os.FileMode) error {
+	log.Debugf("creating managed file %s", fileName)
+	var buf bytes.Buffer
+	buf.WriteString(content)
+	err := os.WriteFile(fileName, buf.Bytes(), permissions)
+	if err != nil {
+		return fmt.Errorf("got an creating resolver file %s. Error: %s", fileName, err)
+	}
+	return nil
+}
+
+func copyFile(src, dest string) error {
+	stats, err := os.Stat(src)
+	if err != nil {
+		return fmt.Errorf("got an error while checking stats for %s file when copying it. Error: %s", src, err)
+	}
+
+	bytesRead, err := os.ReadFile(src)
+	if err != nil {
+		return fmt.Errorf("got an error while reading the file %s file for copy. Error: %s", src, err)
+	}
+
+	err = os.WriteFile(dest, bytesRead, stats.Mode())
+	if err != nil {
+		return fmt.Errorf("got an writing the destination file %s for copy. Error: %s", dest, err)
+	}
+	return nil
+}

client/internal/dns/host.go

@@ -0,0 +1,79 @@
+package dns
+
+import (
+	"fmt"
+	nbdns "github.com/netbirdio/netbird/dns"
+	"strings"
+)
+
+type hostManager interface {
+	applyDNSConfig(config hostDNSConfig) error
+	restoreHostDNS() error
+}
+
+type hostDNSConfig struct {
+	domains    []domainConfig
+	routeAll   bool
+	serverIP   string
+	serverPort int
+}
+
+type domainConfig struct {
+	domain    string
+	matchOnly bool
+}
+
+type mockHostConfigurator struct {
+	applyDNSConfigFunc func(config hostDNSConfig) error
+	restoreHostDNSFunc func() error
+}
+
+func (m *mockHostConfigurator) applyDNSConfig(config hostDNSConfig) error {
+	if m.applyDNSConfigFunc != nil {
+		return m.applyDNSConfigFunc(config)
+	}
+	return fmt.Errorf("method applyDNSSettings is not implemented")
+}
+
+func (m *mockHostConfigurator) restoreHostDNS() error {
+	if m.restoreHostDNSFunc != nil {
+		return m.restoreHostDNSFunc()
+	}
+	return fmt.Errorf("method restoreHostDNS is not implemented")
+}
+
+func newNoopHostMocker() hostManager {
+	return &mockHostConfigurator{
+		applyDNSConfigFunc: func(config hostDNSConfig) error { return nil },
+		restoreHostDNSFunc: func() error { return nil },
+	}
+}
+
+func dnsConfigToHostDNSConfig(dnsConfig nbdns.Config, ip string, port int) hostDNSConfig {
+	config := hostDNSConfig{
+		routeAll:   false,
+		serverIP:   ip,
+		serverPort: port,
+	}
+	for _, nsConfig := range dnsConfig.NameServerGroups {
+		if nsConfig.Primary {
+			config.routeAll = true
+		}
+
+		for _, domain := range nsConfig.Domains {
+			config.domains = append(config.domains, domainConfig{
+				domain:    strings.TrimSuffix(domain, "."),
+				matchOnly: true,
+			})
+		}
+	}
+
+	for _, customZone := range dnsConfig.CustomZones {
+		config.domains = append(config.domains, domainConfig{
+			domain:    strings.TrimSuffix(customZone.Domain, "."),
+			matchOnly: false,
+		})
+	}
+
+	return config
+}

client/internal/dns/host_darwin.go

@@ -0,0 +1,259 @@
+package dns
+
+import (
+	"bufio"
+	"bytes"
+	"fmt"
+	"github.com/netbirdio/netbird/iface"
+	log "github.com/sirupsen/logrus"
+	"os/exec"
+	"strconv"
+	"strings"
+)
+
+const (
+	netbirdDNSStateKeyFormat            = "State:/Network/Service/NetBird-%s/DNS"
+	globalIPv4State                     = "State:/Network/Global/IPv4"
+	primaryServiceSetupKeyFormat        = "Setup:/Network/Service/%s/DNS"
+	keySupplementalMatchDomains         = "SupplementalMatchDomains"
+	keySupplementalMatchDomainsNoSearch = "SupplementalMatchDomainsNoSearch"
+	keyServerAddresses                  = "ServerAddresses"
+	keyServerPort                       = "ServerPort"
+	arraySymbol                         = "* "
+	digitSymbol                         = "# "
+	scutilPath                          = "/usr/sbin/scutil"
+	searchSuffix                        = "Search"
+	matchSuffix                         = "Match"
+)
+
+type systemConfigurator struct {
+	// primaryServiceID primary interface in the system. AKA the interface with the default route
+	primaryServiceID string
+	createdKeys      map[string]struct{}
+}
+
+func newHostManager(_ *iface.WGIface) (hostManager, error) {
+	return &systemConfigurator{
+		createdKeys: make(map[string]struct{}),
+	}, nil
+}
+
+func (s *systemConfigurator) applyDNSConfig(config hostDNSConfig) error {
+	var err error
+
+	if config.routeAll {
+		err = s.addDNSSetupForAll(config.serverIP, config.serverPort)
+		if err != nil {
+			return err
+		}
+	} else if s.primaryServiceID != "" {
+		err = s.removeKeyFromSystemConfig(getKeyWithInput(primaryServiceSetupKeyFormat, s.primaryServiceID))
+		if err != nil {
+			return err
+		}
+		s.primaryServiceID = ""
+		log.Infof("removed %s:%d as main DNS resolver for this peer", config.serverIP, config.serverPort)
+	}
+
+	var (
+		searchDomains []string
+		matchDomains  []string
+	)
+
+	for _, dConf := range config.domains {
+		if dConf.matchOnly {
+			matchDomains = append(matchDomains, dConf.domain)
+			continue
+		}
+		searchDomains = append(searchDomains, dConf.domain)
+	}
+
+	matchKey := getKeyWithInput(netbirdDNSStateKeyFormat, matchSuffix)
+	if len(matchDomains) != 0 {
+		err = s.addMatchDomains(matchKey, strings.Join(matchDomains, " "), config.serverIP, config.serverPort)
+	} else {
+		log.Infof("removing match domains from the system")
+		err = s.removeKeyFromSystemConfig(matchKey)
+	}
+	if err != nil {
+		return err
+	}
+
+	searchKey := getKeyWithInput(netbirdDNSStateKeyFormat, searchSuffix)
+	if len(searchDomains) != 0 {
+		err = s.addSearchDomains(searchKey, strings.Join(searchDomains, " "), config.serverIP, config.serverPort)
+	} else {
+		log.Infof("removing search domains from the system")
+		err = s.removeKeyFromSystemConfig(searchKey)
+	}
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (s *systemConfigurator) restoreHostDNS() error {
+	lines := ""
+	for key := range s.createdKeys {
+		lines += buildRemoveKeyOperation(key)
+		keyType := "search"
+		if strings.Contains(key, matchSuffix) {
+			keyType = "match"
+		}
+		log.Infof("removing %s domains from system", keyType)
+	}
+	if s.primaryServiceID != "" {
+		lines += buildRemoveKeyOperation(getKeyWithInput(primaryServiceSetupKeyFormat, s.primaryServiceID))
+		log.Infof("restoring DNS resolver configuration for system")
+	}
+	_, err := runSystemConfigCommand(wrapCommand(lines))
+	if err != nil {
+		log.Errorf("got an error while cleaning the system configuration: %s", err)
+		return err
+	}
+
+	return nil
+}
+
+func (s *systemConfigurator) removeKeyFromSystemConfig(key string) error {
+	line := buildRemoveKeyOperation(key)
+	_, err := runSystemConfigCommand(wrapCommand(line))
+	if err != nil {
+		return err
+	}
+
+	delete(s.createdKeys, key)
+
+	return nil
+}
+
+func (s *systemConfigurator) addSearchDomains(key, domains string, ip string, port int) error {
+	err := s.addDNSState(key, domains, ip, port, true)
+	if err != nil {
+		return err
+	}
+
+	log.Infof("added %d search domains to the state. Domain list: %s", len(strings.Split(domains, " ")), domains)
+
+	s.createdKeys[key] = struct{}{}
+
+	return nil
+}
+
+func (s *systemConfigurator) addMatchDomains(key, domains, dnsServer string, port int) error {
+	err := s.addDNSState(key, domains, dnsServer, port, false)
+	if err != nil {
+		return err
+	}
+
+	log.Infof("added %d match domains to the state. Domain list: %s", len(strings.Split(domains, " ")), domains)
+
+	s.createdKeys[key] = struct{}{}
+
+	return nil
+}
+
+func (s *systemConfigurator) addDNSState(state, domains, dnsServer string, port int, enableSearch bool) error {
+	noSearch := "1"
+	if enableSearch {
+		noSearch = "0"
+	}
+	lines := buildAddCommandLine(keySupplementalMatchDomains, arraySymbol+domains)
+	lines += buildAddCommandLine(keySupplementalMatchDomainsNoSearch, digitSymbol+noSearch)
+	lines += buildAddCommandLine(keyServerAddresses, arraySymbol+dnsServer)
+	lines += buildAddCommandLine(keyServerPort, digitSymbol+strconv.Itoa(port))
+
+	addDomainCommand := buildCreateStateWithOperation(state, lines)
+	stdinCommands := wrapCommand(addDomainCommand)
+
+	_, err := runSystemConfigCommand(stdinCommands)
+	if err != nil {
+		return fmt.Errorf("got error while applying state for domains %s, error: %s", domains, err)
+	}
+	return nil
+}
+
+func (s *systemConfigurator) addDNSSetupForAll(dnsServer string, port int) error {
+	primaryServiceKey := s.getPrimaryService()
+	if primaryServiceKey == "" {
+		return fmt.Errorf("couldn't find the primary service key")
+	}
+
+	err := s.addDNSSetup(getKeyWithInput(primaryServiceSetupKeyFormat, primaryServiceKey), dnsServer, port)
+	if err != nil {
+		return err
+	}
+	log.Infof("configured %s:%d as main DNS resolver for this peer", dnsServer, port)
+	s.primaryServiceID = primaryServiceKey
+	return nil
+}
+
+func (s *systemConfigurator) getPrimaryService() string {
+	line := buildCommandLine("show", globalIPv4State, "")
+	stdinCommands := wrapCommand(line)
+	b, err := runSystemConfigCommand(stdinCommands)
+	if err != nil {
+		log.Error("got error while sending the command: ", err)
+		return ""
+	}
+	scanner := bufio.NewScanner(bytes.NewReader(b))
+	for scanner.Scan() {
+		text := scanner.Text()
+		if strings.Contains(text, "PrimaryService") {
+			return strings.TrimSpace(strings.Split(text, ":")[1])
+		}
+	}
+	return ""
+}
+
+func (s *systemConfigurator) addDNSSetup(setupKey, dnsServer string, port int) error {
+	lines := buildAddCommandLine(keySupplementalMatchDomainsNoSearch, digitSymbol+strconv.Itoa(0))
+	lines += buildAddCommandLine(keyServerAddresses, arraySymbol+dnsServer)
+	lines += buildAddCommandLine(keyServerPort, digitSymbol+strconv.Itoa(port))
+	addDomainCommand := buildCreateStateWithOperation(setupKey, lines)
+	stdinCommands := wrapCommand(addDomainCommand)
+	_, err := runSystemConfigCommand(stdinCommands)
+	if err != nil {
+		return fmt.Errorf("got error while applying dns setup, error: %s", err)
+	}
+	return nil
+}
+
+func getKeyWithInput(format, key string) string {
+	return fmt.Sprintf(format, key)
+}
+
+func buildAddCommandLine(key, value string) string {
+	return buildCommandLine("d.add", key, value)
+}
+
+func buildCommandLine(action, key, value string) string {
+	return fmt.Sprintf("%s %s %s\n", action, key, value)
+}
+
+func wrapCommand(commands string) string {
+	return fmt.Sprintf("open\n%s\nquit\n", commands)
+}
+
+func buildRemoveKeyOperation(key string) string {
+	return fmt.Sprintf("remove %s\n", key)
+}
+
+func buildCreateStateWithOperation(state, commands string) string {
+	return buildWriteStateOperation("set", state, commands)
+}
+
+func buildWriteStateOperation(operation, state, commands string) string {
+	return fmt.Sprintf("d.init\n%s %s\n%s\nset %s\n", operation, state, commands, state)
+}
+
+func runSystemConfigCommand(command string) ([]byte, error) {
+	cmd := exec.Command(scutilPath)
+	cmd.Stdin = strings.NewReader(command)
+	out, err := cmd.Output()
+	if err != nil {
+		return nil, fmt.Errorf("got error while running system configuration command: \"%s\", error: %s", command, err)
+	}
+	return out, nil
+}

client/internal/dns/host_linux.go

@@ -0,0 +1,75 @@
+package dns
+
+import (
+	"bufio"
+	"fmt"
+	"github.com/netbirdio/netbird/iface"
+	log "github.com/sirupsen/logrus"
+	"os"
+	"strings"
+)
+
+const (
+	defaultResolvConfPath = "/etc/resolv.conf"
+)
+
+const (
+	netbirdManager osManagerType = iota
+	fileManager
+	networkManager
+	systemdManager
+	resolvConfManager
+)
+
+type osManagerType int
+
+func newHostManager(wgInterface *iface.WGIface) (hostManager, error) {
+	osManager, err := getOSDNSManagerType()
+	if err != nil {
+		return nil, err
+	}
+
+	log.Debugf("discovered mode is: %d", osManager)
+	switch osManager {
+	case networkManager:
+		return newNetworkManagerDbusConfigurator(wgInterface)
+	case systemdManager:
+		return newSystemdDbusConfigurator(wgInterface)
+	default:
+		return newFileConfigurator()
+	}
+}
+
+func getOSDNSManagerType() (osManagerType, error) {
+
+	file, err := os.Open(defaultResolvConfPath)
+	if err != nil {
+		return 0, fmt.Errorf("unable to open %s for checking owner, got error: %s", defaultResolvConfPath, err)
+	}
+	defer file.Close()
+
+	scanner := bufio.NewScanner(file)
+	for scanner.Scan() {
+		text := scanner.Text()
+		if len(text) == 0 {
+			continue
+		}
+		if text[0] != '#' {
+			return fileManager, nil
+		}
+		if strings.Contains(text, fileGeneratedResolvConfContentHeader) {
+			return netbirdManager, nil
+		}
+		if strings.Contains(text, "NetworkManager") && isDbusListenerRunning(networkManagerDest, networkManagerDbusObjectNode) && isNetworkManagerSupported() {
+			log.Debugf("is nm running on supported v? %t", isNetworkManagerSupportedVersion())
+			return networkManager, nil
+		}
+		if strings.Contains(text, "systemd-resolved") && isDbusListenerRunning(systemdResolvedDest, systemdDbusObjectNode) {
+			return systemdManager, nil
+		}
+		if strings.Contains(text, "resolvconf") {
+			return resolvConfManager, nil
+		}
+	}
+	return fileManager, nil
+}

client/internal/dns/host_windows.go

@@ -0,0 +1,260 @@
+package dns
+
+import (
+	"fmt"
+	"github.com/netbirdio/netbird/iface"
+	log "github.com/sirupsen/logrus"
+	"golang.org/x/sys/windows/registry"
+	"strings"
+)
+
+const (
+	dnsPolicyConfigMatchPath            = "SYSTEM\\CurrentControlSet\\Services\\Dnscache\\Parameters\\DnsPolicyConfig\\NetBird-Match"
+	dnsPolicyConfigVersionKey           = "Version"
+	dnsPolicyConfigVersionValue         = 2
+	dnsPolicyConfigNameKey              = "Name"
+	dnsPolicyConfigGenericDNSServersKey = "GenericDNSServers"
+	dnsPolicyConfigConfigOptionsKey     = "ConfigOptions"
+	dnsPolicyConfigConfigOptionsValue   = 0x8
+)
+
+const (
+	interfaceConfigPath          = "SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters\\Interfaces"
+	interfaceConfigNameServerKey = "NameServer"
+	interfaceConfigSearchListKey = "SearchList"
+	tcpipParametersPath          = "SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters"
+)
+
+type registryConfigurator struct {
+	guid                  string
+	routingAll            bool
+	existingSearchDomains []string
+}
+
+func newHostManager(wgInterface *iface.WGIface) (hostManager, error) {
+	guid, err := wgInterface.GetInterfaceGUIDString()
+	if err != nil {
+		return nil, err
+	}
+	return &registryConfigurator{
+		guid: guid,
+	}, nil
+}
+
+func (r *registryConfigurator) applyDNSConfig(config hostDNSConfig) error {
+	var err error
+	if config.routeAll {
+		err = r.addDNSSetupForAll(config.serverIP)
+		if err != nil {
+			return err
+		}
+	} else if r.routingAll {
+		err = r.deleteInterfaceRegistryKeyProperty(interfaceConfigNameServerKey)
+		if err != nil {
+			return err
+		}
+		r.routingAll = false
+		log.Infof("removed %s as main DNS forwarder for this peer", config.serverIP)
+	}
+
+	var (
+		searchDomains []string
+		matchDomains  []string
+	)
+
+	for _, dConf := range config.domains {
+		if !dConf.matchOnly {
+			searchDomains = append(searchDomains, dConf.domain)
+		}
+		matchDomains = append(matchDomains, "."+dConf.domain)
+	}
+
+	if len(matchDomains) != 0 {
+		err = r.addDNSMatchPolicy(matchDomains, config.serverIP)
+	} else {
+		err = removeRegistryKeyFromDNSPolicyConfig(dnsPolicyConfigMatchPath)
+	}
+	if err != nil {
+		return err
+	}
+
+	err = r.updateSearchDomains(searchDomains)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (r *registryConfigurator) addDNSSetupForAll(ip string) error {
+	err := r.setInterfaceRegistryKeyStringValue(interfaceConfigNameServerKey, ip)
+	if err != nil {
+		return fmt.Errorf("adding dns setup for all failed with error: %s", err)
+	}
+	r.routingAll = true
+	log.Infof("configured %s:53 as main DNS forwarder for this peer", ip)
+	return nil
+}
+
+func (r *registryConfigurator) addDNSMatchPolicy(domains []string, ip string) error {
+	_, err := registry.OpenKey(registry.LOCAL_MACHINE, dnsPolicyConfigMatchPath, registry.QUERY_VALUE)
+	if err == nil {
+		err = registry.DeleteKey(registry.LOCAL_MACHINE, dnsPolicyConfigMatchPath)
+		if err != nil {
+			return fmt.Errorf("unable to remove existing key from registry, key: HKEY_LOCAL_MACHINE\\%s, error: %s", dnsPolicyConfigMatchPath, err)
+		}
+	}
+
+	regKey, _, err := registry.CreateKey(registry.LOCAL_MACHINE, dnsPolicyConfigMatchPath, registry.SET_VALUE)
+	if err != nil {
+		return fmt.Errorf("unable to create registry key, key: HKEY_LOCAL_MACHINE\\%s, error: %s", dnsPolicyConfigMatchPath, err)
+	}
+
+	err = regKey.SetDWordValue(dnsPolicyConfigVersionKey, dnsPolicyConfigVersionValue)
+	if err != nil {
+		return fmt.Errorf("unable to set registry value for %s, error: %s", dnsPolicyConfigVersionKey, err)
+	}
+
+	err = regKey.SetStringsValue(dnsPolicyConfigNameKey, domains)
+	if err != nil {
+		return fmt.Errorf("unable to set registry value for %s, error: %s", dnsPolicyConfigNameKey, err)
+	}
+
+	err = regKey.SetStringValue(dnsPolicyConfigGenericDNSServersKey, ip)
+	if err != nil {
+		return fmt.Errorf("unable to set registry value for %s, error: %s", dnsPolicyConfigGenericDNSServersKey, err)
+	}
+
+	err = regKey.SetDWordValue(dnsPolicyConfigConfigOptionsKey, dnsPolicyConfigConfigOptionsValue)
+	if err != nil {
+		return fmt.Errorf("unable to set registry value for %s, error: %s", dnsPolicyConfigConfigOptionsKey, err)
+	}
+
+	log.Infof("added %d match domains to the state. Domain list: %s", len(domains), domains)
+
+	return nil
+}
+
+func (r *registryConfigurator) restoreHostDNS() error {
+	err := removeRegistryKeyFromDNSPolicyConfig(dnsPolicyConfigMatchPath)
+	if err != nil {
+		log.Error(err)
+	}
+
+	return r.updateSearchDomains([]string{})
+}
+
+func (r *registryConfigurator) updateSearchDomains(domains []string) error {
+	value, err := getLocalMachineRegistryKeyStringValue(tcpipParametersPath, interfaceConfigSearchListKey)
+	if err != nil {
+		return fmt.Errorf("unable to get current search domains failed with error: %s", err)
+	}
+
+	valueList := strings.Split(value, ",")
+	setExisting := false
+	if len(r.existingSearchDomains) == 0 {
+		r.existingSearchDomains = valueList
+		setExisting = true
+	}
+
+	if len(domains) == 0 && setExisting {
+		log.Infof("added %d search domains to the registry. Domain list: %s", len(domains), domains)
+		return nil
+	}
+
+	newList := append(r.existingSearchDomains, domains...)
+
+	err = setLocalMachineRegistryKeyStringValue(tcpipParametersPath, interfaceConfigSearchListKey, strings.Join(newList, ","))
+	if err != nil {
+		return fmt.Errorf("adding search domain failed with error: %s", err)
+	}
+
+	log.Infof("updated the search domains in the registry with %d domains. Domain list: %s", len(domains), domains)
+
+	return nil
+}
+
+func (r *registryConfigurator) setInterfaceRegistryKeyStringValue(key, value string) error {
+	regKey, err := r.getInterfaceRegistryKey()
+	if err != nil {
+		return err
+	}
+	defer regKey.Close()
+
+	err = regKey.SetStringValue(key, value)
+	if err != nil {
+		return fmt.Errorf("applying key %s with value \"%s\" for interface failed with error: %s", key, value, err)
+	}
+
+	return nil
+}
+
+func (r *registryConfigurator) deleteInterfaceRegistryKeyProperty(propertyKey string) error {
+	regKey, err := r.getInterfaceRegistryKey()
+	if err != nil {
+		return err
+	}
+	defer regKey.Close()
+
+	err = regKey.DeleteValue(propertyKey)
+	if err != nil {
+		return fmt.Errorf("deleting registry key %s for interface failed with error: %s", propertyKey, err)
+	}
+
+	return nil
+}
+
+func (r *registryConfigurator) getInterfaceRegistryKey() (registry.Key, error) {
+	var regKey registry.Key
+
+	regKeyPath := interfaceConfigPath + "\\" + r.guid
+
+	regKey, err := registry.OpenKey(registry.LOCAL_MACHINE, regKeyPath, registry.SET_VALUE)
+	if err != nil {
+		return regKey, fmt.Errorf("unable to open the interface registry key, key: HKEY_LOCAL_MACHINE\\%s, error: %s", regKeyPath, err)
+	}
+
+	return regKey, nil
+}
+
+func removeRegistryKeyFromDNSPolicyConfig(regKeyPath string) error {
+	k, err := registry.OpenKey(registry.LOCAL_MACHINE, regKeyPath, registry.QUERY_VALUE)
+	if err == nil {
+		k.Close()
+		err = registry.DeleteKey(registry.LOCAL_MACHINE, regKeyPath)
+		if err != nil {
+			return fmt.Errorf("unable to remove existing key from registry, key: HKEY_LOCAL_MACHINE\\%s, error: %s", regKeyPath, err)
+		}
+	}
+	return nil
+}
+
+func getLocalMachineRegistryKeyStringValue(keyPath, key string) (string, error) {
+	regKey, err := registry.OpenKey(registry.LOCAL_MACHINE, keyPath, registry.QUERY_VALUE)
+	if err != nil {
+		return "", fmt.Errorf("unable to open existing key from registry, key path: HKEY_LOCAL_MACHINE\\%s, error: %s", keyPath, err)
+	}
+	defer regKey.Close()
+
+	val, _, err := regKey.GetStringValue(key)
+	if err != nil {
+		return "", fmt.Errorf("getting %s value for key path HKEY_LOCAL_MACHINE\\%s failed with error: %s", key, keyPath, err)
+	}
+
+	return val, nil
+}
+
+func setLocalMachineRegistryKeyStringValue(keyPath, key, value string) error {
+	regKey, err := registry.OpenKey(registry.LOCAL_MACHINE, keyPath, registry.SET_VALUE)
+	if err != nil {
+		return fmt.Errorf("unable to open existing key from registry, key path: HKEY_LOCAL_MACHINE\\%s, error: %s", keyPath, err)
+	}
+	defer regKey.Close()
+
+	err = regKey.SetStringValue(key, value)
+	if err != nil {
+		return fmt.Errorf("setting %s value %s for key path HKEY_LOCAL_MACHINE\\%s failed with error: %s", key, value, keyPath, err)
+	}
+
+	return nil
+}

client/internal/dns/local.go

@@ -1,6 +1,7 @@
 package dns
 
 import (
+	"fmt"
 	"github.com/miekg/dns"
 	nbdns "github.com/netbirdio/netbird/dns"
 	log "github.com/sirupsen/logrus"
@@ -14,16 +15,16 @@ type localResolver struct {
 
 // ServeDNS handles a DNS request
 func (d *localResolver) ServeDNS(w dns.ResponseWriter, r *dns.Msg) {
-	log.Tracef("received question: %#v\n", r.Question[0])
-	response := d.lookupRecord(r)
-	if response == nil {
-		log.Debugf("got empty response for question: %#v\n", r.Question[0])
-		return
-	}
-
+	log.Debugf("received question: %#v\n", r.Question[0])
 	replyMessage := &dns.Msg{}
 	replyMessage.SetReply(r)
-	replyMessage.Answer = append(replyMessage.Answer, response)
+	replyMessage.RecursionAvailable = true
+	replyMessage.Rcode = dns.RcodeSuccess
+
+	response := d.lookupRecord(r)
+	if response != nil {
+		replyMessage.Answer = append(replyMessage.Answer, response)
+	}
 
 	err := w.WriteMsg(replyMessage)
 	if err != nil {
@@ -32,7 +33,8 @@ func (d *localResolver) ServeDNS(w dns.ResponseWriter, r *dns.Msg) {
 }
 
 func (d *localResolver) lookupRecord(r *dns.Msg) dns.RR {
-	record, found := d.records.Load(r.Question[0].Name)
+	question := r.Question[0]
+	record, found := d.records.Load(buildRecordKey(question.Name, question.Qclass, question.Qtype))
 	if !found {
 		return nil
 	}
@@ -46,7 +48,10 @@ func (d *localResolver) registerRecord(record nbdns.SimpleRecord) error {
 		return err
 	}
 
-	d.records.Store(fullRecord.Header().Name, fullRecord)
+	fullRecord.Header().Rdlength = record.Len()
+
+	header := fullRecord.Header()
+	d.records.Store(buildRecordKey(header.Name, header.Class, header.Rrtype), fullRecord)
 
 	return nil
 }
@@ -54,3 +59,8 @@ func (d *localResolver) registerRecord(record nbdns.SimpleRecord) error {
 func (d *localResolver) deleteRecord(recordKey string) {
 	d.records.Delete(dns.Fqdn(recordKey))
 }
+
+func buildRecordKey(name string, class, qType uint16) string {
+	key := fmt.Sprintf("%s_%d_%d", name, class, qType)
+	return key
+}

client/internal/dns/local_test.go

@@ -64,7 +64,7 @@ func TestLocalResolver_ServeDNS(t *testing.T) {
 
 			resolver.ServeDNS(responseWriter, testCase.inputMSG)
 
-			if responseMSG == nil {
+			if responseMSG == nil || len(responseMSG.Answer) == 0 {
 				if testCase.responseShouldBeNil {
 					return
 				}

client/internal/dns/network_manager_linux.go

@@ -0,0 +1,295 @@
+package dns
+
+import (
+	"context"
+	"encoding/binary"
+	"fmt"
+	"github.com/godbus/dbus/v5"
+	"github.com/hashicorp/go-version"
+	"github.com/miekg/dns"
+	"github.com/netbirdio/netbird/iface"
+	log "github.com/sirupsen/logrus"
+	"net/netip"
+	"regexp"
+	"time"
+)
+
+const (
+	networkManagerDest                                                              = "org.freedesktop.NetworkManager"
+	networkManagerDbusObjectNode                                                    = "/org/freedesktop/NetworkManager"
+	networkManagerDbusDNSManagerInterface                                           = "org.freedesktop.NetworkManager.DnsManager"
+	networkManagerDbusDNSManagerObjectNode                                          = networkManagerDbusObjectNode + "/DnsManager"
+	networkManagerDbusDNSManagerModeProperty                                        = networkManagerDbusDNSManagerInterface + ".Mode"
+	networkManagerDbusDNSManagerRcManagerProperty                                   = networkManagerDbusDNSManagerInterface + ".RcManager"
+	networkManagerDbusVersionProperty                                               = "org.freedesktop.NetworkManager.Version"
+	networkManagerDbusGetDeviceByIPIfaceMethod                                      = networkManagerDest + ".GetDeviceByIpIface"
+	networkManagerDbusDeviceInterface                                               = "org.freedesktop.NetworkManager.Device"
+	networkManagerDbusDeviceGetAppliedConnectionMethod                              = networkManagerDbusDeviceInterface + ".GetAppliedConnection"
+	networkManagerDbusDeviceReapplyMethod                                           = networkManagerDbusDeviceInterface + ".Reapply"
+	networkManagerDbusDeviceDeleteMethod                                            = networkManagerDbusDeviceInterface + ".Delete"
+	networkManagerDbusDefaultBehaviorFlag              networkManagerConfigBehavior = 0
+	networkManagerDbusIPv4Key                                                       = "ipv4"
+	networkManagerDbusIPv6Key                                                       = "ipv6"
+	networkManagerDbusDNSKey                                                        = "dns"
+	networkManagerDbusDNSSearchKey                                                  = "dns-search"
+	networkManagerDbusDNSPriorityKey                                                = "dns-priority"
+
+	// dns priority doc https://wiki.gnome.org/Projects/NetworkManager/DNS
+	networkManagerDbusPrimaryDNSPriority       int32 = -500
+	networkManagerDbusWithMatchDomainPriority  int32 = 0
+	networkManagerDbusSearchDomainOnlyPriority int32 = 50
+	supportedNetworkManagerVersionConstraint         = ">= 1.16, < 1.28"
+)
+
+type networkManagerDbusConfigurator struct {
+	dbusLinkObject dbus.ObjectPath
+	routingAll     bool
+}
+
+// the types below are based on dbus specification, each field is mapped to a dbus type
+// see https://dbus.freedesktop.org/doc/dbus-specification.html#basic-types for more details on dbus types
+// see https://networkmanager.dev/docs/api/latest/gdbus-org.freedesktop.NetworkManager.Device.html on Network Manager input types
+
+// networkManagerConnSettings maps to a (a{sa{sv}}) dbus output from GetAppliedConnection and input for Reapply methods
+type networkManagerConnSettings map[string]map[string]dbus.Variant
+
+// networkManagerConfigVersion maps to a (t) dbus output from GetAppliedConnection and input for Reapply methods
+type networkManagerConfigVersion uint64
+
+// networkManagerConfigBehavior maps to a (u) dbus input for GetAppliedConnection and Reapply methods
+type networkManagerConfigBehavior uint32
+
+// cleanDeprecatedSettings cleans deprecated settings that still returned by
+// the GetAppliedConnection methods but can't be reApplied
+func (s networkManagerConnSettings) cleanDeprecatedSettings() {
+	for _, key := range []string{"addresses", "routes"} {
+		delete(s[networkManagerDbusIPv4Key], key)
+		delete(s[networkManagerDbusIPv6Key], key)
+	}
+}
+
+func newNetworkManagerDbusConfigurator(wgInterface *iface.WGIface) (hostManager, error) {
+	obj, closeConn, err := getDbusObject(networkManagerDest, networkManagerDbusObjectNode)
+	if err != nil {
+		return nil, err
+	}
+	defer closeConn()
+	var s string
+	err = obj.Call(networkManagerDbusGetDeviceByIPIfaceMethod, dbusDefaultFlag, wgInterface.GetName()).Store(&s)
+	if err != nil {
+		return nil, err
+	}
+
+	log.Debugf("got network manager dbus Link Object: %s from net interface %s", s, wgInterface.GetName())
+
+	return &networkManagerDbusConfigurator{
+		dbusLinkObject: dbus.ObjectPath(s),
+	}, nil
+}
+
+func (n *networkManagerDbusConfigurator) applyDNSConfig(config hostDNSConfig) error {
+	connSettings, configVersion, err := n.getAppliedConnectionSettings()
+	if err != nil {
+		return fmt.Errorf("got an error while retrieving the applied connection settings, error: %s", err)
+	}
+
+	connSettings.cleanDeprecatedSettings()
+
+	dnsIP := netip.MustParseAddr(config.serverIP)
+	convDNSIP := binary.LittleEndian.Uint32(dnsIP.AsSlice())
+	connSettings[networkManagerDbusIPv4Key][networkManagerDbusDNSKey] = dbus.MakeVariant([]uint32{convDNSIP})
+	var (
+		searchDomains []string
+		matchDomains  []string
+	)
+	for _, dConf := range config.domains {
+		if dConf.matchOnly {
+			matchDomains = append(matchDomains, "~."+dns.Fqdn(dConf.domain))
+			continue
+		}
+		searchDomains = append(searchDomains, dns.Fqdn(dConf.domain))
+	}
+
+	newDomainList := append(searchDomains, matchDomains...)
+
+	priority := networkManagerDbusSearchDomainOnlyPriority
+	switch {
+	case config.routeAll:
+		priority = networkManagerDbusPrimaryDNSPriority
+		newDomainList = append(newDomainList, "~.")
+		if !n.routingAll {
+			log.Infof("configured %s:%d as main DNS forwarder for this peer", config.serverIP, config.serverPort)
+		}
+	case len(matchDomains) > 0:
+		priority = networkManagerDbusWithMatchDomainPriority
+	}
+
+	if priority != networkManagerDbusPrimaryDNSPriority && n.routingAll {
+		log.Infof("removing %s:%d as main DNS forwarder for this peer", config.serverIP, config.serverPort)
+		n.routingAll = false
+	}
+
+	connSettings[networkManagerDbusIPv4Key][networkManagerDbusDNSPriorityKey] = dbus.MakeVariant(priority)
+	connSettings[networkManagerDbusIPv4Key][networkManagerDbusDNSSearchKey] = dbus.MakeVariant(newDomainList)
+
+	log.Infof("adding %d search domains and %d match domains. Search list: %s , Match list: %s", len(searchDomains), len(matchDomains), searchDomains, matchDomains)
+	err = n.reApplyConnectionSettings(connSettings, configVersion)
+	if err != nil {
+		return fmt.Errorf("got an error while reapplying the connection with new settings, error: %s", err)
+	}
+	return nil
+}
+
+func (n *networkManagerDbusConfigurator) restoreHostDNS() error {
+	// once the interface is gone network manager cleans all config associated with it
+	return n.deleteConnectionSettings()
+}
+
+func (n *networkManagerDbusConfigurator) getAppliedConnectionSettings() (networkManagerConnSettings, networkManagerConfigVersion, error) {
+	obj, closeConn, err := getDbusObject(networkManagerDest, n.dbusLinkObject)
+	if err != nil {
+		return nil, 0, fmt.Errorf("got error while attempting to retrieve the applied connection settings, err: %s", err)
+	}
+	defer closeConn()
+
+	ctx, cancel := context.WithTimeout(context.TODO(), 5*time.Second)
+	defer cancel()
+
+	var (
+		connSettings  networkManagerConnSettings
+		configVersion networkManagerConfigVersion
+	)
+
+	err = obj.CallWithContext(ctx, networkManagerDbusDeviceGetAppliedConnectionMethod, dbusDefaultFlag,
+		networkManagerDbusDefaultBehaviorFlag).Store(&connSettings, &configVersion)
+	if err != nil {
+		return nil, 0, fmt.Errorf("got error while calling GetAppliedConnection method with context, err: %s", err)
+	}
+
+	return connSettings, configVersion, nil
+}
+
+func (n *networkManagerDbusConfigurator) reApplyConnectionSettings(connSettings networkManagerConnSettings, configVersion networkManagerConfigVersion) error {
+	obj, closeConn, err := getDbusObject(networkManagerDest, n.dbusLinkObject)
+	if err != nil {
+		return fmt.Errorf("got error while attempting to retrieve the applied connection settings, err: %s", err)
+	}
+	defer closeConn()
+
+	ctx, cancel := context.WithTimeout(context.TODO(), 5*time.Second)
+	defer cancel()
+
+	err = obj.CallWithContext(ctx, networkManagerDbusDeviceReapplyMethod, dbusDefaultFlag,
+		connSettings, configVersion, networkManagerDbusDefaultBehaviorFlag).Store()
+	if err != nil {
+		return fmt.Errorf("got error while calling ReApply method with context, err: %s", err)
+	}
+
+	return nil
+}
+
+func (n *networkManagerDbusConfigurator) deleteConnectionSettings() error {
+	obj, closeConn, err := getDbusObject(networkManagerDest, n.dbusLinkObject)
+	if err != nil {
+		return fmt.Errorf("got error while attempting to retrieve the applied connection settings, err: %s", err)
+	}
+	defer closeConn()
+
+	ctx, cancel := context.WithTimeout(context.TODO(), 5*time.Second)
+	defer cancel()
+
+	err = obj.CallWithContext(ctx, networkManagerDbusDeviceDeleteMethod, dbusDefaultFlag).Store()
+	if err != nil {
+		return fmt.Errorf("got error while calling delete method with context, err: %s", err)
+	}
+
+	return nil
+}
+
+func isNetworkManagerSupported() bool {
+	return isNetworkManagerSupportedVersion() && isNetworkManagerSupportedMode()
+}
+
+func isNetworkManagerSupportedMode() bool {
+	var mode string
+	err := getNetworkManagerDNSProperty(networkManagerDbusDNSManagerModeProperty, &mode)
+	if err != nil {
+		log.Error(err)
+		return false
+	}
+	switch mode {
+	case "dnsmasq", "unbound", "systemd-resolved":
+		return true
+	default:
+		var rcManager string
+		err = getNetworkManagerDNSProperty(networkManagerDbusDNSManagerRcManagerProperty, &rcManager)
+		if err != nil {
+			log.Error(err)
+			return false
+		}
+		if rcManager == "unmanaged" {
+			return false
+		}
+	}
+	return true
+}
+
+func getNetworkManagerDNSProperty(property string, store any) error {
+	obj, closeConn, err := getDbusObject(networkManagerDest, networkManagerDbusDNSManagerObjectNode)
+	if err != nil {
+		return fmt.Errorf("got error while attempting to retrieve the network manager dns manager object, error: %s", err)
+	}
+	defer closeConn()
+
+	v, e := obj.GetProperty(property)
+	if e != nil {
+		return fmt.Errorf("got an error getting property %s: %v", property, e)
+	}
+
+	return v.Store(store)
+}
+
+func isNetworkManagerSupportedVersion() bool {
+	obj, closeConn, err := getDbusObject(networkManagerDest, networkManagerDbusObjectNode)
+	if err != nil {
+		log.Errorf("got error while attempting to get the network manager object, err: %s", err)
+		return false
+	}
+
+	defer closeConn()
+
+	value, err := obj.GetProperty(networkManagerDbusVersionProperty)
+	if err != nil {
+		log.Errorf("unable to retrieve network manager mode, got error: %s", err)
+		return false
+	}
+	versionValue, err := parseVersion(value.Value().(string))
+	if err != nil {
+		return false
+	}
+
+	constraints, err := version.NewConstraint(supportedNetworkManagerVersionConstraint)
+	if err != nil {
+		return false
+	}
+
+	return constraints.Check(versionValue)
+}
+
+func parseVersion(inputVersion string) (*version.Version, error) {
+	reg, err := regexp.Compile(version.SemverRegexpRaw)
+	if err != nil {
+		return nil, err
+	}
+
+	if inputVersion == "" || !reg.MatchString(inputVersion) {
+		return nil, fmt.Errorf("couldn't parse the provided version: Not SemVer")
+	}
+
+	verObj, err := version.NewVersion(inputVersion)
+	if err != nil {
+		return nil, err
+	}
+
+	return verObj, nil
+}

client/internal/dns/server.go

@@ -5,14 +5,19 @@ import (
 	"fmt"
 	"github.com/miekg/dns"
 	nbdns "github.com/netbirdio/netbird/dns"
+	"github.com/netbirdio/netbird/iface"
 	log "github.com/sirupsen/logrus"
+	"net"
+	"net/netip"
+	"runtime"
 	"sync"
 	"time"
 )
 
 const (
-	port      = 5053
-	defaultIP = "0.0.0.0"
+	port       = 53
+	customPort = 5053
+	defaultIP  = "127.0.0.1"
 )
 
 // Server is a dns server interface
@@ -31,8 +36,12 @@ type DefaultServer struct {
 	dnsMux            *dns.ServeMux
 	dnsMuxMap         registrationMap
 	localResolver     *localResolver
+	wgInterface       *iface.WGIface
+	hostManager       hostManager
 	updateSerial      uint64
 	listenerIsRunning bool
+	runtimePort       int
+	runtimeIP         string
 }
 
 type registrationMap map[string]struct{}
@@ -43,11 +52,15 @@ type muxUpdate struct {
 }
 
 // NewDefaultServer returns a new dns server
-func NewDefaultServer(ctx context.Context) *DefaultServer {
+func NewDefaultServer(ctx context.Context, wgInterface *iface.WGIface) (*DefaultServer, error) {
 	mux := dns.NewServeMux()
+	listenIP := defaultIP
+	if runtime.GOOS != "darwin" && wgInterface != nil {
+		listenIP = wgInterface.GetAddress().IP.String()
+	}
 
 	dnsServer := &dns.Server{
-		Addr:    fmt.Sprintf("%s:%d", defaultIP, port),
+		Addr:    fmt.Sprintf("%s:%d", listenIP, port),
 		Net:     "udp",
 		Handler: mux,
 		UDPSize: 65535,
@@ -55,7 +68,7 @@ func NewDefaultServer(ctx context.Context) *DefaultServer {
 
 	ctx, stop := context.WithCancel(ctx)
 
-	return &DefaultServer{
+	defaultServer := &DefaultServer{
 		ctx:       ctx,
 		stop:      stop,
 		server:    dnsServer,
@@ -64,18 +77,44 @@ func NewDefaultServer(ctx context.Context) *DefaultServer {
 		localResolver: &localResolver{
 			registeredMap: make(registrationMap),
 		},
+		wgInterface: wgInterface,
+		runtimePort: port,
+		runtimeIP:   listenIP,
 	}
+
+	hostmanager, err := newHostManager(wgInterface)
+	if err != nil {
+		return nil, err
+	}
+	defaultServer.hostManager = hostmanager
+	return defaultServer, err
 }
 
 // Start runs the listener in a go routine
 func (s *DefaultServer) Start() {
-	log.Debugf("starting dns on %s:%d", defaultIP, port)
+	s.runtimePort = port
+	udpAddr := net.UDPAddrFromAddrPort(netip.MustParseAddrPort(s.server.Addr))
+	probeListener, err := net.ListenUDP("udp", udpAddr)
+	if err != nil {
+		log.Warnf("using a custom port for dns server")
+		s.runtimePort = customPort
+		s.server.Addr = fmt.Sprintf("%s:%d", s.runtimeIP, customPort)
+	} else {
+		err = probeListener.Close()
+		if err != nil {
+			log.Errorf("got an error closing the probe listener, error: %s", err)
+		}
+	}
+
+	log.Debugf("starting dns on %s", s.server.Addr)
+
 	go func() {
 		s.setListenerStatus(true)
 		defer s.setListenerStatus(false)
-		err := s.server.ListenAndServe()
+
+		err = s.server.ListenAndServe()
 		if err != nil {
-			log.Errorf("dns server returned an error: %v", err)
+			log.Errorf("dns server running with %d port returned an error: %v. Will not retry", s.runtimePort, err)
 		}
 	}()
 }
@@ -86,9 +125,16 @@ func (s *DefaultServer) setListenerStatus(running bool) {
 
 // Stop stops the server
 func (s *DefaultServer) Stop() {
+	s.mux.Lock()
+	defer s.mux.Unlock()
 	s.stop()
 
-	err := s.stopListener()
+	err := s.hostManager.restoreHostDNS()
+	if err != nil {
+		log.Error(err)
+	}
+
+	err = s.stopListener()
 	if err != nil {
 		log.Error(err)
 	}
@@ -148,6 +194,11 @@ func (s *DefaultServer) UpdateDNSServer(serial uint64, update nbdns.Config) erro
 		s.updateMux(muxUpdates)
 		s.updateLocalResolver(localRecords)
 
+		err = s.hostManager.applyDNSConfig(dnsConfigToHostDNSConfig(update, s.runtimeIP, s.runtimePort))
+		if err != nil {
+			log.Error(err)
+		}
+
 		s.updateSerial = serial
 
 		return nil
@@ -170,7 +221,12 @@ func (s *DefaultServer) buildLocalHandlerUpdate(customZones []nbdns.CustomZone)
 		})
 
 		for _, record := range customZone.Records {
-			localRecords[record.Name] = record
+			var class uint16 = dns.ClassINET
+			if record.Class != nbdns.DefaultClass {
+				return nil, nil, fmt.Errorf("received an invalid class type: %s", record.Class)
+			}
+			key := buildRecordKey(record.Name, class, uint16(record.Type))
+			localRecords[key] = record
 		}
 	}
 	return muxUpdates, localRecords, nil

client/internal/dns/server_test.go

@@ -3,6 +3,7 @@ package dns
 import (
 	"context"
 	"fmt"
+	"github.com/miekg/dns"
 	nbdns "github.com/netbirdio/netbird/dns"
 	"net"
 	"net/netip"
@@ -74,12 +75,12 @@ func TestUpdateDNSServer(t *testing.T) {
 				},
 			},
 			expectedUpstreamMap: registrationMap{"netbird.io": struct{}{}, "netbird.cloud": struct{}{}, nbdns.RootZone: struct{}{}},
-			expectedLocalMap:    registrationMap{zoneRecords[0].Name: struct{}{}},
+			expectedLocalMap:    registrationMap{buildRecordKey(zoneRecords[0].Name, 1, 1): struct{}{}},
 		},
 		{
 			name:            "New Config Should Succeed",
 			initLocalMap:    registrationMap{"netbird.cloud": struct{}{}},
-			initUpstreamMap: registrationMap{zoneRecords[0].Name: struct{}{}},
+			initUpstreamMap: registrationMap{buildRecordKey(zoneRecords[0].Name, 1, 1): struct{}{}},
 			initSerial:      0,
 			inputSerial:     1,
 			inputUpdate: nbdns.Config{
@@ -98,7 +99,7 @@ func TestUpdateDNSServer(t *testing.T) {
 				},
 			},
 			expectedUpstreamMap: registrationMap{"netbird.io": struct{}{}, "netbird.cloud": struct{}{}},
-			expectedLocalMap:    registrationMap{zoneRecords[0].Name: struct{}{}},
+			expectedLocalMap:    registrationMap{buildRecordKey(zoneRecords[0].Name, 1, 1): struct{}{}},
 		},
 		{
 			name:            "Smaller Config Serial Should Be Skipped",
@@ -188,12 +189,14 @@ func TestUpdateDNSServer(t *testing.T) {
 
 	for _, testCase := range testCases {
 		t.Run(testCase.name, func(t *testing.T) {
-			ctx := context.Background()
-			dnsServer := NewDefaultServer(ctx)
+			dnsServer := getDefaultServerWithNoHostManager("127.0.0.1")
+
+			dnsServer.hostManager = newNoopHostMocker()
 
 			dnsServer.dnsMuxMap = testCase.initUpstreamMap
 			dnsServer.localResolver.registeredMap = testCase.initLocalMap
 			dnsServer.updateSerial = testCase.initSerial
+			// pretend we are running
 			dnsServer.listenerIsRunning = true
 
 			err := dnsServer.UpdateDNSServer(testCase.inputSerial, testCase.inputUpdate)
@@ -230,13 +233,15 @@ func TestUpdateDNSServer(t *testing.T) {
 }
 
 func TestDNSServerStartStop(t *testing.T) {
-	ctx := context.Background()
-	dnsServer := NewDefaultServer(ctx)
+	dnsServer := getDefaultServerWithNoHostManager("127.0.0.1")
+
 	if runtime.GOOS == "windows" && os.Getenv("CI") == "true" {
 		// todo review why this test is not working only on github actions workflows
 		t.Skip("skipping test in Windows CI workflows.")
 	}
 
+	dnsServer.hostManager = newNoopHostMocker()
+
 	dnsServer.Start()
 
 	err := dnsServer.localResolver.registerRecord(zoneRecords[0])
@@ -276,10 +281,40 @@ func TestDNSServerStartStop(t *testing.T) {
 	}
 
 	dnsServer.Stop()
-	ctx, cancel := context.WithTimeout(ctx, time.Second*1)
+	ctx, cancel := context.WithTimeout(context.TODO(), time.Second*1)
 	defer cancel()
 	_, err = resolver.LookupHost(ctx, zoneRecords[0].Name)
 	if err == nil {
 		t.Fatalf("we should encounter an error when querying a stopped server")
 	}
 }
+
+func getDefaultServerWithNoHostManager(ip string) *DefaultServer {
+	mux := dns.NewServeMux()
+	listenIP := defaultIP
+	if ip != "" {
+		listenIP = ip
+	}
+
+	dnsServer := &dns.Server{
+		Addr:    fmt.Sprintf("%s:%d", ip, port),
+		Net:     "udp",
+		Handler: mux,
+		UDPSize: 65535,
+	}
+
+	ctx, stop := context.WithCancel(context.TODO())
+
+	return &DefaultServer{
+		ctx:       ctx,
+		stop:      stop,
+		server:    dnsServer,
+		dnsMux:    mux,
+		dnsMuxMap: make(registrationMap),
+		localResolver: &localResolver{
+			registeredMap: make(registrationMap),
+		},
+		runtimePort: port,
+		runtimeIP:   listenIP,
+	}
+}

client/internal/dns/systemd_linux.go

@@ -0,0 +1,185 @@
+package dns
+
+import (
+	"context"
+	"fmt"
+	"github.com/godbus/dbus/v5"
+	"github.com/miekg/dns"
+	nbdns "github.com/netbirdio/netbird/dns"
+	"github.com/netbirdio/netbird/iface"
+	log "github.com/sirupsen/logrus"
+	"golang.org/x/sys/unix"
+	"net"
+	"net/netip"
+	"time"
+)
+
+const (
+	systemdDbusManagerInterface            = "org.freedesktop.resolve1.Manager"
+	systemdResolvedDest                    = "org.freedesktop.resolve1"
+	systemdDbusObjectNode                  = "/org/freedesktop/resolve1"
+	systemdDbusGetLinkMethod               = systemdDbusManagerInterface + ".GetLink"
+	systemdDbusFlushCachesMethod           = systemdDbusManagerInterface + ".FlushCaches"
+	systemdDbusLinkInterface               = "org.freedesktop.resolve1.Link"
+	systemdDbusRevertMethodSuffix          = systemdDbusLinkInterface + ".Revert"
+	systemdDbusSetDNSMethodSuffix          = systemdDbusLinkInterface + ".SetDNS"
+	systemdDbusSetDefaultRouteMethodSuffix = systemdDbusLinkInterface + ".SetDefaultRoute"
+	systemdDbusSetDomainsMethodSuffix      = systemdDbusLinkInterface + ".SetDomains"
+)
+
+type systemdDbusConfigurator struct {
+	dbusLinkObject dbus.ObjectPath
+	routingAll     bool
+}
+
+// the types below are based on dbus specification, each field is mapped to a dbus type
+// see https://dbus.freedesktop.org/doc/dbus-specification.html#basic-types for more details on dbus types
+// see https://www.freedesktop.org/software/systemd/man/org.freedesktop.resolve1.html on resolve1 input types
+// systemdDbusDNSInput maps to a (iay) dbus input for SetDNS method
+type systemdDbusDNSInput struct {
+	Family  int32
+	Address []byte
+}
+
+// systemdDbusLinkDomainsInput maps to a (sb) dbus input for SetDomains method
+type systemdDbusLinkDomainsInput struct {
+	Domain    string
+	MatchOnly bool
+}
+
+func newSystemdDbusConfigurator(wgInterface *iface.WGIface) (hostManager, error) {
+	iface, err := net.InterfaceByName(wgInterface.GetName())
+	if err != nil {
+		return nil, err
+	}
+
+	obj, closeConn, err := getDbusObject(systemdResolvedDest, systemdDbusObjectNode)
+	if err != nil {
+		return nil, err
+	}
+	defer closeConn()
+
+	var s string
+	err = obj.Call(systemdDbusGetLinkMethod, dbusDefaultFlag, iface.Index).Store(&s)
+	if err != nil {
+		return nil, err
+	}
+
+	log.Debugf("got dbus Link interface: %s from net interface %s and index %d", s, iface.Name, iface.Index)
+
+	return &systemdDbusConfigurator{
+		dbusLinkObject: dbus.ObjectPath(s),
+	}, nil
+}
+
+func (s *systemdDbusConfigurator) applyDNSConfig(config hostDNSConfig) error {
+	parsedIP := netip.MustParseAddr(config.serverIP).As4()
+	defaultLinkInput := systemdDbusDNSInput{
+		Family:  unix.AF_INET,
+		Address: parsedIP[:],
+	}
+	err := s.callLinkMethod(systemdDbusSetDNSMethodSuffix, []systemdDbusDNSInput{defaultLinkInput})
+	if err != nil {
+		return fmt.Errorf("setting the interface DNS server %s:%d failed with error: %s", config.serverIP, config.serverPort, err)
+	}
+
+	var (
+		searchDomains []string
+		matchDomains  []string
+		domainsInput  []systemdDbusLinkDomainsInput
+	)
+	for _, dConf := range config.domains {
+		domainsInput = append(domainsInput, systemdDbusLinkDomainsInput{
+			Domain:    dns.Fqdn(dConf.domain),
+			MatchOnly: dConf.matchOnly,
+		})
+
+		if dConf.matchOnly {
+			matchDomains = append(matchDomains, dConf.domain)
+			continue
+		}
+		searchDomains = append(searchDomains, dConf.domain)
+	}
+
+	if config.routeAll {
+		log.Infof("configured %s:%d as main DNS forwarder for this peer", config.serverIP, config.serverPort)
+		err = s.callLinkMethod(systemdDbusSetDefaultRouteMethodSuffix, true)
+		if err != nil {
+			return fmt.Errorf("setting link as default dns router, failed with error: %s", err)
+		}
+		domainsInput = append(domainsInput, systemdDbusLinkDomainsInput{
+			Domain:    nbdns.RootZone,
+			MatchOnly: true,
+		})
+		s.routingAll = true
+	} else if s.routingAll {
+		log.Infof("removing %s:%d as main DNS forwarder for this peer", config.serverIP, config.serverPort)
+	}
+
+	log.Infof("adding %d search domains and %d match domains. Search list: %s , Match list: %s", len(searchDomains), len(matchDomains), searchDomains, matchDomains)
+	err = s.setDomainsForInterface(domainsInput)
+	if err != nil {
+		log.Error(err)
+	}
+	return nil
+}
+
+func (s *systemdDbusConfigurator) setDomainsForInterface(domainsInput []systemdDbusLinkDomainsInput) error {
+	err := s.callLinkMethod(systemdDbusSetDomainsMethodSuffix, domainsInput)
+	if err != nil {
+		return fmt.Errorf("setting domains configuration failed with error: %s", err)
+	}
+	return s.flushCaches()
+}
+
+func (s *systemdDbusConfigurator) restoreHostDNS() error {
+	log.Infof("reverting link settings and flushing cache")
+	if !isDbusListenerRunning(systemdResolvedDest, s.dbusLinkObject) {
+		return nil
+	}
+	err := s.callLinkMethod(systemdDbusRevertMethodSuffix, nil)
+	if err != nil {
+		return fmt.Errorf("unable to revert link configuration, got error: %s", err)
+	}
+	return s.flushCaches()
+}
+
+func (s *systemdDbusConfigurator) flushCaches() error {
+	obj, closeConn, err := getDbusObject(systemdResolvedDest, systemdDbusObjectNode)
+	if err != nil {
+		return fmt.Errorf("got error while attempting to retrieve the object %s, err: %s", systemdDbusObjectNode, err)
+	}
+	defer closeConn()
+	ctx, cancel := context.WithTimeout(context.TODO(), 5*time.Second)
+	defer cancel()
+
+	err = obj.CallWithContext(ctx, systemdDbusFlushCachesMethod, dbusDefaultFlag).Store()
+	if err != nil {
+		return fmt.Errorf("got error while calling the FlushCaches method with context, err: %s", err)
+	}
+
+	return nil
+}
+
+func (s *systemdDbusConfigurator) callLinkMethod(method string, value any) error {
+	obj, closeConn, err := getDbusObject(systemdResolvedDest, s.dbusLinkObject)
+	if err != nil {
+		return fmt.Errorf("got error while attempting to retrieve the object, err: %s", err)
+	}
+	defer closeConn()
+
+	ctx, cancel := context.WithTimeout(context.TODO(), 5*time.Second)
+	defer cancel()
+
+	if value != nil {
+		err = obj.CallWithContext(ctx, method, dbusDefaultFlag, value).Store()
+	} else {
+		err = obj.CallWithContext(ctx, method, dbusDefaultFlag).Store()
+	}
+
+	if err != nil {
+		return fmt.Errorf("got error while calling command with context, err: %s", err)
+	}
+
+	return nil
+}

client/internal/dns/upstream.go

@@ -21,7 +21,7 @@ type upstreamResolver struct {
 // ServeDNS handles a DNS request
 func (u *upstreamResolver) ServeDNS(w dns.ResponseWriter, r *dns.Msg) {
 
-	log.Tracef("received an upstream question: %#v", r.Question[0])
+	log.Debugf("received an upstream question: %#v", r.Question[0])
 
 	select {
 	case <-u.parentCTX.Done():

client/internal/engine.go

@@ -3,12 +3,6 @@ package internal
 import (
 	"context"
 	"fmt"
-	"github.com/netbirdio/netbird/client/internal/dns"
-	"github.com/netbirdio/netbird/client/internal/routemanager"
-	nbssh "github.com/netbirdio/netbird/client/ssh"
-	nbstatus "github.com/netbirdio/netbird/client/status"
-	nbdns "github.com/netbirdio/netbird/dns"
-	"github.com/netbirdio/netbird/route"
 	"math/rand"
 	"net"
 	"net/netip"
@@ -18,6 +12,13 @@ import (
 	"sync"
 	"time"
 
+	"github.com/netbirdio/netbird/client/internal/dns"
+	"github.com/netbirdio/netbird/client/internal/routemanager"
+	nbssh "github.com/netbirdio/netbird/client/ssh"
+	nbstatus "github.com/netbirdio/netbird/client/status"
+	nbdns "github.com/netbirdio/netbird/dns"
+	"github.com/netbirdio/netbird/route"
+
 	"github.com/netbirdio/netbird/client/internal/peer"
 	"github.com/netbirdio/netbird/client/internal/proxy"
 	"github.com/netbirdio/netbird/iface"
@@ -54,7 +55,8 @@ type EngineConfig struct {
 	WgPrivateKey wgtypes.Key
 
 	// IFaceBlackList is a list of network interfaces to ignore when discovering connection candidates (ICE related)
-	IFaceBlackList []string
+	IFaceBlackList       []string
+	DisableIPv6Discovery bool
 
 	PreSharedKey *wgtypes.Key
 
@@ -66,6 +68,8 @@ type EngineConfig struct {
 
 	// SSHKey is a private SSH key in a PEM format
 	SSHKey []byte
+
+	NATExternalIPs []string
 }
 
 // Engine is a mechanism responsible for reacting on Signal and Management stream events and managing connections to the remote peers.
@@ -135,7 +139,6 @@ func NewEngine(
 		networkSerial:  0,
 		sshServerFunc:  nbssh.DefaultSSHServer,
 		statusRecorder: statusRecorder,
-		dnsServer:      dns.NewDefaultServer(ctx),
 	}
 }
 
@@ -223,13 +226,18 @@ func (e *Engine) Start() error {
 		return err
 	}
 
-	e.udpMuxConn, err = net.ListenUDP("udp4", &net.UDPAddr{Port: e.config.UDPMuxPort})
+	networkName := "udp"
+	if e.config.DisableIPv6Discovery {
+		networkName = "udp4"
+	}
+
+	e.udpMuxConn, err = net.ListenUDP(networkName, &net.UDPAddr{Port: e.config.UDPMuxPort})
 	if err != nil {
 		log.Errorf("failed listening on UDP port %d: [%s]", e.config.UDPMuxPort, err.Error())
 		return err
 	}
 
-	e.udpMuxConnSrflx, err = net.ListenUDP("udp4", &net.UDPAddr{Port: e.config.UDPMuxSrflxPort})
+	e.udpMuxConnSrflx, err = net.ListenUDP(networkName, &net.UDPAddr{Port: e.config.UDPMuxSrflxPort})
 	if err != nil {
 		log.Errorf("failed listening on UDP port %d: [%s]", e.config.UDPMuxSrflxPort, err.Error())
 		return err
@@ -252,6 +260,14 @@ func (e *Engine) Start() error {
 
 	e.routeManager = routemanager.NewManager(e.ctx, e.config.WgPrivateKey.PublicKey().String(), e.wgInterface, e.statusRecorder)
 
+	if e.dnsServer == nil {
+		dnsServer, err := dns.NewDefaultServer(e.ctx, e.wgInterface)
+		if err != nil {
+			return err
+		}
+		e.dnsServer = dnsServer
+	}
+
 	e.receiveSignalEvents()
 	e.receiveManagementEvents()
 
@@ -816,15 +832,17 @@ func (e Engine) createPeerConn(pubKey string, allowedIPs string) (*peer.Conn, er
 	// randomize connection timeout
 	timeout := time.Duration(rand.Intn(PeerConnectionTimeoutMax-PeerConnectionTimeoutMin)+PeerConnectionTimeoutMin) * time.Millisecond
 	config := peer.ConnConfig{
-		Key:                pubKey,
-		LocalKey:           e.config.WgPrivateKey.PublicKey().String(),
-		StunTurn:           stunTurn,
-		InterfaceBlackList: e.config.IFaceBlackList,
-		Timeout:            timeout,
-		UDPMux:             e.udpMux,
-		UDPMuxSrflx:        e.udpMuxSrflx,
-		ProxyConfig:        proxyConfig,
-		LocalWgPort:        e.config.WgPort,
+		Key:                  pubKey,
+		LocalKey:             e.config.WgPrivateKey.PublicKey().String(),
+		StunTurn:             stunTurn,
+		InterfaceBlackList:   e.config.IFaceBlackList,
+		DisableIPv6Discovery: e.config.DisableIPv6Discovery,
+		Timeout:              timeout,
+		UDPMux:               e.udpMux,
+		UDPMuxSrflx:          e.udpMuxSrflx,
+		ProxyConfig:          proxyConfig,
+		LocalWgPort:          e.config.WgPort,
+		NATExternalIPs:		e.parseNATExternalIPMappings(),
 	}
 
 	peerConn, err := peer.NewConn(config, e.statusRecorder)
@@ -918,3 +936,77 @@ func (e *Engine) receiveSignalEvents() {
 
 	e.signal.WaitStreamConnected()
 }
+
+func (e* Engine) parseNATExternalIPMappings() []string {
+	var mappedIPs []string
+	var ignoredIFaces = make(map[string]interface{})
+	for _, iFace := range(e.config.IFaceBlackList) {
+		ignoredIFaces[iFace] = nil
+	}
+	for _, mapping := range e.config.NATExternalIPs {
+		var external, internal string
+		var externalIP, internalIP net.IP
+		var err error
+		split := strings.Split(mapping, "/")
+		if len(split) > 2 {
+			log.Warnf("ignoring invalid external mapping '%s', too many delimiters", mapping)
+			break
+		}
+		if len(split) > 1 {
+			internal = split[1]
+			internalIP = net.ParseIP(internal)
+			if internalIP == nil {
+				// not a properly formatted IP address, maybe it's interface name?
+				if _, present := ignoredIFaces[internal]; present {
+					log.Warnf("internal interface '%s' in blacklist, ignoring external mapping '%s'", internal, mapping)
+					break
+				}
+				internalIP, err = findIPFromInterfaceName(internal)
+				if err != nil {
+					log.Warnf("error finding interface IP for interface '%s', ignoring external mapping '%s': %v", internal, mapping, err)
+					break
+				}
+			}
+		}
+		external = split[0]
+		externalIP = net.ParseIP(external)
+		if externalIP == nil {
+			log.Warnf("invalid external IP, ignoring external IP mapping '%s'", mapping)
+			break
+		}
+		if externalIP != nil {
+			mappedIP := externalIP.String()
+			if internalIP != nil {
+				mappedIP = mappedIP + "/" + internalIP.String()
+			}
+			mappedIPs = append(mappedIPs, mappedIP)
+			log.Infof("parsed external IP mapping of '%s' as '%s'", mapping, mappedIP)
+		}
+	}
+	if len(mappedIPs) != len(e.config.NATExternalIPs) {
+		log.Warnf("one or more external IP mappings failed to parse, ignoring all mappings")
+		return nil
+	}
+	return mappedIPs
+}
+
+func findIPFromInterfaceName(ifaceName string) (net.IP, error) {
+    iface, err := net.InterfaceByName(ifaceName)
+	if err != nil {
+        return nil, err
+    }
+    return findIPFromInterface(iface)
+}
+
+func findIPFromInterface(iface *net.Interface) (net.IP, error) {
+    ifaceAddrs, err := iface.Addrs()
+	if err != nil {
+        return nil, err
+    }
+    for _, addr := range ifaceAddrs {
+        if ipv4Addr := addr.(*net.IPNet).IP.To4(); ipv4Addr != nil {
+			return ipv4Addr, nil
+        }
+    }
+	return nil, fmt.Errorf("interface %s don't have an ipv4 address", iface.Name)
+}

client/internal/engine_test.go

@@ -202,6 +202,9 @@ func TestEngine_UpdateNetworkMap(t *testing.T) {
 	}, nbstatus.NewRecorder())
 	engine.wgInterface, err = iface.NewWGIFace("utun102", "100.64.0.1/24", iface.DefaultMTU)
 	engine.routeManager = routemanager.NewManager(ctx, key.PublicKey().String(), engine.wgInterface, engine.statusRecorder)
+	engine.dnsServer = &dns.MockServer{
+		UpdateDNSServerFunc: func(serial uint64, update nbdns.Config) error { return nil },
+	}
 
 	type testCase struct {
 		name       string
@@ -551,6 +554,7 @@ func TestEngine_UpdateNetworkMapWithRoutes(t *testing.T) {
 			}
 
 			engine.routeManager = mockRouteManager
+			engine.dnsServer = &dns.MockServer{}
 
 			defer func() {
 				exitErr := engine.Stop()
@@ -797,6 +801,7 @@ func TestEngine_MultiplePeers(t *testing.T) {
 				t.Errorf("unable to create the engine for peer %d with error %v", j, err)
 				return
 			}
+			engine.dnsServer = &dns.MockServer{}
 			mu.Lock()
 			defer mu.Unlock()
 			err = engine.Start()

client/internal/peer/conn.go

@@ -2,18 +2,18 @@ package peer
 
 import (
 	"context"
-	nbStatus "github.com/netbirdio/netbird/client/status"
-	"github.com/netbirdio/netbird/client/system"
-	"github.com/netbirdio/netbird/iface"
-	"golang.zx2c4.com/wireguard/wgctrl"
 	"net"
 	"strings"
 	"sync"
 	"time"
 
 	"github.com/netbirdio/netbird/client/internal/proxy"
+	nbStatus "github.com/netbirdio/netbird/client/status"
+	"github.com/netbirdio/netbird/client/system"
+	"github.com/netbirdio/netbird/iface"
 	"github.com/pion/ice/v2"
 	log "github.com/sirupsen/logrus"
+	"golang.zx2c4.com/wireguard/wgctrl"
 )
 
 // ConnConfig is a peer Connection configuration
@@ -29,7 +29,8 @@ type ConnConfig struct {
 
 	// InterfaceBlackList is a list of machine interfaces that should be filtered out by ICE Candidate gathering
 	// (e.g. if eth0 is in the list, host candidate of this interface won't be used)
-	InterfaceBlackList []string
+	InterfaceBlackList   []string
+	DisableIPv6Discovery bool
 
 	Timeout time.Duration
 
@@ -39,6 +40,8 @@ type ConnConfig struct {
 	UDPMuxSrflx ice.UniversalUDPMux
 
 	LocalWgPort int
+
+	NATExternalIPs []string
 }
 
 // OfferAnswer represents a session establishment offer or answer
@@ -143,16 +146,24 @@ func (conn *Conn) reCreateAgent() error {
 
 	failedTimeout := 6 * time.Second
 	var err error
-	conn.agent, err = ice.NewAgent(&ice.AgentConfig{
+	agentConfig := &ice.AgentConfig{
 		MulticastDNSMode: ice.MulticastDNSModeDisabled,
-		NetworkTypes:     []ice.NetworkType{ice.NetworkTypeUDP4},
+		NetworkTypes:     []ice.NetworkType{ice.NetworkTypeUDP4, ice.NetworkTypeUDP6},
 		Urls:             conn.config.StunTurn,
 		CandidateTypes:   []ice.CandidateType{ice.CandidateTypeHost, ice.CandidateTypeServerReflexive, ice.CandidateTypeRelay},
 		FailedTimeout:    &failedTimeout,
 		InterfaceFilter:  interfaceFilter(conn.config.InterfaceBlackList),
 		UDPMux:           conn.config.UDPMux,
 		UDPMuxSrflx:      conn.config.UDPMuxSrflx,
-	})
+		NAT1To1IPs:       conn.config.NATExternalIPs,
+	}
+
+	if conn.config.DisableIPv6Discovery {
+		agentConfig.NetworkTypes = []ice.NetworkType{ice.NetworkTypeUDP4}
+	}
+
+	conn.agent, err = ice.NewAgent(agentConfig)
+
 	if err != nil {
 		return err
 	}
@@ -284,7 +295,7 @@ func (conn *Conn) Open() error {
 		host, _, _ := net.SplitHostPort(remoteConn.LocalAddr().String())
 		rhost, _, _ := net.SplitHostPort(remoteConn.RemoteAddr().String())
 		// direct Wireguard connection
-		log.Infof("directly connected to peer %s [laddr <-> raddr] [%s:%d <-> %s:%d]", conn.config.Key, host, iface.DefaultWgPort, rhost, iface.DefaultWgPort)
+		log.Infof("directly connected to peer %s [laddr <-> raddr] [%s:%d <-> %s:%d]", conn.config.Key, host, conn.config.LocalWgPort, rhost, remoteWgPort)
 	} else {
 		log.Infof("connected to peer %s [laddr <-> raddr] [%s <-> %s]", conn.config.Key, remoteConn.LocalAddr().String(), remoteConn.RemoteAddr().String())
 	}
@@ -448,6 +459,7 @@ func (conn *Conn) SetSignalCandidate(handler func(candidate ice.Candidate) error
 // and then signals them to the remote peer
 func (conn *Conn) onICECandidate(candidate ice.Candidate) {
 	if candidate != nil {
+		// TODO: reported port is incorrect for CandidateTypeHost, makes understanding ICE use via logs confusing as port is ignored
 		log.Debugf("discovered local candidate %s", candidate.String())
 		go func() {
 			err := conn.signalCandidate(candidate)

dns/dns.go

@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"github.com/miekg/dns"
 	"golang.org/x/net/idna"
+	"net"
 	"regexp"
 	"strings"
 )
@@ -60,6 +61,30 @@ func (s SimpleRecord) String() string {
 	return fmt.Sprintf("%s %d %s %s %s", fqdn, s.TTL, s.Class, dns.Type(s.Type).String(), s.RData)
 }
 
+// Len returns the length of the RData field, based on its type
+func (s SimpleRecord) Len() uint16 {
+	emptyString := s.RData == ""
+	switch s.Type {
+	case 1:
+		if emptyString {
+			return 0
+		}
+		return net.IPv4len
+	case 5:
+		if emptyString || s.RData == "." {
+			return 1
+		}
+		return uint16(len(s.RData) + 1)
+	case 28:
+		if emptyString {
+			return 0
+		}
+		return net.IPv6len
+	default:
+		return 0
+	}
+}
+
 // GetParsedDomainLabel returns a domain label with max 59 characters,
 // parsed for old Hosts.txt requirements, and converted to ASCII and lowercase
 func GetParsedDomainLabel(name string) (string, error) {

go.mod

@@ -35,6 +35,7 @@ require (
 	github.com/eko/gocache/v3 v3.1.1
 	github.com/getlantern/systray v1.2.1
 	github.com/gliderlabs/ssh v0.3.4
+	github.com/godbus/dbus/v5 v5.1.0
 	github.com/google/nftables v0.0.0-20220808154552-2eca00135732
 	github.com/hashicorp/go-version v1.6.0
 	github.com/libp2p/go-netroute v0.2.0
@@ -75,7 +76,6 @@ require (
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-redis/redis/v8 v8.11.5 // indirect
 	github.com/go-stack/stack v1.8.0 // indirect
-	github.com/godbus/dbus/v5 v5.0.4 // indirect
 	github.com/goki/freetype v0.0.0-20181231101311-fa8a33aabaff // indirect
 	github.com/google/go-cmp v0.5.9 // indirect
 	github.com/google/gopacket v1.1.19 // indirect

go.sum

@@ -223,8 +223,9 @@ github.com/go-redis/redis/v8 v8.11.5/go.mod h1:gREzHqY1hg6oD9ngVRbLStwAWKhA0FEgq
 github.com/go-stack/stack v1.8.0 h1:5SgMzNM5HxrEjV0ww2lTmX6E2Izsfxas4+YHWRs3Lsk=
 github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
 github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0/go.mod h1:fyg7847qk6SyHyPtNmDHnmrv/HOrqktSC+C9fM+CJOE=
-github.com/godbus/dbus/v5 v5.0.4 h1:9349emZab16e7zQvpmsbtjc18ykshndd8y2PG3sgJbA=
 github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
+github.com/godbus/dbus/v5 v5.1.0 h1:4KLkAxT3aOY8Li4FRJe/KvhoNFFxo0m6fNuFUO8QJUk=
+github.com/godbus/dbus/v5 v5.1.0/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
 github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
 github.com/gogo/protobuf v1.2.2-0.20190723190241-65acae22fc9d/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=

iface/iface.go

@@ -73,13 +73,15 @@ func parseAddress(address string) (WGAddress, error) {
 func (w *WGIface) Close() error {
 	w.mu.Lock()
 	defer w.mu.Unlock()
-
+	if w.Interface == nil {
+		return nil
+	}
 	err := w.Interface.Close()
 	if err != nil {
 		return err
 	}
 
-	if runtime.GOOS == "darwin" {
+	if runtime.GOOS != "windows" {
 		sockPath := "/var/run/wireguard/" + w.Name + ".sock"
 		if _, statErr := os.Stat(sockPath); statErr == nil {
 			statErr = os.Remove(sockPath)

iface/iface_unix.go

@@ -75,3 +75,8 @@ func (w *WGIface) UpdateAddr(newAddr string) error {
 	w.Address = addr
 	return w.assignAddr()
 }
+
+// GetInterfaceGUIDString returns an interface GUID. This is useful on Windows only
+func (w *WGIface) GetInterfaceGUIDString() (string, error) {
+	return "", nil
+}

iface/iface_windows.go

@@ -58,6 +58,20 @@ func (w *WGIface) UpdateAddr(newAddr string) error {
 	return w.assignAddr(luid)
 }
 
+// GetInterfaceGUIDString returns an interface GUID string
+func (w *WGIface) GetInterfaceGUIDString() (string, error) {
+	if w.Interface == nil {
+		return "", fmt.Errorf("interface has not been initialized yet")
+	}
+	windowsDevice := w.Interface.(*driver.Adapter)
+	luid := windowsDevice.LUID()
+	guid, err := luid.GUID()
+	if err != nil {
+		return "", err
+	}
+	return guid.String(), nil
+}
+
 // WireguardModuleIsLoaded check if we can load wireguard mod (linux only)
 func WireguardModuleIsLoaded() bool {
 	return false

management/server/account.go

@@ -91,6 +91,7 @@ type AccountManager interface {
 	UpdateNameServerGroup(accountID, nsGroupID string, operations []NameServerGroupUpdateOperation) (*nbdns.NameServerGroup, error)
 	DeleteNameServerGroup(accountID, nsGroupID string) error
 	ListNameServerGroups(accountID string) ([]*nbdns.NameServerGroup, error)
+	GetDNSDomain() string
 }
 
 type DefaultAccountManager struct {
@@ -901,6 +902,11 @@ func (am *DefaultAccountManager) AccountExists(accountID string) (*bool, error)
 	return &res, nil
 }
 
+// GetDNSDomain returns the configured dnsDomain
+func (am *DefaultAccountManager) GetDNSDomain() string {
+	return am.dnsDomain
+}
+
 // addAllGroup to account object if it doesn't exists
 func addAllGroup(account *Account) {
 	if len(account.Groups) == 0 {

management/server/grpcserver.go

@@ -202,6 +202,11 @@ func (s *GRPCServer) registerPeer(peerKey wgtypes.Key, req *proto.LoginRequest)
 		}
 		claims := jwtclaims.ExtractClaimsWithToken(token, s.config.HttpConfig.AuthAudience)
 		userID = claims.UserId
+		// we need to call this method because if user is new, we will automatically add it to existing or create a new account
+		_, _, err = s.accountManager.GetAccountFromToken(claims)
+		if err != nil {
+			return nil, status.Errorf(codes.Internal, "unable to fetch account with claims, err: %v", err)
+		}
 	} else {
 		log.Debugln("using setup key to register peer")
 		reqSetupKey = req.GetSetupKey()

management/server/http/peers.go

@@ -41,7 +41,8 @@ func (h *Peers) updatePeer(account *server.Account, peer *server.Peer, w http.Re
 		util.WriteError(err, w)
 		return
 	}
-	util.WriteJSONObject(w, toPeerResponse(peer, account))
+	dnsDomain := h.accountManager.GetDNSDomain()
+	util.WriteJSONObject(w, toPeerResponse(peer, account, dnsDomain))
 }
 
 func (h *Peers) deletePeer(accountId string, peer *server.Peer, w http.ResponseWriter, r *http.Request) {
@@ -73,6 +74,8 @@ func (h *Peers) HandlePeer(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	dnsDomain := h.accountManager.GetDNSDomain()
+
 	switch r.Method {
 	case http.MethodDelete:
 		h.deletePeer(account.Id, peer, w, r)
@@ -81,7 +84,7 @@ func (h *Peers) HandlePeer(w http.ResponseWriter, r *http.Request) {
 		h.updatePeer(account, peer, w, r)
 		return
 	case http.MethodGet:
-		util.WriteJSONObject(w, toPeerResponse(peer, account))
+		util.WriteJSONObject(w, toPeerResponse(peer, account, dnsDomain))
 		return
 
 	default:
@@ -106,9 +109,11 @@ func (h *Peers) GetPeers(w http.ResponseWriter, r *http.Request) {
 			return
 		}
 
+		dnsDomain := h.accountManager.GetDNSDomain()
+
 		respBody := []*api.Peer{}
 		for _, peer := range peers {
-			respBody = append(respBody, toPeerResponse(peer, account))
+			respBody = append(respBody, toPeerResponse(peer, account, dnsDomain))
 		}
 		util.WriteJSONObject(w, respBody)
 		return
@@ -117,7 +122,7 @@ func (h *Peers) GetPeers(w http.ResponseWriter, r *http.Request) {
 	}
 }
 
-func toPeerResponse(peer *server.Peer, account *server.Account) *api.Peer {
+func toPeerResponse(peer *server.Peer, account *server.Account, dnsDomain string) *api.Peer {
 	var groupsInfo []api.GroupMinimum
 	groupsChecked := make(map[string]struct{})
 	for _, group := range account.Groups {
@@ -138,6 +143,10 @@ func toPeerResponse(peer *server.Peer, account *server.Account) *api.Peer {
 			}
 		}
 	}
+	fqdn := peer.DNSLabel
+	if dnsDomain != "" {
+		fqdn = peer.DNSLabel + "." + dnsDomain
+	}
 	return &api.Peer{
 		Id:         peer.IP.String(),
 		Name:       peer.Name,
@@ -151,6 +160,6 @@ func toPeerResponse(peer *server.Peer, account *server.Account) *api.Peer {
 		Hostname:   peer.Meta.Hostname,
 		UserId:     &peer.UserID,
 		UiVersion:  &peer.Meta.UIVersion,
-		DnsLabel:   peer.DNSLabel,
+		DnsLabel:   fqdn,
 	}
 }

management/server/mock_server/account_mock.go

@@ -60,6 +60,7 @@ type MockAccountManager struct {
 	ListNameServerGroupsFunc        func(accountID string) ([]*nbdns.NameServerGroup, error)
 	CreateUserFunc                  func(accountID string, key *server.UserInfo) (*server.UserInfo, error)
 	GetAccountFromTokenFunc         func(claims jwtclaims.AuthorizationClaims) (*server.Account, *server.User, error)
+	GetDNSDomainFunc                func() string
 }
 
 // GetUsersFromAccount mock implementation of GetUsersFromAccount from server.AccountManager interface
@@ -477,3 +478,11 @@ func (am *MockAccountManager) GetPeers(accountID, userID string) ([]*server.Peer
 	}
 	return nil, status.Errorf(codes.Unimplemented, "method GetPeersFunc is not implemented")
 }
+
+// GetDNSDomain mocks GetDNSDomain of the AccountManager interface
+func (am *MockAccountManager) GetDNSDomain() string {
+	if am.GetDNSDomainFunc != nil {
+		return am.GetDNSDomainFunc()
+	}
+	return ""
+}

management/server/peer.go

@@ -106,13 +106,29 @@ func (am *DefaultAccountManager) GetPeers(accountID, userID string) ([]*Peer, er
 		return nil, err
 	}
 
-	peers := make([]*Peer, 0, len(account.Peers))
+	peers := make([]*Peer, 0)
+	peersMap := make(map[string]*Peer)
 	for _, peer := range account.Peers {
 		if !user.IsAdmin() && user.Id != peer.UserID {
 			// only display peers that belong to the current user if the current user is not an admin
 			continue
 		}
-		peers = append(peers, peer.Copy())
+		p := peer.Copy()
+		peers = append(peers, p)
+		peersMap[peer.Key] = p
+	}
+
+	// fetch all the peers that have access to the user's peers
+	for _, peer := range peers {
+		aclPeers := am.getPeersByACL(account, peer.Key)
+		for _, p := range aclPeers {
+			peersMap[p.Key] = p
+		}
+	}
+
+	peers = make([]*Peer, 0, len(peersMap))
+	for _, peer := range peersMap {
+		peers = append(peers, peer)
 	}
 
 	return peers, nil