I have a split DNS and I connect to work through Wireguard. However, I only ever want certain domains to be resolved through the office DNS. So I naturally set a search domain, allowing only office.net to be resolved through the office DNS.
However, this will still leak DNS requests, as this interface’s DNS server gets the “default route: yes” attribute, meaning it will be used as a resolver for want of better DNS. I want this off, so I thought I’d add resolvectl default-route office no, because this works perfectly from the commandline.
But not in the PostUp script:
[#] ip link add office type wireguard
[#] wg setconf office /dev/fd/63
[#] ip -4 address add 10.1.1.3/32 dev office
[#] ip link set mtu 1420 up dev office
[#] resolvectl dns office 10.1.1.1; resolvectl domain office office.net; resolvectl default-route office no
Failed to set default route configuration: Access denied
What gives?
