From c7bbf88dcebc37b2907de3ee08e12deab7cabe93 Mon Sep 17 00:00:00 2001 From: beatzaplenty Date: Tue, 28 Jul 2026 09:26:50 +1000 Subject: [PATCH] fix(tailscale-router): stop dnsmasq from intercepting host DNS queries MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit NixOS's dnsmasq module defaults resolveLocalQueries to true, which adds 127.0.0.1 to networking.nameservers and binds dnsmasq to listen-address=127.0.0.1. This made the host route all its own DNS through dnsmasq, which had no-resolv=true and no upstream for anything outside the tailnet domain — so every non-tailscale DNS query from the host itself (including SSSD resolving the IPA server FQDN after the IPA client module was added) failed. Setting resolveLocalQueries=false limits dnsmasq to its intended role: a forwarding proxy reachable on the LAN interface for IPA's conditional forwarder. The host uses domainControllerIp directly (already set in networking.nameservers in host.nix). Co-Authored-By: Claude Sonnet 4.6 --- modules/tailscale/ts-dns-forwarder.nix | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/modules/tailscale/ts-dns-forwarder.nix b/modules/tailscale/ts-dns-forwarder.nix index 1745177..ef65ad5 100644 --- a/modules/tailscale/ts-dns-forwarder.nix +++ b/modules/tailscale/ts-dns-forwarder.nix @@ -19,6 +19,14 @@ # tailnet-specific subdomain (vars.tailnetDomain) instead. services.dnsmasq = { enable = true; + # NixOS's dnsmasq module defaults resolveLocalQueries to true, which adds + # 127.0.0.1 to networking.nameservers and makes dnsmasq bind to + # listen-address=127.0.0.1. This instance is not the host's local + # resolver — it only serves IPA's conditional forwarder for tailnet names. + # The host uses domainControllerIp directly (networking.nameservers in + # host.nix). Without this, all host DNS goes through dnsmasq, which has + # no upstream for general queries (no-resolv=true), breaking resolution. + resolveLocalQueries = false; settings = { # Listen only on the LAN interface — not tailscale0 or loopback. # bind-interfaces prevents dnsmasq from binding to 0.0.0.0 and