Fix DNS resolution for VPN and private network configurations #182
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request modifies the DNS server filtering logic in crates/kit/src/run_ephemeral.rs. Previously, the system filtered out private network IP addresses (IPv4 private ranges and IPv6 ULA) from the list of host DNS servers. The changes now allow these private addresses, with updated comments explaining that this improves compatibility for VPN and air-gapped environments where such DNS servers might be reachable. Additionally, the log level for the fallback message when no usable DNS servers are found has been changed from warn to debug, and its accompanying comments have been refined to clarify the conditions and potential limitations of this fallback.
gursewak1997
force-pushed
the
fix-vpn-dns-filtering
branch
from
2990548 to
2c30a11
Compare
cgwalters
approved these changes
Dec 18, 2025
gursewak1997
force-pushed
the
fix-vpn-dns-filtering
branch
from
2c30a11 to
c34eb74
Compare
cgwalters
reviewed
Dec 18, 2025
gursewak1997
force-pushed
the
fix-vpn-dns-filtering
branch
from
c34eb74 to
7e24cb0
Compare
PR #167 introduced DNS filtering that excluded all private IP addresses (10.x, 172.16-31.x, 192.168.x, fc00::/7) assuming they would be unreachable from QEMU's slirp networking. However, this breaks VPN scenarios where private DNS servers are actually reachable. This change removes the overly aggressive private IP filtering, now only filtering out localhost and link-local addresses. Private network DNS servers are allowed through since they may be reachable (e.g., via VPN or air-gapped networks). If they're actually unreachable, DNS will fail naturally, which is better than prematurely filtering them out. Also downgraded the fallback warning from WARN to debug level since falling back to public DNS is a normal case, not an error condition. Assisted-by: Claude Code (Sonnet 4.5) Signed-off-by: gursewak1997 <gursmangat@gmail.com>
gursewak1997
force-pushed
the
fix-vpn-dns-filtering
branch
from
7e24cb0 to
fae2ca4
Compare
cgwalters
approved these changes
Dec 19, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
PR #167 introduced DNS filtering that excluded all private IP addresses (10.x, 172.16-31.x, 192.168.x, fc00::/7) assuming they would be unreachable from QEMU's slirp networking. However, this breaks VPN scenarios where private DNS servers are actually reachable.
This change removes the overly aggressive private IP filtering, now only filtering out localhost and link-local addresses. Private network DNS servers are allowed through since they may be reachable (e.g., via VPN or air-gapped networks). If they're actually unreachable, DNS will fail naturally, which is better than prematurely filtering them out.
Also downgraded the fallback warning from WARN to debug level since falling back to public DNS is a normal case, not an error condition.
Moving away from parsing DNS manually and letting libvirt handle networking would be cleaner long-term. This fix is a targeted solution for the immediate issue, but a future improvement could delegate more of the network configuration to the underlying infrastructure.
Assisted-by: Claude Code (Sonnet 4.5)