Skip to content

[BUG] PEERDNS env variable unexpected behavior #418

Open
Open
[BUG] PEERDNS env variable unexpected behavior#418
Labels
no-issue-activity

Description

@javiersilva0
javiersilva0
opened on Sep 6, 2026

Is there an existing issue for this?

  • I have searched the existing issues

Current Behavior

Documentation here reports that PEERDNS defaults to auto, which should make use of CoreDNS.

However, currently there is a difference between these two cases:

  • Not setting any value for PEERDNS when deploying the container. In this case, the DNS service is not initialized, as evidenced by container logs below.
  • Setting PEERDNS=auto. In this case, the DNS service works as expected.

Expected Behavior

Since PEERDNS defaults to auto, there should be no difference between the two situations. Thus, the DNS server should work in both cases.

Steps To Reproduce

  1. Deploy both versions of the Podman Quadlet below (i.e. with and without the Environment=PEERDNS=auto line.
  2. Check logs, or attempt to use the DNS server from a WireGuard client.

Environment

- OS: Debian
- How podman service was installed: `apt`
- How the container was deployed: Podman Quadlet

CPU architecture

x86-64

Docker creation

[Unit]
Description="WireGuard VPN server"
Wants=network-online.target
After=network-online.target
After=local-fs.target

[Container]
ContainerName="wireguard-server"
Image=lscr.io/linuxserver/wireguard

Volume=wireguard-server:/config

Network=host

AddCapability=NET_ADMIN 
AddCapability=NET_RAW 
PublishPort=51820:51820/udp

Environment=SERVERPORT=51820
Environment=SERVERURL=auto
Environment=PEERS=<redacted>
Environment=TZ=<redacted>
Environment=PEERDNS=auto    # this line is the only difference between the two configurations
Environment=INTERFACE=enp1s0

AutoUpdate=registry

[Service]
Restart=on-failure
TimeoutStartSec=900

[Install]
WantedBy=default.target

Container logs

Without setting any value for PEERDNS:

───────────────────────────────────────

      ██╗     ███████╗██╗ ██████╗
      ██║     ██╔════╝██║██╔═══██╗
      ██║     ███████╗██║██║   ██║
      ██║     ╚════██║██║██║   ██║
      ███████╗███████║██║╚██████╔╝
      ╚══════╝╚══════╝╚═╝ ╚═════╝

   Brought to you by linuxserver.io
───────────────────────────────────────

To support the app dev(s) visit:
WireGuard: https://www.wireguard.com/donations/

To support LSIO projects visit:
https://www.linuxserver.io/donate/

───────────────────────────────────────
GID/UID
───────────────────────────────────────

User UID:    911
User GID:    911
───────────────────────────────────────
Linuxserver.io version: 1.0.20260223-r0-ls120
Build-date: 2026-08-06T13:03:25+00:00
───────────────────────────────────────

Uname info: Linux SERVER-1 6.12.107+deb13-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.12.107-1 (2026-08-29) x86_64 GNU/Linux
**** Server mode is selected ****
**** SERVERURL var is either not set or is set to "auto", setting external IP to auto detected value of <redacted> ****
**** External server port is set to 51820. Make sure that port is properly forwarded to port 51820 inside this container ****
**** Internal subnet is set to 10.13.13.0 ****
**** AllowedIPs for peers 0.0.0.0/0, ::/0 ****
**** PEERDNS var is either not set or is set to "auto", setting peer DNS to 10.13.13.1 to use wireguard docker host's DNS. ****
**** Server mode is selected ****
**** No changes to parameters. Existing configs are used. ****
[custom-init] No custom files found, skipping...
**** Disabling CoreDNS ****
**** Found WG conf /config/wg_confs/wg0.conf, adding to list ****
**** Activating tunnel /config/wg_confs/wg0.conf ****
[#] ip link add dev wg0 type wireguard
[#] wg addconf wg0 /dev/fd/63
[#] ip -4 address add 10.13.13.1 dev wg0
[#] ip link set mtu 1420 up dev wg0
[#] ip -4 route add 10.13.13.6/32 dev wg0
[#] ip -4 route add 10.13.13.5/32 dev wg0
[#] ip -4 route add 10.13.13.4/32 dev wg0
[#] ip -4 route add 10.13.13.3/32 dev wg0
[#] ip -4 route add 10.13.13.2/32 dev wg0
[#] iptables -A FORWARD -i wg0 -j ACCEPT; iptables -A FORWARD -o wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o enp1s0 -j MASQUERADE
**** All tunnels are now active ****
[ls.io-init] done.

=========================

Setting `PEERDNS=auto`:

───────────────────────────────────────

      ██╗     ███████╗██╗ ██████╗
      ██║     ██╔════╝██║██╔═══██╗
      ██║     ███████╗██║██║   ██║
      ██║     ╚════██║██║██║   ██║
      ███████╗███████║██║╚██████╔╝
      ╚══════╝╚══════╝╚═╝ ╚═════╝

   Brought to you by linuxserver.io
───────────────────────────────────────

To support the app dev(s) visit:
WireGuard: https://www.wireguard.com/donations/

To support LSIO projects visit:
https://www.linuxserver.io/donate/

───────────────────────────────────────
GID/UID
───────────────────────────────────────

User UID:    911
User GID:    911
───────────────────────────────────────
Linuxserver.io version: 1.0.20260223-r0-ls120
Build-date: 2026-08-06T13:03:25+00:00
───────────────────────────────────────

Uname info: Linux SERVER-1 6.12.107+deb13-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.12.107-1 (2026-08-29) x86_64 GNU/Linux
**** Server mode is selected ****
**** SERVERURL var is either not set or is set to "auto", setting external IP to auto detected value of <redacted> ****
**** External server port is set to 51820. Make sure that port is properly forwarded to port 51820 inside this container ****
**** Internal subnet is set to 10.13.13.0 ****
**** AllowedIPs for peers 0.0.0.0/0, ::/0 ****
**** PEERDNS var is either not set or is set to "auto", setting peer DNS to 10.13.13.1 to use wireguard docker host's DNS. ****
**** Server mode is selected ****
**** No changes to parameters. Existing configs are used. ****
[custom-init] No custom files found, skipping...
maxprocs: Leaving GOMAXPROCS=4: CPU quota undefined
.:53
CoreDNS-1.13.2
linux/amd64, go1.26.3,
**** Found WG conf /config/wg_confs/wg0.conf, adding to list ****
**** Activating tunnel /config/wg_confs/wg0.conf ****
[#] ip link add dev wg0 type wireguard
[#] wg addconf wg0 /dev/fd/63
[#] ip -4 address add 10.13.13.1 dev wg0
[#] ip link set mtu 1420 up dev wg0
[#] ip -4 route add 10.13.13.6/32 dev wg0
[#] ip -4 route add 10.13.13.5/32 dev wg0
[#] ip -4 route add 10.13.13.4/32 dev wg0
[#] ip -4 route add 10.13.13.3/32 dev wg0
[#] ip -4 route add 10.13.13.2/32 dev wg0
[#] iptables -A FORWARD -i wg0 -j ACCEPT; iptables -A FORWARD -o wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o enp1s0 -j MASQUERADE
**** All tunnels are now active ****
[ls.io-init] done.

Activity

  1. LinuxServer-CI
    added this to Issue & PR Trackeron Sep 6, 2026
  2. LinuxServer-CI
    moved this to Issues in Issue & PR Trackeron Sep 6, 2026

  3. github-actions commented on Sep 6, 2026

    @github-actions
    github-actionsbot
    on Sep 6, 2026 – with GitHub Actions

    Thanks for opening your first issue here! Be sure to follow the relevant issue templates, or risk having this issue marked as invalid.

  4. thespad commented on Sep 6, 2026

    @thespad
    thespad
    on Sep 6, 2026
    Member

    The logic is the same for both empty and auto values for PEERDNS

        if [[ -z "$PEERDNS" ]] || [[ "$PEERDNS" = "auto" ]]; then
        PEERDNS="${INTERFACE}.1"
        echo "**** PEERDNS var is either not set or is set to \"auto\", setting peer DNS to ${INTERFACE}.1 to use wireguard docker host's DNS. ****"

    And you can tell you're hitting that path in both cases by the log message.

    The only logic I could see you hitting, giving you're running with host networking is:

    if netstat -apn | grep -q ":53 " && [[ -z "${USE_COREDNS}" ]]; then
    USE_COREDNS="false"
fi

...

if [[ ${USE_COREDNS} == "false" ]]; then
    s6-notifyoncheck -d -n 300 -w 1000 -c "echo **** Disabling CoreDNS ****" \
        sleep infinity
else

    But that applies the same regardless of the PEERDNS setting, so unless you explicitly set USE_COREDNS somewhere (it's an intentionally undocumented option) it should never trigger or always trigger.

  5. LinuxServer-CI commented on Oct 7, 2026

    @LinuxServer-CI
    LinuxServer-CI
    on Oct 7, 2026
    Contributor

    This issue has been automatically marked as stale because it has not had recent activity. This might be due to missing feedback from OP. It will be closed if no further activity occurs. Thank you for your contributions.

  6. LinuxServer-CI
    added
    no-issue-activity
    on Oct 7, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    no-issue-activity

    Type

    No type

    Projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions