[BUG] PEERDNS env variable unexpected behavior
Open
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 55/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Active
- Tech stack
- docker
- Domain
- devops, networking
Research direction
Start by reproducing both Podman Quadlet configurations and comparing the container startup logs for PEERDNS and CoreDNS. Trace the container startup handling of an unset PEERDNS value versus PEERDNS=auto; done means both configurations initialize CoreDNS and provide the same DNS behavior to WireGuard clients.
Written by the indexing model from the issue text.
Description
Is there an existing issue for this?
- I have searched the existing issues
Current Behavior
Documentation here reports that PEERDNS defaults to auto, which should make use of CoreDNS.
However, currently there is a difference between these two cases:
- Not setting any value for
PEERDNSwhen deploying the container. In this case, the DNS service is not initialized, as evidenced by container logs below. - Setting
PEERDNS=auto. In this case, the DNS service works as expected.
Expected Behavior
Since PEERDNS defaults to auto, there should be no difference between the two situations. Thus, the DNS server should work in both cases.
Steps To Reproduce
- Deploy both versions of the Podman Quadlet below (i.e. with and without the
Environment=PEERDNS=autoline. - Check logs, or attempt to use the DNS server from a WireGuard client.
Environment
- OS: Debian
- How podman service was installed: `apt`
- How the container was deployed: Podman Quadlet
CPU architecture
x86-64
Docker creation
[Unit]
Description="WireGuard VPN server"
Wants=network-online.target
After=network-online.target
After=local-fs.target
[Container]
ContainerName="wireguard-server"
Image=lscr.io/linuxserver/wireguard
Volume=wireguard-server:/config
Network=host
AddCapability=NET_ADMIN
AddCapability=NET_RAW
PublishPort=51820:51820/udp
Environment=SERVERPORT=51820
Environment=SERVERURL=auto
Environment=PEERS=<redacted>
Environment=TZ=<redacted>
Environment=PEERDNS=auto # this line is the only difference between the two configurations
Environment=INTERFACE=enp1s0
AutoUpdate=registry
[Service]
Restart=on-failure
TimeoutStartSec=900
[Install]
WantedBy=default.target
Container logs
Without setting any value for PEERDNS:
───────────────────────────────────────
██╗ ███████╗██╗ ██████╗
██║ ██╔════╝██║██╔═══██╗
██║ ███████╗██║██║ ██║
██║ ╚════██║██║██║ ██║
███████╗███████║██║╚██████╔╝
╚══════╝╚══════╝╚═╝ ╚═════╝
Brought to you by linuxserver.io
───────────────────────────────────────
To support the app dev(s) visit:
WireGuard: https://www.wireguard.com/donations/
To support LSIO projects visit:
https://www.linuxserver.io/donate/
───────────────────────────────────────
GID/UID
───────────────────────────────────────
User UID: 911
User GID: 911
───────────────────────────────────────
Linuxserver.io version: 1.0.20260223-r0-ls120
Build-date: 2026-08-06T13:03:25+00:00
───────────────────────────────────────
Uname info: Linux SERVER-1 6.12.107+deb13-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.12.107-1 (2026-08-29) x86_64 GNU/Linux
**** Server mode is selected ****
**** SERVERURL var is either not set or is set to "auto", setting external IP to auto detected value of <redacted> ****
**** External server port is set to 51820. Make sure that port is properly forwarded to port 51820 inside this container ****
**** Internal subnet is set to 10.13.13.0 ****
**** AllowedIPs for peers 0.0.0.0/0, ::/0 ****
**** PEERDNS var is either not set or is set to "auto", setting peer DNS to 10.13.13.1 to use wireguard docker host's DNS. ****
**** Server mode is selected ****
**** No changes to parameters. Existing configs are used. ****
[custom-init] No custom files found, skipping...
**** Disabling CoreDNS ****
**** Found WG conf /config/wg_confs/wg0.conf, adding to list ****
**** Activating tunnel /config/wg_confs/wg0.conf ****
[#] ip link add dev wg0 type wireguard
[#] wg addconf wg0 /dev/fd/63
[#] ip -4 address add 10.13.13.1 dev wg0
[#] ip link set mtu 1420 up dev wg0
[#] ip -4 route add 10.13.13.6/32 dev wg0
[#] ip -4 route add 10.13.13.5/32 dev wg0
[#] ip -4 route add 10.13.13.4/32 dev wg0
[#] ip -4 route add 10.13.13.3/32 dev wg0
[#] ip -4 route add 10.13.13.2/32 dev wg0
[#] iptables -A FORWARD -i wg0 -j ACCEPT; iptables -A FORWARD -o wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o enp1s0 -j MASQUERADE
**** All tunnels are now active ****
[ls.io-init] done.
=========================
Setting `PEERDNS=auto`:
───────────────────────────────────────
██╗ ███████╗██╗ ██████╗
██║ ██╔════╝██║██╔═══██╗
██║ ███████╗██║██║ ██║
██║ ╚════██║██║██║ ██║
███████╗███████║██║╚██████╔╝
╚══════╝╚══════╝╚═╝ ╚═════╝
Brought to you by linuxserver.io
───────────────────────────────────────
To support the app dev(s) visit:
WireGuard: https://www.wireguard.com/donations/
To support LSIO projects visit:
https://www.linuxserver.io/donate/
───────────────────────────────────────
GID/UID
───────────────────────────────────────
User UID: 911
User GID: 911
───────────────────────────────────────
Linuxserver.io version: 1.0.20260223-r0-ls120
Build-date: 2026-08-06T13:03:25+00:00
───────────────────────────────────────
Uname info: Linux SERVER-1 6.12.107+deb13-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.12.107-1 (2026-08-29) x86_64 GNU/Linux
**** Server mode is selected ****
**** SERVERURL var is either not set or is set to "auto", setting external IP to auto detected value of <redacted> ****
**** External server port is set to 51820. Make sure that port is properly forwarded to port 51820 inside this container ****
**** Internal subnet is set to 10.13.13.0 ****
**** AllowedIPs for peers 0.0.0.0/0, ::/0 ****
**** PEERDNS var is either not set or is set to "auto", setting peer DNS to 10.13.13.1 to use wireguard docker host's DNS. ****
**** Server mode is selected ****
**** No changes to parameters. Existing configs are used. ****
[custom-init] No custom files found, skipping...
maxprocs: Leaving GOMAXPROCS=4: CPU quota undefined
.:53
CoreDNS-1.13.2
linux/amd64, go1.26.3,
**** Found WG conf /config/wg_confs/wg0.conf, adding to list ****
**** Activating tunnel /config/wg_confs/wg0.conf ****
[#] ip link add dev wg0 type wireguard
[#] wg addconf wg0 /dev/fd/63
[#] ip -4 address add 10.13.13.1 dev wg0
[#] ip link set mtu 1420 up dev wg0
[#] ip -4 route add 10.13.13.6/32 dev wg0
[#] ip -4 route add 10.13.13.5/32 dev wg0
[#] ip -4 route add 10.13.13.4/32 dev wg0
[#] ip -4 route add 10.13.13.3/32 dev wg0
[#] ip -4 route add 10.13.13.2/32 dev wg0
[#] iptables -A FORWARD -i wg0 -j ACCEPT; iptables -A FORWARD -o wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o enp1s0 -j MASQUERADE
**** All tunnels are now active ****
[ls.io-init] done.
- Dominant language
- Dockerfile
- Stars
- 3.6k
- Forks
- 440
- PR merge metrics
- No merged PRs in 30d
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from linuxserver/docker-wireguard
-
Bad peer port config Openno-issue-activity
Difficulty 1/5 Under an hour Newbie friendliness 78/100
linuxserver/docker-wireguard#416 · 5 comments ·
-
[BUG] Server mode + host networking + read only = stale wg0 iface, deletes host route on failure Openno-issue-activity
Difficulty 4/5 3-5 days Newbie friendliness 48/100
linuxserver/docker-wireguard#414 · 2 comments ·
All issues in linuxserver/docker-wireguard
Similar issues
-
kind/bug needs-triage
Difficulty 1/5 Under an hour Newbie friendliness 72/100
matrixorigin/matrixone#29223 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
copse-dev/agent-pane#2953 ·
-
bug ci-failure high priority
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
vllm-project/vllm-omni#7972 · 1 comment ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 90/100
simonw/sqlite-utils#872 ·
-
bug good first issue
Difficulty 1/5 Under an hour Newbie friendliness 88/100
amponce/archive-movie-browser#166 ·