From 1dacd7f096024d9822238213341e4e20d11330b8 Mon Sep 17 00:00:00 2001
From: Bram <info@bramkelchtermans.be>
Date: Tue, 5 May 2026 21:12:06 +0200
Subject: [PATCH] dns

---
 Dockers/pia-wireguard/entrypoint.sh | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/Dockers/pia-wireguard/entrypoint.sh b/Dockers/pia-wireguard/entrypoint.sh
index 7306657..b077119 100644
--- a/Dockers/pia-wireguard/entrypoint.sh
+++ b/Dockers/pia-wireguard/entrypoint.sh
@@ -10,6 +10,7 @@ PIA_PF_FILE="${PIA_PF_FILE:-$PIA_STATE_DIR/port_forward.json}"
 PIA_PF_PORT_FILE="${PIA_PF_PORT_FILE:-$PIA_STATE_DIR/port_forward.port}"
 PIA_DNS_ENABLE="${PIA_DNS_ENABLE:-true}"
 PIA_DNS_FALLBACK="${PIA_DNS_FALLBACK:-10.0.0.242}"
+PIA_DNS_PRE_VPN="${PIA_DNS_PRE_VPN:-1.1.1.1}"
 PIA_HEALTH_URL="${PIA_HEALTH_URL:-https://api64.ipify.org}"
 PIA_HANDSHAKE_MAX_AGE_SECONDS="${PIA_HANDSHAKE_MAX_AGE_SECONDS:-180}"
 PIA_RECONNECT_BACKOFF_SECONDS="${PIA_RECONNECT_BACKOFF_SECONDS:-5}"
@@ -173,6 +174,12 @@ connect_region() {
     dns_server="$PIA_DNS_FALLBACK"
   fi
 
+  # Ensure we can still resolve endpoints before tunnel is up.
+  # Once the tunnel is up, we can switch to PIA-provided DNS.
+  if [[ "$PIA_DNS_ENABLE" == "true" ]]; then
+    write_resolv_conf "$PIA_DNS_PRE_VPN"
+  fi
+
   mkdir -p /etc/wireguard
   cat >"/etc/wireguard/${PIA_IFACE}.conf" <<EOF
 [Interface]
@@ -186,13 +193,13 @@ AllowedIPs = 0.0.0.0/0
 Endpoint = ${wg_ip}:${server_port}
 EOF
 
+  wg-quick down "$PIA_IFACE" 2>/dev/null || true
+  wg-quick up "$PIA_IFACE"
+
   if [[ "$PIA_DNS_ENABLE" == "true" ]]; then
     write_resolv_conf "$dns_server"
   fi
 
-  wg-quick down "$PIA_IFACE" 2>/dev/null || true
-  wg-quick up "$PIA_IFACE"
-
   setup_killswitch "$wg_ip" "$server_port"
 
   current_region="$region"