dns

Dockers/pia-wireguard/entrypoint.sh

@@ -10,6 +10,7 @@ PIA_PF_FILE="${PIA_PF_FILE:-$PIA_STATE_DIR/port_forward.json}"
 PIA_PF_PORT_FILE="${PIA_PF_PORT_FILE:-$PIA_STATE_DIR/port_forward.port}"
 PIA_DNS_ENABLE="${PIA_DNS_ENABLE:-true}"
 PIA_DNS_FALLBACK="${PIA_DNS_FALLBACK:-10.0.0.242}"
+PIA_DNS_PRE_VPN="${PIA_DNS_PRE_VPN:-1.1.1.1}"
 PIA_HEALTH_URL="${PIA_HEALTH_URL:-https://api64.ipify.org}"
 PIA_HANDSHAKE_MAX_AGE_SECONDS="${PIA_HANDSHAKE_MAX_AGE_SECONDS:-180}"
 PIA_RECONNECT_BACKOFF_SECONDS="${PIA_RECONNECT_BACKOFF_SECONDS:-5}"
@@ -173,6 +174,12 @@ connect_region() {
     dns_server="$PIA_DNS_FALLBACK"
   fi
 
+  # Ensure we can still resolve endpoints before tunnel is up.
+  # Once the tunnel is up, we can switch to PIA-provided DNS.
+  if [[ "$PIA_DNS_ENABLE" == "true" ]]; then
+    write_resolv_conf "$PIA_DNS_PRE_VPN"
+  fi
+
   mkdir -p /etc/wireguard
   cat >"/etc/wireguard/${PIA_IFACE}.conf" <<EOF
 [Interface]
@@ -186,13 +193,13 @@ AllowedIPs = 0.0.0.0/0
 Endpoint = ${wg_ip}:${server_port}
 EOF
 
+  wg-quick down "$PIA_IFACE" 2>/dev/null || true
+  wg-quick up "$PIA_IFACE"
+
   if [[ "$PIA_DNS_ENABLE" == "true" ]]; then
     write_resolv_conf "$dns_server"
   fi
 
-  wg-quick down "$PIA_IFACE" 2>/dev/null || true
-  wg-quick up "$PIA_IFACE"
-
   setup_killswitch "$wg_ip" "$server_port"
 
   current_region="$region"