DNS Queries Hijacked by Netbird Settings

[d-givens]

Describe the problem
Trying to resolve active directory DNS names causes DNS Client to use Netbird DNS server instead of the configured DNS server. The setting persists even after uninstalling Netbird completely. Remnant left in HKLM\SYSTEM\ControlSet001\Services\DNScache\Parameters\DnsPolicyConfig that should likely be removed each time Netbird is disconnected, but either way, it should not override DNS settings. This is doubly-strange because we have Netbird set to push the AD DNS server as the higher priority anyway so there's really no case in which it should be using the Netbird DNS server.

Expected behavior
DNS lookups should always use the client's server first.

A clear and concise description of what you expected to happen.

NetBird version

0.35

I did not capture any of the other troubleshooting info, I simply blasted out that remnant regkey and disabled/enabled the adapter to get it to use the correct DNS server again.

[mlsmaycon]

@d-givens can you please share the output from netbird debug for 1m -S?

[d-givens]

Sorry, I do not currently have access to the machine that had the issues. If/when I get another one (there's been four so far), I'll get that troubleshooting info for you. Best Regards, Don Givens

…

________________________________ From: Maycon Santos ***@***.***> Sent: Friday, February 21, 2025 4:22 AM To: netbirdio/netbird ***@***.***> Cc: Don Givens ***@***.***>; Mention ***@***.***> Subject: Re: [netbirdio/netbird] DNS Queries Hijacked by Netbird Settings (Issue #3356) @d-givens<https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_d-2Dgivens&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=Cg7ZbfqlCNZ5daQWHZ7AlOpOsUY-6fu2pBAZZQKg1Ks&m=ZoIZQuWSj_9rJTCzIPlUqOkHvScnRKyDP1Xa7o-9V36eBEIMn_sxNn0fN42yHlyS&s=QFwPk-6gw_ApMgpCnzhw3xLG2_jmmU_kyNGXycAOkW0&e=> can you please share the output from netbird debug for 1m -S? — Reply to this email directly, view it on GitHub<https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_netbirdio_netbird_issues_3356-23issuecomment-2D2674153314&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=Cg7ZbfqlCNZ5daQWHZ7AlOpOsUY-6fu2pBAZZQKg1Ks&m=ZoIZQuWSj_9rJTCzIPlUqOkHvScnRKyDP1Xa7o-9V36eBEIMn_sxNn0fN42yHlyS&s=wLr5W0VroCdL-dSmbnshGz4mWfGKc4k0f_FObbOy8B0&e=>, or unsubscribe<https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_notifications_unsubscribe-2Dauth_BIVOUOS645C5QEZWX46XXFT2Q3453AVCNFSM6AAAAABXRIV75KVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDMNZUGE2TGMZRGQ&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=Cg7ZbfqlCNZ5daQWHZ7AlOpOsUY-6fu2pBAZZQKg1Ks&m=ZoIZQuWSj_9rJTCzIPlUqOkHvScnRKyDP1Xa7o-9V36eBEIMn_sxNn0fN42yHlyS&s=_RL4A4-ugGb3PSP3YK-zy2CeUmWaNoUiIuq7wjkpQKk&e=>. You are receiving this because you were mentioned.Message ID: ***@***.***> [mlsmaycon]mlsmaycon left a comment (netbirdio/netbird#3356)<https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_netbirdio_netbird_issues_3356-23issuecomment-2D2674153314&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=Cg7ZbfqlCNZ5daQWHZ7AlOpOsUY-6fu2pBAZZQKg1Ks&m=ZoIZQuWSj_9rJTCzIPlUqOkHvScnRKyDP1Xa7o-9V36eBEIMn_sxNn0fN42yHlyS&s=wLr5W0VroCdL-dSmbnshGz4mWfGKc4k0f_FObbOy8B0&e=> @d-givens<https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_d-2Dgivens&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=Cg7ZbfqlCNZ5daQWHZ7AlOpOsUY-6fu2pBAZZQKg1Ks&m=ZoIZQuWSj_9rJTCzIPlUqOkHvScnRKyDP1Xa7o-9V36eBEIMn_sxNn0fN42yHlyS&s=QFwPk-6gw_ApMgpCnzhw3xLG2_jmmU_kyNGXycAOkW0&e=> can you please share the output from netbird debug for 1m -S? — Reply to this email directly, view it on GitHub<https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_netbirdio_netbird_issues_3356-23issuecomment-2D2674153314&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=Cg7ZbfqlCNZ5daQWHZ7AlOpOsUY-6fu2pBAZZQKg1Ks&m=ZoIZQuWSj_9rJTCzIPlUqOkHvScnRKyDP1Xa7o-9V36eBEIMn_sxNn0fN42yHlyS&s=wLr5W0VroCdL-dSmbnshGz4mWfGKc4k0f_FObbOy8B0&e=>, or unsubscribe<https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_notifications_unsubscribe-2Dauth_BIVOUOS645C5QEZWX46XXFT2Q3453AVCNFSM6AAAAABXRIV75KVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDMNZUGE2TGMZRGQ&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=Cg7ZbfqlCNZ5daQWHZ7AlOpOsUY-6fu2pBAZZQKg1Ks&m=ZoIZQuWSj_9rJTCzIPlUqOkHvScnRKyDP1Xa7o-9V36eBEIMn_sxNn0fN42yHlyS&s=_RL4A4-ugGb3PSP3YK-zy2CeUmWaNoUiIuq7wjkpQKk&e=>. You are receiving this because you were mentioned.Message ID: ***@***.***>

________________________________ This email has been scanned for spam and viruses by Proofpoint Essentials. Click here<https://us2.proofpointessentials.com/app/report_spam.php?mod_id=11&mod_option=logitem&report=1&type=easyspam&k=k1&payload=53616c7465645f5f1f90233a137ef368df097f977c16ce6fbc56786c7c5238b20be82230ebe8a661d131810581ba961cb50d7647d940e1c9b7c207dad4e8505908c721b30ccaadd485d488d1ecdb29701756e49615181e8cb726e00930141ec3854e2e5f2d5d9551f4c650782b57265fb6b64d8679dc9d970107411f1eb15cb48ced0c8931292f39d79826519bda3c4ce8383e0c427ccd01b65653c374ca83bd> to report this email as spam.