fix: implement two-pronged DNS strategy for robust resolution

## DNS Strategy Overview

Run TWO DNS servers to handle all /etc/resolv.conf configurations:

1. **Namespace DNS server** (separate process in namespace):
   - Binds to loopback addresses (127.0.0.53, 127.0.0.54)
   - Handles queries when /etc/resolv.conf points to loopback (systemd-resolved)
   - These queries never leave namespace, so DNAT doesn't apply

2. **Host DNS server** (runs in main jail process):
   - Binds to host_ip:53 on host side of veth pair
   - Handles queries to external nameservers (e.g., 8.8.8.8)
   - DNAT redirects outbound DNS queries to this server
   - Works because DNAT to localhost fails for locally-generated packets

## Changes

- dns.rs: Update namespace server to bind only to loopback addresses
- mod.rs: Add host_dns_server field, start both servers with detailed comments
- nftables.rs: Allow both host_ip and loopback DNS, redirect external queries
- main.rs: Pass host_ip to namespace DNS server process

This approach works regardless of /etc/resolv.conf configuration.

Author: ammario

src/jail/linux/dns.rs

@@ -149,16 +149,20 @@ fn build_dummy_response(query: Packet<'_>) -> Result<Vec<u8>> {
 
 /// Run DNS server synchronously (blocks forever). Used when spawned inside namespace.
 ///
-/// We bind to multiple addresses to handle different /etc/resolv.conf configurations:
-/// - 0.0.0.0:53 - Catches most queries via DNAT rules
-/// - 127.0.0.53:53 - Used by systemd-resolved on Ubuntu/Debian
-/// - 127.0.0.54:53 - Alternative systemd-resolved address
+/// This handles DNS queries when /etc/resolv.conf points to loopback addresses
+/// (e.g., 127.0.0.53 used by systemd-resolved). These queries don't leave the namespace
+/// and aren't subject to DNAT rules, so we bind directly to those loopback addresses.
+///
+/// For queries to external nameservers (e.g., 8.8.8.8), those are handled by a separate
+/// DNS server running in the host process (see start_dns_server in mod.rs), which binds
+/// to the host_ip. DNAT redirects outbound DNS queries to that host_ip:53 server.
 ///
 /// We intentionally DO NOT modify /etc/resolv.conf to avoid side effects and maintain
 /// robustness across different system configurations.
-pub fn run_dns_server_blocking() -> Result<()> {
-    // Bind to multiple addresses to handle different nameserver configurations
-    let addresses = vec!["0.0.0.0:53", "127.0.0.53:53", "127.0.0.54:53"];
+pub fn run_dns_server_blocking(_host_ip: &str) -> Result<()> {
+    // Bind to loopback addresses for direct queries (systemd-resolved, etc.)
+    // These handle the case where /etc/resolv.conf points to 127.0.0.x
+    let addresses = vec!["127.0.0.53:53".to_string(), "127.0.0.54:53".to_string()];
 
     let mut servers = Vec::new();
     for addr in &addresses {

src/jail/linux/mod.rs

@@ -65,6 +65,8 @@ pub struct LinuxJail {
     veth_pair: Option<ManagedResource<VethPair>>,
     nftables: Option<ManagedResource<NFTable>>,
     dns_server_child: Option<std::process::Child>,
+    // Host-side DNS server for DNAT redirection
+    host_dns_server: Option<dns::DummyDnsServer>,
     // Per-jail computed networking (unique /30 inside 10.99/16)
     host_ip: [u8; 4],
     host_cidr: String,
@@ -82,6 +84,7 @@ impl LinuxJail {
             veth_pair: None,
             nftables: None,
             dns_server_child: None,
+            host_dns_server: None,
             host_ip,
             host_cidr,
             guest_cidr,
@@ -362,17 +365,38 @@ impl LinuxJail {
         Ok(())
     }
 
-    /// Start the dummy DNS server in the namespace
+    /// Start DNS servers using a two-pronged approach to handle different /etc/resolv.conf configs
+    ///
+    /// ## DNS Strategy Overview
+    ///
+    /// We run TWO DNS servers to handle all cases robustly:
+    ///
+    /// 1. **Namespace DNS server** (separate process in namespace):
+    ///    - Binds to loopback addresses (127.0.0.53, 127.0.0.54)
+    ///    - Handles queries when /etc/resolv.conf points to loopback (e.g., systemd-resolved)
+    ///    - These queries never leave the namespace, so DNAT doesn't apply
+    ///
+    /// 2. **Host DNS server** (runs in this process on host side):
+    ///    - Binds to host_ip:53 on the host side of the veth pair
+    ///    - Handles queries to external nameservers (e.g., 8.8.8.8 in /etc/resolv.conf)
+    ///    - DNAT rules redirect outbound DNS queries to this server
+    ///    - This works because DNAT to localhost doesn't work for locally-generated packets
+    ///      in the OUTPUT chain, but DNAT to a routable IP (the host_ip) does work
+    ///
+    /// This two-pronged approach works regardless of /etc/resolv.conf configuration.
     fn start_dns_server(&mut self) -> Result<()> {
         let namespace_name = self.namespace_name();
+        let host_ip_str = format!(
+            "{}.{}.{}.{}",
+            self.host_ip[0], self.host_ip[1], self.host_ip[2], self.host_ip[3]
+        );
 
+        // 1. Start namespace DNS server for loopback queries
         info!(
-            "Starting dummy DNS server inside namespace {}",
+            "Starting namespace DNS server inside {} for loopback addresses",
             namespace_name
         );
 
-        // Spawn httpjail inside the namespace to run the DNS server
-        // This uses the --__internal-dns-server flag which calls run_dns_server_blocking()
         let exe_path = std::env::current_exe().context("Failed to get current executable path")?;
 
         let child = std::process::Command::new("ip")
@@ -382,27 +406,48 @@ impl LinuxJail {
                 &namespace_name,
                 exe_path.to_str().context("Invalid executable path")?,
                 "--__internal-dns-server",
+                &host_ip_str,
             ])
             .stdin(std::process::Stdio::null())
             .stdout(std::process::Stdio::null())
             .stderr(std::process::Stdio::null())
             .spawn()
             .context("Failed to spawn in-namespace DNS server")?;
 
-        info!("Started in-namespace DNS server (pid {})", child.id());
-
+        info!("Started namespace DNS server (pid {})", child.id());
         self.dns_server_child = Some(child);
 
+        // 2. Start host DNS server for DNAT redirection
+        info!(
+            "Starting host DNS server on {} for DNAT redirection",
+            host_ip_str
+        );
+
+        let mut host_server = dns::DummyDnsServer::new();
+        let host_addr = format!("{}:53", host_ip_str);
+        host_server
+            .start(&host_addr)
+            .context("Failed to start host DNS server")?;
+
+        info!("Started host DNS server on {}", host_addr);
+        self.host_dns_server = Some(host_server);
+
         Ok(())
     }
 
-    /// Stop the DNS server
+    /// Stop the DNS servers
     fn stop_dns_server(&mut self) {
+        // Stop namespace DNS server process
         if let Some(mut child) = self.dns_server_child.take() {
-            debug!("Stopping in-namespace DNS server (pid {})", child.id());
+            debug!("Stopping namespace DNS server (pid {})", child.id());
             let _ = child.kill();
             let _ = child.wait();
-            debug!("Stopped in-namespace DNS server");
+            debug!("Stopped namespace DNS server");
+        }
+
+        // Stop host DNS server (runs in threads, cleanup on drop)
+        if let Some(_server) = self.host_dns_server.take() {
+            debug!("Stopping host DNS server (cleanup on drop)");
         }
     }
 }
@@ -580,6 +625,7 @@ impl Clone for LinuxJail {
             veth_pair: None,
             nftables: None,
             dns_server_child: None,
+            host_dns_server: None,
             host_ip: self.host_ip,
             host_cidr: self.host_cidr.clone(),
             guest_cidr: self.guest_cidr.clone(),

src/jail/linux/nftables.rs

@@ -129,7 +129,9 @@ table ip {table_name} {{
 
         # Redirect all DNS queries to our dummy DNS server running in namespace
         # This works regardless of what nameserver is in /etc/resolv.conf
-        udp dport 53 dnat to 127.0.0.1:53
+        # We redirect to host_ip instead of 127.0.0.1 because DNAT to localhost
+        # doesn't work reliably in the OUTPUT chain for locally-generated packets
+        udp dport 53 dnat to {host_ip}:53
 
         # Redirect HTTP to proxy running on host
         tcp dport 80 dnat to {host_ip}:{http_port}
@@ -145,16 +147,21 @@ table ip {table_name} {{
         # Always allow established/related traffic
         ct state established,related accept
 
-        # Allow DNS traffic to localhost (after DNAT redirection)
-        ip daddr 127.0.0.1 udp dport 53 accept
+        # Allow DNS traffic to host IP (after DNAT redirection for external nameservers)
+        ip daddr {host_ip} udp dport 53 accept
+
+        # Allow DNS traffic to loopback addresses (systemd-resolved, etc.)
+        # These are handled by the namespace DNS server and don't need DNAT
+        ip daddr 127.0.0.53 udp dport 53 accept
+        ip daddr 127.0.0.54 udp dport 53 accept
 
         # Allow traffic to the host proxy ports after DNAT
         ip daddr {host_ip} tcp dport {{ {http_port}, {https_port} }} accept
 
         # Explicitly block all other UDP (e.g., QUIC on 443)
         # This must come AFTER allowing DNS traffic
         ip protocol udp drop
-        
+
         # Explicitly block all other TCP traffic
         # This must come AFTER allowing HTTP/HTTPS traffic
         ip protocol tcp drop

src/main.rs

@@ -309,17 +309,25 @@ async fn main() -> Result<()> {
     // Handle internal DNS server flag (must be first, before clap parsing)
     // This is called by LinuxJail when spawning DNS server inside namespace
     #[cfg(target_os = "linux")]
-    if std::env::args().any(|arg| arg == "--__internal-dns-server") {
-        use httpjail::jail::linux::dns::run_dns_server_blocking;
-
-        // Bring up loopback interface in the namespace
-        std::process::Command::new("ip")
-            .args(["link", "set", "lo", "up"])
-            .output()
-            .context("Failed to bring up loopback interface")?;
-
-        // Run the DNS server (blocks forever)
-        return run_dns_server_blocking();
+    {
+        let args: Vec<String> = std::env::args().collect();
+        if let Some(pos) = args.iter().position(|arg| arg == "--__internal-dns-server") {
+            use httpjail::jail::linux::dns::run_dns_server_blocking;
+
+            // Get host IP from next argument
+            let host_ip = args
+                .get(pos + 1)
+                .context("Missing host IP argument after --__internal-dns-server")?;
+
+            // Bring up loopback interface in the namespace
+            std::process::Command::new("ip")
+                .args(["link", "set", "lo", "up"])
+                .output()
+                .context("Failed to bring up loopback interface")?;
+
+            // Run the DNS server (blocks forever)
+            return run_dns_server_blocking(host_ip);
+        }
     }
 
     let args = Args::parse();