mirror of
https://github.com/outbackdingo/firezone.git
synced 2026-01-27 10:18:54 +00:00
1140f6ffa3
Firezone Clients set themselves as the system-wide DNS resolver on startup. This is necessary to intercept queries for DNS resources which resolve to proxy IPs whilst Firezone is active. All DNS queries for non-resources are forwarded to either the resolver defined on the system or the ones defined in the portal (if any). These DNS servers can also be CIDR resources in which cases the queries get forwarded through the tunnel to a Gateway. Right now, the responses from these DNS servers are never cached. DNS is pretty heavily relied on on most systems and having DNS fail or be slow usually results in a bad user experience. To improve on this, we embed a small DNS cache into connlib where for each query, we first try to answer it from the cache. Queries otherwise forwarded to the system/upstream resolver or through the tunnel will see a much improved response time with this change. When serving responses from this cache, the TTL is decremented automatically based on how much time has passed since the entry was first added to the cache. Outside of the response time being ~1ms, this makes the cache fully transparent. Resolves: #10508