The other thing I also noticed is that the /etc/resolv.conf that's updated by ConnMan includes name servers from each of the connections. I'd be curious to see if there's a way to have ConnMan only use the name server specified by WireGuard. Otherwise it's using the DNS from my local internet first before going across the VPN.
I've noticed this but resolving it [sic] is complicated. LE does not use the internal DNS proxy in ConnMan, and ConnMan will add/remove the extra DNS servers from the WireGuard config but will not remove the initial (local network entry) at the same time. ConnMan devs are not iterested in looking into this as they regard /etc/resolv.conf as a legacy approach. LE has no plan to switch back to using the DNS proxy; in the past we found lots of bugs but the main issue was consistent user reports of "My DNS is broken" because the Kodi sysinfo screen (correctly) shows 127.0.0.1 as the DNS server and this is attributed as the source of all network issues by inexperienced users. The fix probably requires LE to move to systemd resolvd but that will be a rather invasive and political change .. won't happen overnight. NB: It's not a well-known fact, but libc will only use the first 3x DNS servers listed, even if more are in the file.
I've experimented with the following systemd service which has some added Pre/Post calls:
[Unit]
Description=WireGuard VPN Service
After=network-online.target nss-lookup.target connman-vpn.service
Before=kodi.service
[Service]
Type=oneshot
RemainAfterExit=yes
ExecStartPre=/bin/sh -c '/storage/fix_dns_leaks StartPre'
ExecStart=/usr/bin/connmanctl connect <service_name>
ExecStartPost=/bin/sh -c '/storage/fix_dns_leaks StartPost'
ExecStop=/usr/bin/connmanctl disconnect <service_name>
ExecStopPost=/bin/sh -c '/storage/fix_dns_leaks StopPost'
[Install]
WantedBy=multi-user.target
Display More
The /storage/fix_dns_leaks script looks like:
#!/bin/bash
# SPDX-License-Identifier: GPL-2.0
# Copyright (C) 2020-present Team LibreELEC (https://libreelec.tv)
case $1 in
StartPre)
mkdir -p /storage/.cache/wireguard
cp /run/libreelec/resolv.conf /storage/.cache/wireguard/resolv.conf
;;
StartPost)
LOCALNS=$(egrep '192.168|172.16|10.' /run/libreelec/resolv.conf | awk '{print $2}')
for NS in $LOCALNS; do
sed -i /${NS}/d /run/libreelec/resolv.conf
done
;;
StopPost)
cp /storage/.cache/wireguard/resolv.conf /run/libreelec/resolv.conf
rm /storage/.cache/wireguard/resolv.conf
;;
esac
Display More
If you only start/stop the connection at boot time via systemd this script appears to work. If you start connecting/disconnecting the connection via dbus (using the connections screen in the settings add-on) the logic is faulty somewhere and at some point you end up with no DNS servers .. I haven't had time to look into it much further due to work and other time commitments. I'd be happy if others started digging around..