fix(fish): route DNS through exit node so vpn works - #2084
Conversation
|
|
Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
|
Warning Review limit reached
Next review available in: 30 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Mesa DescriptionTL;DREnables Tailscale DNS acceptance when routing through the exit node to prevent DNS resolution failures when the VPN is active. What changed?
Description generated by Mesa. Update settings |
![mesa-dot-dev[bot]](https://avatars.githubusercontent.com/in/1050077?s=60&v=4){kind=small}
There was a problem hiding this comment.
Performed full review of ab5f8a7...354fb4e
Tip
Help
Slash Commands:
/review- Request a full code review/review latest- Review only changes since the last review/describe- Generate PR description. This will update the PR body or issue comment depending on your configuration/help- Get help with Mesa commands and configuration options
0 files reviewed | 0 comments | Edit Agent Settings • Read Docs
![indent-zero[bot]](https://avatars.githubusercontent.com/in/1426746?s=60&v=4){kind=small}
| and echo "VPN connected through kyber" | ||
| case off | ||
| tailscale set --exit-node= | ||
| tailscale set --exit-node= --accept-dns=false |
There was a problem hiding this comment.
Latent: off hard-disables accept-dns regardless of host baseline — This currently matches nix-darwin/config/networking.nix:33-37, which activates with tailscale set --accept-dns=false alongside the /etc/resolver/ts.net split-DNS setup, so on macOS it correctly restores the declared baseline. On a host that instead relies on Tailscale MagicDNS while the exit node is off (e.g. a future Linux/NixOS machine using this same fish function), vpn off will flip --accept-dns to false and silently break .ts.net lookups until the user re-enables it. Worth either scoping this to macOS or reading the current preference before overwriting.
| and echo "VPN connected through kyber" | ||
| case off | ||
| tailscale set --exit-node= | ||
| tailscale set --exit-node= --accept-dns=false |
There was a problem hiding this comment.
Nit: add a symmetric comment on the off path — The on branch documents why --accept-dns=true is required, but the two branches that pass --accept-dns=false are silent. Since this pairs with the activation script in nix-darwin/config/networking.nix:33-37 (which sets --accept-dns=false and configures /etc/resolver/ts.net for split-DNS), a one-line comment on line 11 would prevent a future reader from stripping the flag as dead code.
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the _vpn_function script to include --accept-dns settings when toggling the Tailscale exit node. Specifically, it enables DNS routing through the exit node when connected and disables it when disconnected to ensure proper name resolution while tunneled. I have no further feedback to provide.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
1 participant
Summary
_vpn_function.fishset the Tailscale exit node but not--accept-dns. WithCorpDNS: falsein prefs, DNS stayed pointed at 1.1.1.1/8.8.8.8 and those UDP:53 queries failed through the tunnel - traffic routed but name resolution broke (http:000), which read as "VPN not working".Changes
tailscale set --exit-node=kyber --accept-dns=truetailscale set --exit-node= --accept-dns=falseTesting
make fish-test-> 414 passingvpn on-> exit-node IP (91.242.214.231), DNS resolvesvpn off-> direct IP (203.106.130.122)Summary by cubic
Fixes VPN name resolution by routing DNS through the
tailscaleexit node in_vpn_function.fish. Turning VPN off now restores local DNS.tailscale set --exit-node=$kyber_host --accept-dns=truetailscale set --exit-node= --accept-dns=falseWritten for commit 354fb4e. Summary will update on new commits.