Run certain programs with modified DNS resolution

We (mostly non-NixOS users) use port-forwarding to connect to private endpoints within our infrastructure. Typically (because of http redirects or applications wanting to be called with a specific host header) we need to call the endpoints by specific DNS names, something like localhost:1234 won’t do. The typical approach to facilitate this is to modify /etc/hosts ad-hoc in some script. This approach doesn’t work in NixOS as /etc/hosts points to some store path and isn’t writeable.

Do you know of a nice way to modify DNS resolution for a specific progress?

1 Like

Have a look at networking.extraHosts
It is not solving it for specific programs however, but that would not be the case in your previous way of working either?

https://search.nixos.org/options?channel=23.05&show=networking.extraHosts&from=0&size=50&sort=relevance&type=packages&query=networking.extraHosts

1 Like

neworking.extraHosts is what I’ve been doing so far. It works, but it cannot be scripted as easily as a simple grep/sed on /etc/hosts, and adding a line to hosts then requires a rebuild of my system.

You are right, the /etc/hosts solution is unfortunately global instead of specific to certain programs. And finding a solution for that is easily scriptable but changes DNS resolution for the whole system would already be a step forward. But given that I have to find another solution anyway, I might as well aim for a solution that doesn’t change DNS resolution globally on my system.

In my case it’s mostly about https calls. When doing those with curl, I obtained good results when using the --connect-to switch.

For Firefox, I experimented with mitmproxy and URL rewriting. So far I’m getting http 400, but the approach looks promising.

For non-http calls, the next think I would try is probably running a program in a separate network namespace and run a DNS server in that namespace.

Curl as a very specific subject has a --resolve CLI flag which I have used once in a while, and possibly an envvar approach too that I only learned of today:
https://curl.se/libcurl/c/CURLOPT_RESOLVE.html

Take a look at how captive-browser (it’s in nixpkgs) does it using a socks5 proxy. This of course assumes that your software supports that.