[client] netstack SOCKS5 proxy resolves hostname-form CONNECTs via system DNS instead of the in-stack DNS

[RaymondKroon]

Before posting

• I searched existing discussions and issues, including closed ones, and checked the relevant docs.
• I believe this is a product bug rather than a configuration or setup question.
• I can reproduce this issue, or for intermittent issues I've included trigger, frequency, and timing details below.
• I removed or anonymized sensitive data from logs, screenshots, and configuration.

Affected area

Client / Agent, DNS

Deployment type

Self-hosted - advanced/custom deployment

Operating system or environment

Windows

NetBird version and upgrade status

Client: 0.78.1
Management: 0.78.1

Did this work before?

No, this never worked

Regression details

No response

Summary

In netstack (userspace) mode, the SOCKS5 proxy on 127.0.0.1:1080 only works with IP-form
CONNECT requests.

Hostname-form CONNECT requests (SOCKS5 "remote DNS", used by curl
--socks5-hostname, browsers with a SOCKS5 proxy, most SOCKS5-capable clients) are resolved
via the host OS resolver, so NetBird-managed domain names (custom DNS zones / nameserver
groups configured in the management UI) never resolve and the connection fails

Current behavior

DNS resolving from NetBird FQDN's is not working through the SOCKS5 proxy,

Expected behavior

DNS resolving works

Steps to reproduce

1. Run a netstack client connected to a management instance with a DNS rule (custom zone /
   nameserver group) for a domain, e.g. app.example.internal → 10.x.x.x (a routed network
   or peer IP).
2. Verify the in-stack DNS knows the name (e.g. via netbird debug or by resolving it from
   inside the tunnel).
3. From the host:

     curl --socks5 127.0.0.1:1080 --resolve app.example.internal:443:<ip>
   https://app.example.internal/   # OK (IP form)
     curl --socks5-hostname 127.0.0.1:1080 https://app.example.internal/
   # fails: name not found
   

4. The hostname form fails even though the same name resolves fine through the client's
   in-stack DNS server.

Environment and topology

N/A

Self-hosted details, if available

No response

Logs, status output, or debug evidence

N/A

Related issues or discussions

No response

Impact

No response

Additional context

No response

[aditya-mitra]

After looking at the codebase, it seems SOCK5 proxy is designed to connect to a name (not an IP) and it looks up in the computer's DNS instead of netbird.