[client] Fix netstack dns forwarder

[lixmal]

Describe your changes

• Register DNS forwarder as netstack service instead of on the native stack
  • Port netstack services from ssh-rewrite branch
  • Listen on netstack
• Change the listen address from unspecified to the NetBird address

Issue ticket number and link

Stack

Checklist

• Is it a bug fix
• Is a typo/documentation fix
• Is a feature enhancement
• It is a refactor
• Created tests that fail without the change (if possible)

By submitting this pull request, you confirm that you have read and agree to the terms of the Contributor License Agreement.

Documentation

Select exactly one:

• I added/updated documentation for this change
• Documentation is not needed for this change (explain why)

Docs PR URL (required if "docs added" is checked)

Paste the PR link from https://github.com/netbirdio/docs here:

https://github.com/netbirdio/docs/pull/__

[Copilot]

Pull Request Overview

This PR refactors the DNS forwarder to support netstack-based DNS listening by passing the full WireGuard interface instead of just the local address. The key changes enable DNS forwarding to work through netstack when available, falling back to native network stack listeners when netstack is not in use.

• Refactored DNS forwarder manager and forwarder to accept wgIface interface instead of netip.Addr
• Added netstack service registration mechanism in the userspace firewall to handle DNS traffic routing
• Updated DNS server initialization to use netstack listeners when available

Reviewed Changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
client/internal/engine.go	Registers DNS forwarder service with netstack firewall when creating DNS forwarder manager
client/internal/dnsfwd/manager.go	Refactored to accept wgIface interface and extract local address on-demand for DNAT rules
client/internal/dnsfwd/forwarder.go	Updated to use netstack listeners when available, changed from string-based to AddrPort-based listen address
client/internal/dnsfwd/forwarder_test.go	Updated test instantiations to match new NewDNSForwarder signature
client/firewall/uspfilter/filter.go	Added netstack service registry and routing logic to direct traffic to netstack listeners
client/internal/dnsfwd/cache_test.go	Removed trailing newline

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud