Equivalent to Wireguard's post up?

[AdamantUnstable]

Hi all, I'm in the process of deploying a Nebula network and I'm running into some issues getting Windows to behave with some DNS related stuff (Android too but that's an ongoing discussion for the app). Specifically, because Nebula DNS can't deal with reverse proxies (you can't have multiple names point to the same address) I'm using the implied alternate solution of running a DNS server in the network that responds with Nebula IP addresses. It took some finagling with systemd-resolved but works well on Linux (not Nebula's fault mind you, just systemd-resolved being weird).

The issue is that while I can get it to work on Windows by manually setting up the tunnel adaptor with a DNS server and a metric to override the DHCP DNS server it resets on reboot since the tunnel gets destroyed and recreated. I don't want to set the DNS at the main network adaptor since these are mobile devices I'm setting up and I'd like them to be able to get DHCP DNS they can use in case my server can't resolve anything and so they can fall back on that if the Nebula tunnel goes down for whatever reason. With Wireguard, this would be solved with a post up script to set these parameters, but even though Nebula on Windows uses the same Wintun driver I can't find any way to set a post up script.

Is there a clean/convenient way to do this? Either some means of passing configuration info through to Wintun or by having Nebula call a post up script of some description?

[AdamantUnstable]

I'm going to leave this discussion up because there's probably a better way to do it (even better, adding it as a feature) but for reference I've put together a solution that seems to work OK, even if it's very hacky:

1. Create a powershell script with the filename post-up.ps1 in the folder where you store your Nebula details with the following contents:
   netsh netsh interface ip set dns nebula1 static [insert DNS IP address here]
Set-NetConnectionProfile -Name nebula1 NetworkCategory Private (this line isn't strictly necessary but Windows Firewall just causes way too many headaches if you try to open up stuff selectively when the network is Public)
2. Open Task Scheduler
3. Create new task, name it Nebula Post-Up
4. Tick the box to run even if the user is logged out, and to run with highest privileges
5. Go to the Triggers tab and add New
6. Set the Trigger to run on login for any user
7. Go to the Actions tab and add New
8. Set the action to Start a program, set the program to powershell.exe, and add the arguments:
   -ExecutionPolicy Bypass -File C:\path\to\nebula\folder\post-up.ps1 (ExecutionPolicy Bypass lets Powershell execute the script even though it normally won't run a script this way, by setting it inline here it only switches off for this automation and stays on for the rest of the system)
9. Save the automation

(edited because triggering when Nebula comes up was not working for some reason, triggering on login seems to work although obviously assumes that the user will manually retrigger the task if they manually reconnect to Nebula)