diff --git a/setup-base.sh b/setup-base.sh
index 5f7bc58..a441f18 100755
--- a/setup-base.sh
+++ b/setup-base.sh
@@ -161,6 +161,9 @@ if [[ -n "$REPO_DIR" && -f "$REPO_DIR/wireguard/m${MODEL}.conf" ]]; then
     cp "$REPO_DIR/wireguard/m${MODEL}.conf" /etc/wireguard/wg0.conf
     chmod 600 /etc/wireguard/wg0.conf
     systemctl enable wg-quick@wg0 2>/dev/null || true
+    # systemd-resolved Stub funktioniert nicht mit WireGuard DNS catch-all (~.)
+    # → resolv.conf direkt auf die upstream-Server zeigen lassen
+    ln -sf /run/systemd/resolve/resolv.conf /etc/resolv.conf
     ok "WireGuard m${MODEL}.conf → /etc/wireguard/wg0.conf"
 else
     warn "WireGuard: keine lokale Config gefunden — manuell einrichten"
diff --git a/wireguard/iPadM.conf b/wireguard/iPadM.conf
index bc535aa..c664d0d 100755
--- a/wireguard/iPadM.conf
+++ b/wireguard/iPadM.conf
@@ -2,7 +2,7 @@
 PrivateKey = EHTtesjOBYQdhOnii54POY1XivkohZS/3VdZU8xRaUc=
 ListenPort = 51820
 Address = 10.13.13.5/24
-DNS = 10.47.11.21,10.47.11.20
+DNS = 10.47.11.20,10.47.11.1
 
 [Peer]
 PublicKey = mp0YKEjsUbnld3aTAnF6cSzTfixhZETQCoKiFHIcF30=
diff --git a/wireguard/iPadR.conf b/wireguard/iPadR.conf
index 1e81e5a..533619f 100755
--- a/wireguard/iPadR.conf
+++ b/wireguard/iPadR.conf
@@ -2,7 +2,7 @@
 PrivateKey = CHIzDLQ2Sla/aH591a+OlvG9bjyGDq/toh+NYE6wPFo=
 ListenPort = 51820
 Address = 10.13.13.4/24
-DNS = 10.47.11.21,10.47.11.20
+DNS = 10.47.11.20,10.47.11.1
 
 [Peer]
 PublicKey = mp0YKEjsUbnld3aTAnF6cSzTfixhZETQCoKiFHIcF30=
diff --git a/wireguard/iPhoneM.conf b/wireguard/iPhoneM.conf
index 14072b1..0813476 100755
--- a/wireguard/iPhoneM.conf
+++ b/wireguard/iPhoneM.conf
@@ -2,7 +2,7 @@
 PrivateKey = OL+CAPy9+HaHLxxqB3+N4ABn51v6xLk8gaGhRWlbG1s=
 ListenPort = 51820
 Address = 10.13.13.3/24
-DNS = 10.47.11.21,10.47.11.20
+DNS = 10.47.11.20,10.47.11.1
 
 [Peer]
 PublicKey = mp0YKEjsUbnld3aTAnF6cSzTfixhZETQCoKiFHIcF30=
diff --git a/wireguard/iPhoneR.conf b/wireguard/iPhoneR.conf
index 9489a5d..0c813d0 100755
--- a/wireguard/iPhoneR.conf
+++ b/wireguard/iPhoneR.conf
@@ -2,7 +2,7 @@
 PrivateKey = oIJYPKn7pmsRFMY5+PIDaXZxDCVug9KsR5ZMjSwdVWw=
 ListenPort = 51820
 Address = 10.13.13.2/24
-DNS = 10.47.11.21,10.47.11.20
+DNS = 10.47.11.20,10.47.11.1
 
 [Peer]
 PublicKey = mp0YKEjsUbnld3aTAnF6cSzTfixhZETQCoKiFHIcF30=
diff --git a/wireguard/m1.conf b/wireguard/m1.conf
index 58f30b0..0650ba9 100755
--- a/wireguard/m1.conf
+++ b/wireguard/m1.conf
@@ -2,7 +2,7 @@
 PrivateKey = kEUk6gLdqXiPfOt9n639fshf0gMAhRhoRTRRXoz86Hc=
 ListenPort = 51820
 Address = 10.13.13.6/24
-DNS = 10.47.11.21,10.47.11.20
+DNS = 10.47.11.20,10.47.11.1
 
 [Peer]
 PublicKey = mp0YKEjsUbnld3aTAnF6cSzTfixhZETQCoKiFHIcF30=
diff --git a/wireguard/m13.conf b/wireguard/m13.conf
index f1953f9..f2688ca 100755
--- a/wireguard/m13.conf
+++ b/wireguard/m13.conf
@@ -2,7 +2,7 @@
 PrivateKey = sIxh2D50+9bpWe6O6ezrfybW9Iy6QKcrwr9hmFpuGn0=
 ListenPort = 51820
 Address = 10.13.13.8/24
-DNS = 10.47.11.21,10.47.11.20
+DNS = 10.47.11.20,10.47.11.1
 
 [Peer]
 PublicKey = 7WrqHPof31gcCYMjLWPoP1EIxPR2896/3KL1pQ3YZGs=
diff --git a/wireguard/m16.conf b/wireguard/m16.conf
index c4e08d0..b2a1652 100755
--- a/wireguard/m16.conf
+++ b/wireguard/m16.conf
@@ -2,7 +2,7 @@
 PrivateKey = OA5IiSzPglSY8GdobOYMlaOaG+QqNjHIACBRe7MvK04=
 ListenPort = 51820
 Address = 10.13.13.7/24
-DNS = 10.47.11.21,10.47.11.20
+DNS = 10.47.11.20,10.47.11.1
 
 [Peer]
 PublicKey = J/dD1t3Bo9Zbcvxg6PvGP78kgMlL4s4yYfrUMpcoS2w=