Lansenou · Writing

How to serialize HoloLens 2 anchors

Sun, 28 Jun 2026 12:21:49 GMT

This article shows how to export and import spatial anchors in Unity using OpenXR, enabling persistence and sharing between HoloLens 2 devices. This resulting data can then be used to transfer the data. This allows you to persist the data either locally on a single HoloLens or to share the anchors between multiple devices.

This uses XRAnchorTransferBatch for “offline” cross-device anchor persistence in Unity OpenXR without having to resort to Azure Spatial Anchors (which has been retired as a cloud service as of November 2024), when cloud/online services are not an option or as a free alternative.

Cross-platform

My cross-platform anchor package, LansAnchor, is retired.

Requirements

HoloLens 2
Unity 2020+
OpenXR plugin
ARFoundation

Setup

The OpenXR plugin and ARFoundation can be installed via the Mixed Reality Feature Tool.

Make sure you have the AR Anchor Manager component in the scene. I’ve got my scene setup as follows:

View the full-resolution setup screenshot.

Then you need an ARFoundation ARAnchor attached on the object on the location that you want to save.

Exporting the anchor

This can be used to grab the data from the anchors. This data can be saved locally, offline or shared with your networking solution of choice.

Save as ExportAnchor.cs (Pseudocode):

using System.Collections.Generic;
using System.IO;
using System.Threading.Tasks;
using Microsoft.MixedReality.OpenXR;
using UnityEngine.XR.ARFoundation;
using UnityEngine.XR.ARSubsystems;

public async Task<byte[]> ExportAnchorsAsync(
    IEnumerable<ARAnchor> anchors)
{
    var batch = new XRAnchorTransferBatch();

    foreach (var anchor in anchors)
    {
        // You usually store a mapping between ARAnchor and a string id yourself
        batch.AddAnchor(anchor.trackableId, anchor.name);
    }

    Stream stream = await XRAnchorTransferBatch.ExportAsync(batch);

    using var ms = new MemoryStream();
    await stream.CopyToAsync(ms);

    return ms.ToArray();
}

Importing

This is how you should load the data onto the HoloLens.

Save as ExportAnchor.cs (Pseudocode):

using Microsoft.MixedReality.OpenXR;
using System.IO;
using System.Threading.Tasks;

public async Task<XRAnchorTransferBatch> ImportAnchorsAsync(byte[] data)
{
    using var stream = new MemoryStream(data);

    XRAnchorTransferBatch batch =
        await XRAnchorTransferBatch.ImportAsync(stream);

    return batch;
}

Loading Anchors into the scene

After import, you explicitly request each anchor to be recreated in the Unity/XR session. You can also replace existing anchors.

Save as LoadAnchors.cs (Pseudocode):

public void LoadImportedAnchors(XRAnchorTransferBatch batch, string anchorName)
{
    batch.LoadAnchor(anchorName);
}

public void ReplaceAnchor(
    XRAnchorTransferBatch batch,
    string anchorName,
    TrackableId existingAnchorId)
{
    batch.LoadAndReplaceAnchor(anchorName, existingAnchorId);
}

Completed file

Github gist: https://gist.github.com/Lansenou/caf479981f5757e36d86c684635e2303

Download AnchorImporterExporter.cs

Multiplayer

If you want players to see the information based around the Persistent Spatial Anchor you will need to make sure that the shared content in the scene is all placed relative to the anchor. For example:

Anchor (Same world position, parent of all objects)
Object with a position relative to the anchor

This will show all the objects at the same world position.

Conclusion

To summarize the steps to correctly serialize a HoloLens anchor.

Collect known anchors (AddAnchor)
Serialize them into an opaque stream (ExportAsync)
You can save these anchors for later usage or instantly transfer it to different HoloLens devices.
Rebuild the anchor mapping on another device (ImportAsync)
Let Unity resolve them back into live and local anchors (LoadAnchor)

The anchor data itself is intentionally opaque by Microsoft. You’re not supposed to inspect or modify the batch, the code is there to send the anchor data between devices or sessions.

Troubleshooting

Let me know if this information helped you! If you couldn’t make it work. Please contact me!

License

If you found this code useful, I’d appreciate a mention or a link back to this blog.

MIT License

Copyright (c) 2026 Lansenou.com

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.

Split DNS on macOS while using WireGuard

Sat, 27 Jun 2026 19:30:33 GMT

My goal was to have a Split-Tunnel WireGuard connection which grants access to some private services, including a DNS server, and to serve some DNS results over the WireGuard connection. I wanted the rest of the requests to be restored to the original DNS of the WIFI connection. Without this, internal hostnames either fail or leak to public DNS. To do this we need to setup a DNS resolver.

By creating a resolver that is only responsible for your internal domain, queries for names such as host.internal are sent through the DNS server reachable over the WireGuard tunnel. All other DNS queries continue to use your normal network’s DNS servers, so public traffic behaves exactly as it would without the VPN.

This approach is often referred to as split DNS. Instead of routing all DNS traffic through the VPN, only the domains that actually exist on the remote network use the VPN’s DNS server. This avoids unnecessary latency for public lookups while still allowing private hostnames to resolve correctly.

The /opt/homebrew path is the captured Apple Silicon setup. Check brew --prefix on other Macs before choosing the configuration path.

Point Dnsmasq to original DNS nameservers

I followed dferg’s guide on how to configure splitdns on macos. Instead of having no-resolve the goal is to point towards a custom updated resolve file.

First install Dnsmasq via homebrew (install homebrew via https://brew.sh/).

In Terminal:

brew install dnsmasq

Save as /opt/homebrew/etc/dnsmasq.conf:

# https://lansenou.com/blog/2026/06/27/split-dns-on-macos/
# Edited from: https://gist.github.com/dferg/0472269333be4aca6aaa21cf3b165c02
# Ignore /etc/resolv.conf - Keep this disabled to make resolv-file work
# no-resolv
resolv-file=/opt/dnsmasq/upstream.conf

# For queries *.internal and *.box, forward to the specified DNS server
# Servers are queried in order (if the previous fails)
# -- Note: These are EXAMPLES. Replace with your desired config.
server=/internal/box/10.0.0.1
server=/internal/box/10.0.0.2

# Forward all other requests to Google's public DNS server - Keep this disabled since we use our own resolv-file
# server=8.8.8.8

# Only listen for DNS queries on localhost
listen-address=127.0.0.1

# Required due to macOS limitations
bind-interfaces

Restoring DNS settings

Now I needed a way to put the original DNS settings that DHCP is handing out into the upstream.conf file.

Grabbing original DNS values from scutil

This file grabs all upstream servers via the scutil command, and filters out loopback addresses (127.x), including the own resolver address 127.0.0.1. It outputs the result into the upstream.conf file.

In Terminal:

sudo mkdir -p /opt/dnsmasq
sudo chown -R $(whoami) /opt/dnsmasq

Save as /opt/dnsmasq/update-dns.sh:

#!/bin/bash
# https://lansenou.com/blog/2026/06/27/split-dns-on-macos/

OUT="/opt/dnsmasq/upstream.conf"

# Get macOS DNS entries
scutil --dns | awk '/nameserver\[[0-9]+\]/{print $3}' \
  | grep -E '^([0-9]{1,3}\.){3}[0-9]{1,3}$' \
  | grep -v '^127\.' \
  | sort -u \
  | sed 's/^/nameserver /' \
  > "$OUT"

# Fallback (never leave empty)
if [ ! -s "$OUT" ]; then
  echo "127.0.0.1" > "$OUT"
fi

# restart dnsmasq safely
killall -HUP dnsmasq 2>/dev/null

In Terminal:

sudo chmod +x /opt/dnsmasq/update-dns.sh

Running a background script

I’m using launchctl to make sure the update-dns.sh is ran at load time and also when settings change. The /Library/Preferences/SystemConfiguration directory contains macOS’s network configuration state. Changes to the system will cause the script to update again:

VPN connect/disconnect
Joining a different Wi-Fi network
Ethernet connecting/disconnecting
DNS changes

Save as ~/Library/LaunchAgents/local.dnsmasq.dnsupdate.plist:

<?xml version="1.0" encoding="UTF-8"?>
<plist version="1.0">
<dict>
  <key>Label</key>
  <string>local.dnsmasq.dnsupdate</string>

  <key>ProgramArguments</key>
  <array>
    <string>/opt/dnsmasq/update-dns.sh</string>
  </array>

  <key>RunAtLoad</key>
  <true/>

  <key>WatchPaths</key>
  <array>
    <string>/Library/Preferences/SystemConfiguration</string>
  </array>
</dict>
</plist>

Load the dns update script

In Terminal:

launchctl bootstrap gui/$(id -u) ~/Library/LaunchAgents/local.dnsmasq.dnsupdate.plist

Setting up wireguard to point to the internal resolver

To make sure your local dnsmasq resolver is used, point towards it in the wireguard configuration. In my wireguard setup I want to have access to the whole subnet.

Save as wireguard.conf:

[Interface]
DNS = 127.0.0.1
#... rest of the interface

[Peer]
AllowedIPs = 10.0.0.0/24 # Exposes the entire network range 10.0.0.0-10.0.0.255
#... rest of the peer setup

Now you should activate the configuration.

Finishing it all

Restart the dnsmasq to use make use of the upstream config file.

In Terminal:

sudo brew services restart dnsmasq

The DNS resolver should now correctly be setup for wireguard and support network switching. After reconnecting the VPN, internal domains resolves through the VPN DNS while public domains continue using the system resolver.

In Terminal:

$ nslookup google.com
Server:		127.0.0.1
Address:	127.0.0.1#53

Non-authoritative answer:
Name:	google.com
Address: 172.217.23.238

In Terminal:

$ nslookup nas.internal
Server:		127.0.0.1
Address:	127.0.0.1#53

Non-authoritative answer:
Name:	nas.internal
Address: 10.0.0.3

Thanks for reading! This my first blog post, please let me know if my experience helped you, or if I should have described some steps in more depth.

Troubleshooting

Check launched processes

In Terminal:

launchctl list | grep dnsmasq

Unloading the script

In Terminal:

launchctl bootout gui/$(id -u) ~/Library/LaunchAgents/local.dnsmasq.dnsupdate.plist

Manually check the logs of dnsmasq

In Terminal:

sudo brew services stop dnsmasq
sudo dnsmasq --no-daemon --log-queries --log-facility=-

Don’t forget to start dnsmasq again after this.

Lansenou · Writing

How to serialize HoloLens 2 anchors

Cross-platform

Requirements

Setup

Exporting the anchor

Importing

Loading Anchors into the scene

Completed file

Multiplayer

Conclusion

Projects that use sharing of anchors

Troubleshooting

License

Split DNS on macOS while using WireGuard

Point Dnsmasq to original DNS nameservers

Restoring DNS settings

Grabbing original DNS values from scutil

Running a background script

Load the dns update script

Setting up wireguard to point to the internal resolver

Finishing it all

Troubleshooting