1

I have configured a split tunnel VPN to connect my home computer to my corporate network. I can simultaneously ping internet hosts (by name) and corporate servers (but only by address, not name). tracepath confirms the traffic is using the appropriate interface, too. But I cannot resolve any hosts on the corp net by DNS. However, I can ping the corp net DNS server (at 192.168.0.253, for example), and nslookup sample.corp.local 192.168.0.253 resolves:

Server:     192.168.0.253
Address:    192.168.0.253#53

Name:   sample.corp.local
Address: 192.168.0.228

Digging into this, I see that network name resolution doesn't change when I activate the VPN connection, although the PPP link does receive the names of the corp net DNS servers (and an IP address from the corp net) (below).

This is apparently already a known issue with network-manager package.

I have tried the workaround described in the thread of installing dnscrypt-proxy, but that is not working for me and I don't know how to even start debugging it. Suggestions on that would be appreciated.

The thread also mentioned the possibility of killing dnsmasq process and letting it restart, but I do not see any such process running on 19.04.

I have also tried hard-coding the DNS info in a .network file, but that broke DNS resolution on both links. Advice on what I did wrong there would be appreciated.

file: /etc/systemd/network/50-vpn-corp.network

[Match]
Name=ppp*
[Network]
Description=VPN to corp net
DNS=192.168.0.254
Domains=corp.local

Ideally, I'd have names in corp.local domain be resolved by corp net DNS servers while names in internet domains be set out the internet link and resolved directly by global DNS servers, but I'll settle for sending all requests to the corporate network DNS servers. This is not a censorship scenario.

I'm running Ubuntu 19.04, network-manager-l2tp-gnome from the Canonical repository and connecting to a Cisco Meraki client VPN using this recommended VPN config.

With VPN active on PPP0, $ resolvectl status shows:

Global
       LLMNR setting: no
MulticastDNS setting: no
  DNSOverTLS setting: no
      DNSSEC setting: no
    DNSSEC supported: no
          DNSSEC NTA: 10.in-addr.arpa
                      16.172.in-addr.arpa
                      168.192.in-addr.arpa
                      17.172.in-addr.arpa
                      18.172.in-addr.arpa
                      19.172.in-addr.arpa
                      20.172.in-addr.arpa
                      21.172.in-addr.arpa
                      22.172.in-addr.arpa
                      23.172.in-addr.arpa
                      24.172.in-addr.arpa
                      25.172.in-addr.arpa
                      26.172.in-addr.arpa
                      27.172.in-addr.arpa
                      28.172.in-addr.arpa
                      29.172.in-addr.arpa
                      30.172.in-addr.arpa
                      31.172.in-addr.arpa
                      corp
                      d.f.ip6.arpa
                      home
                      internal
                      intranet
                      lan
                      local
                      private
                      test

Link 6 (ppp0)
      Current Scopes: none
DefaultRoute setting: no
       LLMNR setting: yes
MulticastDNS setting: no
  DNSOverTLS setting: no
      DNSSEC setting: no
    DNSSEC supported: no

Link 2 (enp30s0)
      Current Scopes: DNS
DefaultRoute setting: yes
       LLMNR setting: yes
MulticastDNS setting: no
  DNSOverTLS setting: no
      DNSSEC setting: no
    DNSSEC supported: no
  Current DNS Server: 2600:1700:2d61:ca0::1
         DNS Servers: 127.0.0.2
                      2600:1700:2d61:ca0::1
          DNS Domain: ~.
                      attlocal.net

And $ cat /etc/ppp/resolv.conf shows:

nameserver 192.168.0.253
nameserver 192.168.1.253
  • Bueller? Anyone? – BobHy Aug 31 at 14:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.