3

I want to create a split-DNS config on a 14.04 desktop machine with both a local eth network and a VPN connection. Ie I should send DNS lookups for address ranges that are accessed via the vpn to the (private) DNS servers that are configured for that particular vpn connection. Other addresses which are served via the local net should use different (public) dns servers.

https://www.stgraber.org/2012/02/24/dns-in-ubuntu-12-04/ suggests this is easy to do now that we have a local dnsmasq resolver. Quote:

The big advantage is that if you connect to a VPN, instead of having all your DNS traffic be routed through the VPN like in the past, you’ll instead only send DNS queries related to the subnet and domains announced by that VPN. This is especially interesting for high latency VPN links where everything would be slowed down in the past.

But I can not figure out how to make this work! With VPN inactive network-manager tells dnsmasq to use the local public DNS servers as its upstream servers (this is good). If I now activate a VPN connection network-manager tells dnsmasq to change the upstream dns servers to the private ones configured for the vpn connection. And now all my local traffic goes to vpn for its dns lookups (this is bad!).

If I had a "real" dnsmasq setup I could tell it in dnsmasq.conf to route specific lookups to specific dns servers. But how does this work with the cut-down dnsmasq / network-manager setup provided with Ubuntu desktop?

I guess that one option is just to install the full dnsmasq, but this then means that I need to maintain config details in 2 separate places which is the sort of thing that network-manager mostly overcomes. Any suggestions?

Improve this question
2
  • This discussion may shed some light: mail.gnome.org/archives/networkmanager-list/2014-October/…
    – jdthood
    May 30, 2015 at 19:07
  • You say "this is bad", but it is not illegal (i.e., against an RFC) for the machine to use the VPN nameservers for all queries. The VPN nameservers should have information both about the VPN and about the Internet. What is disadvantageous is, first, that doing this may be slow. Second, if the local network is a different private network, then doing this leaks local names to the VPN. Admitted, but DNS was never designed to maintain the privacy of namespaces; the design of DNS assumes that there is only one global public namespace.
    – jdthood
    May 30, 2015 at 19:14

3 Answers 3

Reset to default
2

To get the D-Bus controlled dnsmasq that NetworkManager runs to use different DNS servers, there are the following options (obviously adjust domains and IP addresses in the examples):

  • Add a file to /etc/NetworkManager/dnsmasq.d that sets the DNS server for the subnet you want: myvpn-server.conf could contain server=/myvpn.domain.com/10.8.4.9. This will always be respected by dnsmasq even when not connected to the VPN, in which case queries for these domains should time out. Disadvantage is that you need to specify the IP address statically, advantage is simplicity
  • Use D-Bus to talk directly to dnsmasq to tell it to update the servers using something like sudo dbus-send --system --print-reply --dest=org.freedesktop.NetworkManager.dnsmasq /uk/org/thekelleys/dnsmasq uk.org.thekelleys.SetDomainServers "array:string:192.168.0.1,/myvpn.domain.com/10.8.4.9". This could be scripted when the vpn connects. You'd need to look up existing DNS servers (the 192.168.0.1 in my example) over D-Bus or using nm-cli
  • Use D-Bus to talk to Network Manager itself and tell it to update the servers. Here's an example of doing this using Python which would require some work to include the current servers.

I'm using the first option and have only tried preliminary versions of the other two

Improve this answer
0

This is most likely a configuration problem on the server side. The vpn server should only push domains that he can resolve.

For example if you use an openvpn server a user configuration might look like this: 

ifconfig-push 172.16.0.51 255.255.255.0
push "route 172.16.1.0 255.255.255.0 172.16.0.1"
push "route 192.168.2.0 255.255.255.0 172.16.0.6"
push "dhcp-option DNS 172.16.0.1"
push "dhcp-option DOMAIN some.of.your.domains"
push "dhcp-option DOMAIN another.domain"

This way your client knows, that your server can only resolve domains specified here.

The dnsmasq config can be quite minimal in the case you use Networkmanager: 

domain-needed
interface=lo
bind-interfaces

One more common pitfall: You have to configure your vpn connection ip settings in networkmanager to "use the connection only for resources on its network" (like here: https://brmlab.cz/_media/project/warzone/nv-routes.png)

Otherwise the routing will always use your vpn connection over the "real" interface. Metrics are normally correctly set by networkmanager (higher metric for vpn than the underlying network)

Improve this answer
0

You likely are looking for the DNS Search Domain and Additional DNS Server fields in the IPv4 and IPv6 tabs in the nm-connection-editor application.

Just enter you companies domain and DNS server IPs there.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.