DNS not working with VPN

Question

Level 1

8 points

DNS not working with VPN

I've done my best to search for an existing discussion on this topic, but couldn't find anything conclusive or exactly the same.

I'm brand new to Apple and OS X Server, but think I have made good progress with this one exception.

Setup: XServe with OS X Server SL setup as a Gateway directly behind an ISP/Cable modem. WAN configured and connected to the ISP, and one LAN with the default setup at 192.168.1.x (DNS at 192.168.1.1). I used the Gateway Assistant to get basic network settings initially configured, including DHCP, Firewall, DNS, and VPN.

I'm using DNS with a single primary zone for internal domain purposes and forwarders for Internet resolution. I have customized it to include various machine records within my LAN. Outside of the LAN, DNS is handled at register.com to point all traffic to my servers WAN IP.

In short, when connected directly to the LAN, all works like a charm. Internal DNS handles everything perfectly, and connects to the Internet for everything else.

However, when I connect to my environment from the Internet via VPN (LT2P and PPTP) and a Mac OS X SL client machine DNS doesn't seem to function and I can't even ping my DNS server by IP (192.168.1.1). Any attempt to ping any resource by name including my primary zone's FQDN fail/timeout. I can only ping other LAN resources by IP.

Not sure if this is useful or a valid test, but when I establish a VPN connection while on the LAN, everything works great and as expected, and I seem to get the exact same network settings assigned by the server as when coming from the Internet.

Just not sure where to go from here? I seem to be on the LAN via the VPN, just can't really use it effectively if I can't leverage internal DNS.

Any suggestions would be much appreciated.

XServe, Mac OS X (10.6), Setup as an Internet Gateway

Posted on Oct 19, 2009 8:13 PM

Reply

Answer 1

Top-ranking reply

TheChinaMac

Level 1

1 points

Oct 20, 2009 6:20 PM in response to MrVDaze

Have you manually entered your server DNS in the VPN DNS settings tab of your client machine? This may not be applicable to you as we use a hardware VPN router as we never could get the Mac VPN working. However, if i connect to our VPN without the DNS entered in my PPTP config I experience a similar issue as you. I can access our shared AFP, ping IPs, but not resolve domains. To fix this I put both our primary and secondary internal DNS plus search domain in the System Preferences/Network/VPN(PPTP)/Advanced/DNS tab of my PPTP connection.

Also i noted that if you have multiple configurations under one VPN interface - all configurations will be set to that DNS. To get around this i had to add multiple VPN interfaces for my various VPNs instead of using multiple configurations under one interface.

Not sure if this will help but its what worked for me. I am new Server as well and been trial and error setting up a couple Mini Servs. It look me a while to break enough things to figure it all out but I now have a slick little setup.

Reply

Answer 2

MrVDaze Author

Level 1

8 points

Oct 21, 2009 10:31 AM in response to TheChinaMac

Thanks for the suggestion.

Not sure if this is odd/expected or not...but the only way I could finally get things working was to set the DNS on the clients to be the WAN IP of the Xserve (was original set as the LAN IP as it should be). Additionally, for some reason I needed to update the firewall rule to allow incoming DNS from the 'any' group. Doesn't makes sense to me, since I would not expect to be coming from the 'any' group once connected via the VPN. Also, I'm still confused as to why I can't use the the internal IP for the DNS server, since I'm connected to the LAN via the VPN and can connect to everything else on the LAN. Oh well...probably just going to move to a separate hardware device for firewall and VPN anyway.

Reply

Answer 3

Oct 23, 2009 1:34 AM in response to MrVDaze

Hi there!

I have the same problem! I even contacted Apple Support to get this solved.

The problem is that UDP (connection-less) traffic (in this case DNS traffic) received on the tunnel interface (ppp) will not sent back over the tunnel interface but over the physical interface (in my case en0). Which shouldn't be the case.

At the moment Apple doesn't have a solution for me.

Here is my post about the same issue:
http://discussions.apple.com/thread.jspa?threadID=2179500&tstart=45

Reply

Answer 4

Oct 21, 2009 5:14 PM in response to MrVDaze

VPN was our biggest headache. We went through 2 months and 2 VPN routers before we finally got it stable. We went from the software VPN to a cheap DLINK VPN to finally a more robust VPN router/firewall from QNO (chinese brand). Its been working perfectly ever since.

On a quick side topic, I would be interested to know if you have ever experienced your wireless connection crashing if your VPN randomly disconnects and/or you disconnect your VPN and try to reconnect to another. This is a consistent issue for me and believe its a bug in 10.6 as its replicable.

Reply

Answer 5

mheydon

Level 1

8 points

Nov 12, 2009 5:12 PM in response to rgruyters

Hi,

Did you ever get a solution from Apple on this as I've got exactly the same issue, I thought it might be something to do with the PIX I have in front of everything but guessing not as I'm not the only person having the issue it seems. I've also had to get round it by pointing VPN users to the external IP of the server and exposing DNS for my internal zone which is far from ideal really.

Mark

Reply

Answer 6

Nov 13, 2009 4:21 PM in response to mheydon

I had the problem and just tried again. New installs (10.6.2) on a Mac Pro and on a Mini with a USB Ethernet for a second NIC. Everything spins up and works perfectly except that there are weird packet losses when a vpn client accesses services on the Gateway. Specifically delays making TCP connections to the gateway and the above-mentioned misrouting of UDP packets.

DNS works fine on the server forward and reverse for itself and external addresses. All the services work. Internal clients using the server for DNS (or not shrug) work great and have no issues accessing the greater internet or services on the Gateway. The Gateway itself can access it's own services without issue too.

sigh

Reply