DNS over VPN

Question

Level 1

8 points

DNS over VPN

Hi community,

I am having some trouble with dns over vpn. On server side of VPN the dns is working 100% i.e servername.domain.com resolves to local IP address correctly from within network. However, when i connect into network over VPN the dns does not work correctly - it resolves servername correctly but not servername.domain.com. I can overcome this by setting VPN above my Ethernet adaptor in service order but then all my traffic gets routed over VPN connection (which i don't want) - even if I try adding network routing defn on VPN server. I probably need to do something on the VPN client (Snow leopard 10.6.1)?

Please help! 🙂

Mac OS X (10.6.1)

Posted on Nov 9, 2009 2:34 AM

Reply

Answer 1

MrHoffman

Level 10

146,299 points

Nov 9, 2009 6:02 AM in response to cmortimer

What sort of DNS configuration are you running? If you're running split-horizon/split-brain/split-view/etc DNS, do you have the VPN set to route all of the DNS traffic to your DNS server and to no other DNS servers?

Reply

Answer 2

cmortimer Author

Level 1

8 points

Nov 11, 2009 3:43 AM in response to MrHoffman

Im running dnsmasq on openwrt, yes i have specified the vpn config on the server side to use this dns server (by IP address). And as i mentioned, it partially works, it resolves hostname but does not resolve hostname.domain.com

Reply

Answer 3

MrHoffman

Level 10

146,299 points

Nov 11, 2009 5:41 AM in response to cmortimer

Rather than dnsmasq and openwrt, I'd look at the DNS server here.

My guess here would be that the DNS configuration is invalid, or the domain name incorrect, or such.

For a simple split-brain, you'll have one forward zone with your local Mac OS X Server box as the DNS server, and one (created for you) reverse DNS zone. And you'll be using a unique domain name or (far better) a publicly-registered DNS domain. But this smells like a DNS error.

Post the +dig -x+ of the IP address on your LAN, and the +dig host+ and +dig host.example.com+ of the domain name on your LAN. And given this DNS information is either public or is behind a firewall and thus accessible only via VPN, please post the real data rather than masked data.

Reply