DNS lookup fails from iOS client via Mac VPN server

Question

Level 6

13,697 points

DNS lookup fails from iOS client via Mac VPN server

I am trying to help someone running a Mac OS X 10.6.8 Server and Apple's VPN server with iOS clients (e.g. an iPhone 4S running 5.1.1).

The Mac Server and iOS client can successfully connect over L2TP and by entering a numeric IP address the iOS device can access a webserver on the private network or public internet. However any attempt to use a hostname e.g. server.example.com or even a public name such as www.google.com fails. It is clear from testing that DNS lookups are failing.

The iOS device is configured to route all traffic via the VPN link, if this option is turned off then DNS lookups work. However the whole point of wanting to use a VPN setup to ensure all traffic is encrypted when using public networks so having public traffic not go via the VPN is not an option.

While we would not normally want ot use PPTP I have tested that and got the same results.

Any suggestions?

Posted on Jun 11, 2012 4:50 AM

Reply

Answer 1

capaho

Level 4

3,677 points

Jun 11, 2012 7:09 AM in response to John Lockwood

John Lockwood wrote:

It is clear from testing that DNS lookups are failing.

It shouldn't make any difference what the client device is for DNS lookups if DNS is configured correctly on the server and its name servers. If DNS lookups are failing only on certain client devices but not others then I would suspect configuration errors on the client devices. If all DNS lookups are failing then DNS is not configured correctly for the server or the server's name servers, if they are not the same.

Reply

Answer 2

John Lockwood Author

Level 6

13,697 points

Jun 11, 2012 7:27 AM in response to capaho

So far we are only testing with iOS devices as clients, DNS lookups work on the VPN server itself. The VPN server is not the DNS server. We have tried putting a) nothing, b) the internal DNS server, c) an external DNS server in the field in the VPN server configuration with no difference in result.

Reply

Answer 3

capaho

Level 4

3,677 points

Jun 11, 2012 6:00 PM in response to John Lockwood

Use the host command on a different Mac and see if the IP address resolves:

host 123.456.789.012

It should return a reverse lookup with the domain name:

012.789.456.123.in-addr.arpa domain name pointer some_domain.com.

If it doesn't, the name servers for the domain are not configured correctly.

If the IP address resolves correctly from a remote machine, either the VPN or the DNS on the VPN machine are not configured correctly or there is possibly a firewall configuration issue.

Reply

Answer 4

John Lockwood Author

Level 6

13,697 points

Aug 1, 2012 5:36 AM in response to John Lockwood

I have done more investigation and have now found the following.

While from the client devices point of view it looks like DNS lookups fail this was merely a symptom rather than the cause of failing to be able to access addresses.

It turns out the problem is that when the client device is accessing the remote internal network (which works fine) this is correctly going through the VPN servers second LAN interface which is connected to the internal LAN at the office. When the client device is accessing a public address and when the VPN is set to route all traffic via the VPN server the traffic is exiting via the VPN servers first LAN interface which is connected to the DMZ port of a firewall. This behaviour in of itself is correct but the firewall is seeing the packets as coming from an unexpected IP address, rather than looking like they are coming from the VPN server itself, they look like they are coming from a spoofed address which is actually the remote clients public IP address.

As a result the the firewall is blocking all the traffic in this case including DNS lookups.

I would at least partially consider this to be the fault of the VPN server not producing packets with correct IP addresses. I plan to try the following as possible solutions.

Build a test Lion or Mountain Lion VPN server and see if it works any better.
Replace the old firewall with a new one which supports OS X and iOS standard VPN client software, the current one only supports the manufacturers client, they do have a version for OS X and iOS but I want to use the standard Apple client.
I could move the first LAN port of the VPN server from the DMZ to the WAN side of the firewall, the firewall then obviously would not be able to block the traffic.

Note: I am aware I could have just a single LAN connection on the VPN server on the internal LAN and setup port-forwarding in the firewall, I prefer not to do this.

Reply