DNS temporarily fails with VPN addresses

Question

I'm connecting to a company network on Lubuntu 15.10 with vpnc either on terminal or via the network manager. Sometimes I can reach the intranet hosts fine, then suddenly they are gone. Then they come back. I don't change anything on the settings, my connection is otherwise stable. It's very frustrating.

I can usually always reach them via their ip but not their host name. Here is the output of dig only 5 minutes apart, one time it fails the other time it doesn't.

; <<>> DiG 9.9.5-11ubuntu1-Ubuntu <<>> some.intranet.host
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 7423
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1280
;; QUESTION SECTION:
;some.intranet.host.        IN  A

;; ANSWER SECTION:
some.intranet.host. 3500    IN  A   10.0.20.107

;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Thu Dec 10 18:46:17 CET 2015
;; MSG SIZE  rcvd: 65

---

; <<>> DiG 9.9.5-11ubuntu1-Ubuntu <<>> some.intranet.host
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 17766
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1280
;; QUESTION SECTION:
;some.intranet.host.        IN  A

;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Thu Dec 10 19:06:35 CET 2015
;; MSG SIZE  rcvd: 49

I'm not good with network setup and struggle to debug it. The content of my resolv.conf when connected to the vpn:

# Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8)
#     DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN
nameserver 127.0.0.1
search intranet.host intranet fritz.box

---

ifconfig tun0
tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:172.16.0.138  P-t-P:172.16.0.138  Mask:255.255.255.0
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1412  Metric:1
          RX packets:46575 errors:0 dropped:0 overruns:0 frame:0
          TX packets:36452 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:500 
          RX bytes:45875777 (45.8 MB)  TX bytes:4059895 (4.0 MB)

---

Update:

Despite deactivating dnsmasq I can see a running process after reboot and my resolv.conf still holds 127.0.0.1 as nameserver. After I kill the process I cannot resolve web addresses anymore. I assume I would need to take out the nameserver from resolv.conf manually then?

$ grep dnsmasq /etc/NetworkManager/NetworkManager.conf
#dns=dnsmasq

$ ps aux|grep dnsmas
dnsmasq   1730  0.0  0.0  49580  3052 ?        S    16:26   0:00 /usr/sbin/dnsmasq -x /var/run/dnsmasq/dnsmasq.pid -u dnsmasq -r /var/run/dnsmasq/resolv.conf -7 /etc/dnsmasq.d,.dpkg-dist,.dpkg-old,.dpkg-new --local-service

Answer 1

The Ubuntus ship with dnsmasq enabled as a default. Dnsmasq is 1) a DNS caching proxy (for performance) and 2) a DHCP server. I cannot find a reason why a typical home user talking to a typical home router would need dnsmasq to duplicate these two services that your router provides.

The first step is to disable dnsmasq:

$ grep dnsmasq /etc/NetworkManager/NetworkManager.conf 
#dns=dnsmasq
$ sudo service network-manager restart
$ sudo killall dnsmasq

Before anything else, it would be a good idea to confirm that your network connectivity remains unchanged. If you see a performance hit in DNS, I'd be surprised.

Fire up vpnc; I run it manually also, no NetworkManager aid for me. You may have to re-point the default route to your VPN. You can find the VPN tunnel pseudo-device with ifconfig; mine is named tun0

$ sudo route del default ; sudo route add default tun0

I suggest keeping them on one line in case having no default router jams up your terminal (it shouldn't, but...).

The first code block above is done once. The default route, if it needs to be changed at all, needs to be done every time you VPN. I have simple script that does all this which I'm not posting here because without better understanding of NetworkManager I consider it too localized.

Answer 2

My working setup now for the same client/vpn situation under Debian bullseye/sid/unstable is to take out NetworkManager from the equation.

1. Remove NetworkManager (you probably won't be able to connect to Wifis by the regular tray icon GUI then!)

   sudo apt remove network-manager-gnome network-manager sudo apt install dnsmasq

2. Use a simple custom dnsmasq config.

File: /etc/dnsmasq.d/your-name

# Use my router as default
server=192.168.2.1
# Use some-company dns for intranet hosts
server=/some-company.com/10.49.123.5
server=/.foo/10.49.123.5

Optionally add these two lines for debugging via the logs:

log-queries
log-dhcp

Docs at: https://wiki.ubuntuusers.de/Dnsmasq/

2. Make sure /etc/resolv.conf is not a symbolic link and make it point to dnsmasq. That's important because the vpn scripts up/down scripts may try to change the file and mess up your configuration on connect/disconnect.

File: /etc/resolv.con

nameserver 127.0.0.1

YMMV: Since I still saw something override my /etc/resolf.conf I added a line to the end of /etc/dhcp/dhclient.conf:

supersede domain-name-servers 127.0.0.1;                                                                                            

3. Restart services

   /etc/init.d/networking restart
   sudo /etc/init.d/dnsmasq restart

This finally makes it work for non-company and company addresses when I'm connected or not connected to the VPN.