OpenVPN, resolvconf, and DNS domain resolution

Question

While at site1, I need to connect to site2 via OpenVPN. Once connected, the OpenVPN site2 pushes a DNS nameserver and domain search options. This causes all name resolutions for site1 to fail.

Example:

1. Physically connected at site1, DHCP pushes DNS options and resolvconf manages them.
   /etc/resolv.conf

   # Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8)
   #     DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN
   nameserver 172.16.1.101
   nameserver 172.16.1.102
   search site1.internal.domain
   

2. Open OpenVPN tunnel to site2, OpenVPN pushes dhcp-option DNS and DOMAIN for site2 and /etc/openvpn/update-resolv-conf pushes them to resolvconf.
   /etc/resolv.conf

   # Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8)
   #     DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN
   nameserver 192.168.1.5
   nameserver 172.16.1.101
   nameserver 172.16.1.102
   search site2.internal.domain site1.internal.domain
   

3. DNS resolution works for server.site2.internal.domain but fails for server.site1.internal.domain

Is there a way that any failed DNS request to site21 should fall-through to the site1 DNS servers? Or configure resolvconf that only queries for site2.internal.domain should be passed to the site2 nameserver?

I use an Ubuntu 14.04 machine at site1, and the OpenVPN server at site2 is a pfSense 2.2 box. I manage both sites so making changes to either side isn't a problem. Both domains are non-public and internal use only.

Answer 1

You can set up a local caching server that will watch your /etc/resolv.conf, as it's changed by resolvconf scripts, and try get its answers from all nameservers listed there.

On many systems it'll be enough to install the dnsmasq package, in addition to resolvconf.

The defaults should "just work" provided that no-resolv and no-poll directives are absent from /etc/dnsmasq.conf and lo interface is at the top of /etc/resolvconf/interface-order. If an upstream nameserver returns some arbitrary IPs for unresolvable addresses, strict-order in dnsmasq.conf can help. Your /etc/resolv.conf should only show nameserver 127.0.0.1.

If you prefer a fixed setup or connect to multiple unrelated networks and want to avoid leaking your private network names too all nameservers you should configure dnsmasq to query specific servers based on domain:

# /etc/dnsmasq.conf

# site1 servers
nameserver=/site1.internal.domain/172.16.1.101
nameserver=/site1.internal.domain/172.16.1.102

# site2 servers
nameserver=/site2.internal.domain/192.168.1.5

# default OpenNIC (optional, unless 'no-resolv' is set). 
server=51.15.98.97
server=172.104.136.243

For more info on dnsmasq options see here: http://oss.segetech.com/intra/srv/dnsmasq.conf

Answer 2

I haven't tried this on Ubuntu, but I was able to get a similar setup working on Arch Linux using openresolv and dnsmasq.

All changes will be on the VPN client machine. The VPN server should not need any changes because it already includes the DNS nameserver and domain search options.

1. While connected to the VPN, use resolvconf -l to see all the resolv.conf files. Figure out the resolvconf name of your VPN interface (i.e. the X in "resolv.conf from X"). In my case, it was tun0, which I'll use in the remaining config.
2. Install dnsmasq

3. Edit /etc/resolvconf.conf to add these options:

   private_interfaces=tun0
   name_servers="::1 127.0.0.1"
   dnsmasq_conf=/etc/dnsmasq-conf.conf
   dnsmasq_resolv=/etc/dnsmasq-resolv.conf
   

4. Edit /etc/dnsmasq.conf to add these options:

   conf-file=/etc/dnsmasq-conf.conf
   resolv-file=/etc/dnsmasq-resolv.conf
   

5. Run resolvconf -u to generate the dnsmasq config files.

6. Start the dnsmasq service and configure it to start on boot. On Arch, this is done by running:

   systemctl start dnsmasq.service
   systemctl enable dnsmasq.service
   

The name_servers option tells resolvconf to list only those nameservers in /etc/resolv.conf (i.e. it points at your local dnsmasq instance). The dnsmasq_ options tell resolvconf to write the nameservers that would have gone into /etc/resolv.conf to dnsmasq config files instead.

The private_interface option tells resolvconf that the nameservers provided by that interface (your VPN) should be used only when resolving hostnames that are in one of the domains specified on the search line. It will generate the appropriate dnsmasq config to make that happen.

With this config, requests for hosts under site2.internal.domain should go to 192.168.1.5, and all other requests should go to 172.16.1.101 or 172.16.1.102.

If your system doesn't use IPv6, remove the ::1 from the name_servers option.

Answer 3

resolv.conf list all availables DNS servers. As long as the first one in the list is up and running, all queries will be send to it. Nothing to the others unless the first one is down. So, if the first DNS server in list is up and know the answer, he reply "I know it !", else he'll say "I'm afraid I don't know...". And that's all. You have to make 192.168.1.5 (the DNS server of site2) aware of all entries of site1, and vice-versa of course. Greetings