Some hosts resolves slowly or does not resolved at all with dnsmasq

Question

I am using corporate VPN to access internal resources. After connecting via Shrewsoft VPN client these internal resources had not been resolving because resolv.conf was always having DNS another than set to resolve VPN network.

So I installed dnsmasq with the settings:

listen-address=127.0.0.1
domain-needed
bogus-priv
no-resolv
no-poll
strict-order
server=/somedevhost.com/10.4.0.21
server=8.8.8.8
server=/slack-edge.com/8.8.8.8
server=/somedevhost.com/10.4.0.22
no-hosts

Set network-manager to use it:

[main]
dns=dnsmasq
plugins=ifupdown,keyfile
[ifupdown]
managed=false
[device]
wifi.scan-rand-mac-address=no

Now VPN resources are available but some external hosts are resolving slowly or not from first attempt; for example, slack is loading but messages and channel are not with the error in browser's console (I use webclient) - it appears after enabling VPN only:

2018/1/29 12:42:30.595 logging error:
{"subtype":"api_call_error","message":"{\"ok\":false,\"error\":\"not_allowed\"}","stack":"Error\n
at Object.n [as logError]
(https://a.slack-edge.com/bv1-1/rollup-core_required_ts.9069eb596bccc6b1a2d8.min.js:1:62608)\n
at e
(https://a.slack-edge.com/bv1-1/rollup-secondary_a_required.0718dfd6831f53c92d4a.min.js:1:129606)\n    at e
(https://a.slack-edge.com/bv1-1/rollup-secondary_a_required.0718dfd6831f53c92d4a.min.js:1:124805)\n    at e
(https://a.slack-edge.com/bv1-1/rollup-secondary_a_required.0718dfd6831f53c92d4a.min.js:1:126400)\n    at XMLHttpRequest.m.onreadystatechange
(https://a.slack-edge.com/bv1-1/rollup-secondary_a_required.0718dfd6831f53c92d4a.min.js:1:128098)"} (I tried to add slack-edge.com to be served over google dns but it
seem to have no effect)

For me it seems that rule to use devhostname.com DNS servers are applied widely when I expected that it will be used for specified resources only, and google DNS 8.8.8.8 for all other requests.

What am I doing wrong?

Answer 1

It is not a good standard design practice setting up as resolvers different DNS servers with different visions of the "world".

Leaving those kind of decisions for whom to talk/ask does not lead to good results. You have to deal with DNS servers errors, or even with negative cache timeouts.

Then there are full VPN tunnels and split VPN tunnels. In the first a conscious setup was made for deterring the end users for using the Internet while they are with the VPN active.

One choice is to setup some DNS server setup on your side that only forwards DNS internal names to the other side of the VPN.

In the past, we did not have strict security requirements, and for no-so-trusted people, we gave them split VPN tunnels.

For the people we trusted, we gave full VPN tunnels that allowed them to reach the Internet. We also forced the DNS requests to go through own our DNS servers, no matter what DNS server they had configured, and it worked pretty well. If you are not the one managing the VPN, bear in mind you might be dealing with such configuration too.

Again, bear also in mind a full VPN tunnel might be configured to block the Internet access and only give access to corporate assets i.e. it might prevent you using the Internet by design.

Talk with your networking guys.