0

I am using corporate VPN to access internal resources. After connecting via Shrewsoft VPN client these internal resources had not been resolving because resolv.conf was always having DNS another than set to resolve VPN network.

So I installed dnsmasq with the settings:

listen-address=127.0.0.1
domain-needed
bogus-priv
no-resolv
no-poll
strict-order
server=/somedevhost.com/10.4.0.21
server=8.8.8.8
server=/slack-edge.com/8.8.8.8
server=/somedevhost.com/10.4.0.22
no-hosts

Set network-manager to use it:

[main]
dns=dnsmasq
plugins=ifupdown,keyfile
[ifupdown]
managed=false
[device]
wifi.scan-rand-mac-address=no

Now VPN resources are available but some external hosts are resolving slowly or not from first attempt; for example, slack is loading but messages and channel are not with the error in browser's console (I use webclient) - it appears after enabling VPN only:

2018/1/29 12:42:30.595 logging error:
{"subtype":"api_call_error","message":"{\"ok\":false,\"error\":\"not_allowed\"}","stack":"Error\n
at Object.n [as logError]
(https://a.slack-edge.com/bv1-1/rollup-core_required_ts.9069eb596bccc6b1a2d8.min.js:1:62608)\n
at e
(https://a.slack-edge.com/bv1-1/rollup-secondary_a_required.0718dfd6831f53c92d4a.min.js:1:129606)\n    at e
(https://a.slack-edge.com/bv1-1/rollup-secondary_a_required.0718dfd6831f53c92d4a.min.js:1:124805)\n    at e
(https://a.slack-edge.com/bv1-1/rollup-secondary_a_required.0718dfd6831f53c92d4a.min.js:1:126400)\n    at XMLHttpRequest.m.onreadystatechange
(https://a.slack-edge.com/bv1-1/rollup-secondary_a_required.0718dfd6831f53c92d4a.min.js:1:128098)"} (I tried to add slack-edge.com to be served over google dns but it
seem to have no effect)

For me it seems that rule to use devhostname.com DNS servers are applied widely when I expected that it will be used for specified resources only, and google DNS 8.8.8.8 for all other requests.

What am I doing wrong?

  • Please connect your VPN and then add the result of ip route or netstat -rn to your question. (Feel free to obfuscate any network addresses that are internal to your corporate network, but ensure the result remains self-consistent.) Specifically I'm looking to see if your modified default route routes via your VPN and whether that could be reason for slow access to 8.8.8.8. – roaima Jan 30 '18 at 0:06
0

It is not a good standard design practice setting up as resolvers different DNS servers with different visions of the "world".

Leaving those kind of decisions for whom to talk/ask does not lead to good results. You have to deal with DNS servers errors, or even with negative cache timeouts.

Then there are full VPN tunnels and split VPN tunnels. In the first a conscious setup was made for deterring the end users for using the Internet while they are with the VPN active.

One choice is to setup some DNS server setup on your side that only forwards DNS internal names to the other side of the VPN.

In the past, we did not have strict security requirements, and for no-so-trusted people, we gave them split VPN tunnels.

For the people we trusted, we gave full VPN tunnels that allowed them to reach the Internet. We also forced the DNS requests to go through own our DNS servers, no matter what DNS server they had configured, and it worked pretty well. If you are not the one managing the VPN, bear in mind you might be dealing with such configuration too.

Again, bear also in mind a full VPN tunnel might be configured to block the Internet access and only give access to corporate assets i.e. it might prevent you using the Internet by design.

Talk with your networking guys.

  • The problem is from few colleagues on ubuntu only I have such problems, others have not. So I suggest that it is configuration issue on my side – Vladimir Kolenov Jan 29 '18 at 10:50
  • @VladimirKolenov There are many things that can and do go wrong, at several layers of the OSI layer. (...) Obviously, your question is too broad, and we cannot guess or do a full remote debug. – Rui F Ribeiro Jan 29 '18 at 10:52
  • (the web client also has limitations AFAIR) – Rui F Ribeiro Jan 29 '18 at 11:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.