I have a network where we have mostly stock Ubuntu 18 installs and a local only DNS service for stuff on the network.

What I want is for systems to get their nameservers normally with DHCP when they boot up. They should use the local DNS server for local machines, NOT sending those requests out to the Internet, but do use the Internet servers for all other lookups.

When the users connect with the NetworkManager controlled VPN client (in the menubar), it should use ONLY the VPN's DNS server for non-local requests, never using the ones it got from DHCP, but still continue to use the local server for local requests.

I think I've managed to mostly get local resolving using dnsmasq's "server" options, except that it still forwards requests out to the Internet even for fully qualified local names.

I've tried setting up old style resolv.conf with the local server first (where the server is configured to reject requests instead of forward them), but that fails because Ubuntu's resolver doesn't immediately attempt to use the second server in resolv.conf when the first rejects the request, instead forcing it to time out after 5 seconds before attempting the second server. I can reduce the timeout to 1 second with options timeout:1 but that's still less than ideal and I've not found a way to make network-manager write that option to the resolv.conf when it rewrites the file every time the VPN goes up or down. I would prefer a solution that doesn't fight with NetworkManager, but anything that works would be great.


1 Answer 1


For anybody else who stumbles across this question, the answer that I am currently using is this:

How to configure systemd-resolved and systemd-networkd to use local DNS server for resolving local domains and remote DNS server for remote domains?

However it does have a problem. Every time you query a remote address it sends a flurry of requests to the local server despite what the documentation says. Since my local server is fast and the lab does not have a lot of people in it this is acceptable, but as a general solution it may not scale well.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .