I have a network where we have mostly stock Ubuntu 18 installs and a local only DNS service for stuff on the network.
What I want is for systems to get their nameservers normally with DHCP when they boot up. They should use the local DNS server for local machines, NOT sending those requests out to the Internet, but do use the Internet servers for all other lookups.
When the users connect with the NetworkManager controlled VPN client (in the menubar), it should use ONLY the VPN's DNS server for non-local requests, never using the ones it got from DHCP, but still continue to use the local server for local requests.
I think I've managed to mostly get local resolving using dnsmasq's "server" options, except that it still forwards requests out to the Internet even for fully qualified local names.
I've tried setting up old style resolv.conf with the local server first (where the server is configured to reject requests instead of forward them), but that fails because Ubuntu's resolver doesn't immediately attempt to use the second server in resolv.conf when the first rejects the request, instead forcing it to time out after 5 seconds before attempting the second server. I can reduce the timeout to 1 second with options timeout:1 but that's still less than ideal and I've not found a way to make network-manager write that option to the resolv.conf when it rewrites the file every time the VPN goes up or down. I would prefer a solution that doesn't fight with NetworkManager, but anything that works would be great.