0

I connect to a remote VPN using NetworkManager and the openconnect (Cisco Anyconnect) pluging under Xubuntu 20.4. All works fine, except DNS resolution of services inside the VPN.

The remote VPN Gateway forwards its private DNS severs, as can be seen in the syslog output below (slightly shortened and anonymized):

... NetworkManager[701]: <info>  [..] vpn-connection[...]: VPN connection: (IP Config Get) reply received.
... NetworkManager[701]: <info>  [..] vpn-connection[...]: VPN connection: (IP4 Config Get) reply received
... NetworkManager[701]: <info>  [..] vpn-connection[...]: Data: VPN Gateway: 195.xxx.xxx.xxx
... NetworkManager[701]: <info>  [..] vpn-connection[...]: Data: Tunnel Device: "vpn0"
... NetworkManager[701]: <info>  [..] vpn-connection[...]: Data: IPv4 configuration:
... NetworkManager[701]: <info>  [..] vpn-connection[...]: Data:   Internal Address: 10.57.0.188
... NetworkManager[701]: <info>  [..] vpn-connection[...]: Data:   Internal Prefix: 8
... NetworkManager[701]: <info>  [..] vpn-connection[...]: Data:   Internal Point-to-Point Address: 10.57.0.188
... NetworkManager[701]: <info>  [..] vpn-connection[...]: Data:   Static Route: 10.0.0.0/8   Next Hop: 0.0.0.0
... NetworkManager[701]: <info>  [..] vpn-connection[...]: Data:   Internal DNS: 10.240.4.62
... NetworkManager[701]: <info>  [..] vpn-connection[...]: Data:   Internal DNS: 10.240.4.60
... NetworkManager[701]: <info>  [..] vpn-connection[...]: Data:   DNS Domain: 'xxx.yyy.global'
... NetworkManager[701]: <info>  [..] vpn-connection[...]: Data: No IPv6 configuration
... NetworkManager[701]: <info>  [..] vpn-connection[...]: Data: Login Banner:
... NetworkManager[701]: <info>  [..] vpn-connection[...]: Data: -----------------------------------------
... NetworkManager[701]: <info>  [..] vpn-connection[...]: Data: xxxx
... NetworkManager[701]: <info>  [..] vpn-connection[...]: Data: -----------------------------------------
... NetworkManager[701]: <info>  [..] vpn-connection[...]: VPN plugin: state changed: started (4)
... NetworkManager[701]: <info>  [..] vpn-connection[...]: VPN connection: (IP Config Get) complete

NetworkManager correctly forwards the DNS server addresses and the DNS Domain to systemd-resolved:

% systemd-resolve --status
Global
[...]

Link 3 (vpn0)
      Current Scopes: DNS                
DefaultRoute setting: yes                
       LLMNR setting: yes                
MulticastDNS setting: no                 
  DNSOverTLS setting: no                 
      DNSSEC setting: no                 
    DNSSEC supported: no                 
  Current DNS Server: 10.240.4.62        
         DNS Servers: 10.240.4.62        
                      10.240.4.60        
          DNS Domain: xxx.yyy.global

Link 2 (ens33)
[...]        

Still, if I want to ping a URL should be resolvable in the VPN, it doesn't work:

% ping foo.bar.com
ping: foo.bar.com: Name or service not known

Checking the situation with Wireshark reveals that somehow the DNS query is wrong. I don't know why, but systemd-resolved doesn't query for foo.bar.com, but for foo.bar.com.xxx.yyy.global, where the latter part apparently comes from the "DNS Domain" (not sure what that actually is).

wireshark screenshot

On another system (of a colleague) the DNS query works correctly (the DNS Domain is not appended). One notable difference there is that (I think) he uses resolvconf instead of systemd-resolved. I think so because /etc/resolv.conf there is a symlink to /run/resolvconf/resolv.conf, rather than /run/systemd/resolve/stub-resolv.con.

Can someone explain me what's going on with systemd-resolved, or how I can configure it to make a correct DNS query?

  • Dotless DNS names are strictly local, never sent to DNS servers. And systemd works hard to enforce that rule. – Isaac Jul 2 at 14:27
  • Mistake in my anonymization - it's actually not dotless, but something like foo.bar.com. Sorry for the confusion, I'll update the question. – Georg P. Jul 2 at 15:02
1
 % ping foo.bar.com 

That is not a fully-qualified human-readable-form domain name. In human-readable form, fully-qualified domain names end with a full stop. The Domain Name System proper always (in effect) works with fully-qualified domain names. The DNS client libraries linked into applications therefore transform the names that you give to applications into fully-qualified ones before using them in DNS lookups. They do this in various ways, too many to go into here, and clearly one way being employed on your particular system is to add that "Domain" suffix that has been configured.

 % ping foo.bar.com. 

This is how to pass a fully-qualified domain name to the ping program.

Further reading

| improve this answer | |
  • Wow, good reading, I never heard of that before. Anyway, it still doesn't work. When I call ping foo.bar.com., the DNS query is correct, but sent to the wrong server! It is only sent to my default DNS server, but not the one from the VPN. Why oh why...? – Georg P. Jul 3 at 6:44
  • That's a different question. – JdeBP Jul 3 at 7:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.