Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

I am using a MacBook with Mac OS X 10.8.2 and connect to my company's network via VPN. Everything works great when establishing the VPN connection via LAN or WLAN. However, when I use a dial-up connection (Huawei HSDPA USB Stick) host names are not correctly resolved in applications (e.g. Web-Browser). Command line tools like host name will correctly resolve the IP address, ping name will not resolve.

Using scutil --dns I dumped the DNS configuration when connecting via WLAN vs. dial-up. There is a notable difference in the lookup order:

connecting using WLAN:

resolver #1
  nameserver[0] : 192.168.80.10
  nameserver[1] : 192.168.80.24
  if_index : 6 (ppp0)
  reach    : Reachable,Transient Connection
  order    : 100000

resolver #2
  nameserver[0] : 192.168.80.10
  nameserver[1] : 192.168.80.24
  if_index : 6 (ppp0)
  reach    : Reachable,Transient Connection
  order    : 200000

resolver #3
  domain   : local
  options  : mdns
  timeout  : 5
  order    : 300000

resolver #4
  domain   : 254.169.in-addr.arpa
  options  : mdns
  timeout  : 5
  order    : 300200

resolver #5
  domain   : 8.e.f.ip6.arpa
  options  : mdns
  timeout  : 5
  order    : 300400

resolver #6
  domain   : 9.e.f.ip6.arpa
  options  : mdns
  timeout  : 5
  order    : 300600

resolver #7
  domain   : a.e.f.ip6.arpa
  options  : mdns
  timeout  : 5
  order    : 300800

resolver #8
  domain   : b.e.f.ip6.arpa
  options  : mdns
  timeout  : 5
  order    : 301000

DNS configuration (for scoped queries)

resolver #1
  nameserver[0] : 192.168.1.1
  if_index : 4 (en0)
  flags    : Scoped
  reach    : Reachable,Directly Reachable Address

resolver #2
  nameserver[0] : 192.168.80.10
  nameserver[1] : 192.168.80.24
  if_index : 6 (ppp0)
  flags    : Scoped
  reach    : Reachable,Transient Connection

The ppp0 connection is the VPN connection. As you can see, two servers are connected and they answer correctly on the command line and in applications.

Connecting via UMTS:

resolver #1
  nameserver[0] : 139.7.30.126
  nameserver[1] : 139.7.30.125
  if_index : 6 (ppp0)
  reach    : Reachable,Transient Connection
  order    : 100000

resolver #2
  nameserver[0] : 192.168.80.10
  nameserver[1] : 192.168.80.24
  if_index : 7 (ppp1)
  reach    : Reachable,Transient Connection
  order    : 100000

resolver #3
  nameserver[0] : 192.168.80.10
  nameserver[1] : 192.168.80.24
  if_index : 7 (ppp1)
  reach    : Reachable,Transient Connection
  order    : 200000

resolver #4
  domain   : local
  options  : mdns
  timeout  : 5
  order    : 300000

resolver #5
  domain   : 254.169.in-addr.arpa
  options  : mdns
  timeout  : 5
  order    : 300200

resolver #6
  domain   : 8.e.f.ip6.arpa
  options  : mdns
  timeout  : 5
  order    : 300400

resolver #7
  domain   : 9.e.f.ip6.arpa
  options  : mdns
  timeout  : 5
  order    : 300600

resolver #8
  domain   : a.e.f.ip6.arpa
  options  : mdns
  timeout  : 5
  order    : 300800

resolver #9
  domain   : b.e.f.ip6.arpa
  options  : mdns
  timeout  : 5
  order    : 301000

DNS configuration (for scoped queries)

resolver #1
  nameserver[0] : 192.168.80.10
  nameserver[1] : 192.168.80.24
  if_index : 7 (ppp1)
  flags    : Scoped
  reach    : Reachable,Transient Connection

resolver #2
  nameserver[0] : 139.7.30.126
  nameserver[1] : 139.7.30.125
  if_index : 6 (ppp0)
  flags    : Scoped
  reach    : Reachable,Transient Connection

This time, ppp1 is the VPN connection and ppp0 is the UMTS connection. From the response times of the commands (using the non-existing hostname foo.bar.local) I infer that ping uses the first resolver chain, where as host uses the scoped query configuration. ping takes 5 seconds to return "Unkown host", hostgets back immediately. I assume ping runs into the 5 second timeout of the mdns resolver.

In order to fix my problem with the broken DNS lookups when dialing in via VPN over modem I need to change the order of the resolvers. So far I have not found a way of doing this.

Any ideas welcome.

share|improve this question
add comment

10 Answers 10

I have the same problem. I have tried changing the order of responders in my Network prefpane, and it has not been successful.

Here are screenshots of my network configuration.

Also puzzling to me is that the VPN does NOT have my office domain in the search domain list, but the first resolver still specifies my office domain to go over the VPN.

Even more curious: attempting to do traceroute support.inresonance.com gives "unknown host", but doing host support.inresonance.com returns the correct IP address.

Suggestions?

Without the VPN:


resolver #1
  search domain[0] : inresonance.com
  nameserver[0] : 10.32.123.82
  nameserver[1] : 10.32.123.87
  nameserver[2] : 10.32.123.82
  if_index : 4 (en0)
  reach    : Reachable,Directly Reachable Address

resolver #2
  domain   : local
  options  : mdns
  timeout  : 5
  order    : 300000

resolver #3
  domain   : 254.169.in-addr.arpa
  options  : mdns
  timeout  : 5
  order    : 300200

resolver #4
  domain   : 8.e.f.ip6.arpa
  options  : mdns
  timeout  : 5
  order    : 300400

resolver #5
  domain   : 9.e.f.ip6.arpa
  options  : mdns
  timeout  : 5
  order    : 300600

resolver #6
  domain   : a.e.f.ip6.arpa
  options  : mdns
  timeout  : 5
  order    : 300800

resolver #7
  domain   : b.e.f.ip6.arpa
  options  : mdns
  timeout  : 5
  order    : 301000

resolver #8
  domain   : inresonance.com
  nameserver[0] : 10.32.123.1

DNS configuration (for scoped queries)

resolver #1
  search domain[0] : inresonance.com
  nameserver[0] : 10.32.123.82
  nameserver[1] : 10.32.123.87
  nameserver[2] : 10.32.123.82
  if_index : 4 (en0)
  flags    : Scoped
  reach    : Reachable,Directly Reachable Address

resolver #2
  search domain[0] : inresonance.com
  nameserver[0] : 10.32.123.82
  nameserver[1] : 10.32.123.87
  nameserver[2] : 10.32.123.82
  if_index : 5 (en1)
  flags    : Scoped
  reach    : Reachable,Directly Reachable Address

With the VPN:


DNS configuration

resolver #1
  search domain[0] : inresonance.com
  nameserver[0] : 10.41.220.10
  nameserver[1] : 10.41.220.11
  if_index : 8 (ppp0)
  reach    : Reachable,Transient Connection
  order    : 100000

resolver #2
  nameserver[0] : 10.32.123.82
  nameserver[1] : 10.32.123.87
  nameserver[2] : 10.32.123.82
  if_index : 4 (en0)
  reach    : Reachable,Directly Reachable Address
  order    : 200000

resolver #3
  domain   : local
  options  : mdns
  timeout  : 5
  order    : 300000

resolver #4
  domain   : 254.169.in-addr.arpa
  options  : mdns
  timeout  : 5
  order    : 300200

resolver #5
  domain   : 8.e.f.ip6.arpa
  options  : mdns
  timeout  : 5
  order    : 300400

resolver #6
  domain   : 9.e.f.ip6.arpa
  options  : mdns
  timeout  : 5
  order    : 300600

resolver #7
  domain   : a.e.f.ip6.arpa
  options  : mdns
  timeout  : 5
  order    : 300800

resolver #8
  domain   : b.e.f.ip6.arpa
  options  : mdns
  timeout  : 5
  order    : 301000

resolver #9
  domain   : inresonance.com
  nameserver[0] : 10.32.123.1

DNS configuration (for scoped queries)

resolver #1
  search domain[0] : inresonance.com
  nameserver[0] : 10.32.123.82
  nameserver[1] : 10.32.123.87
  nameserver[2] : 10.32.123.82
  if_index : 4 (en0)
  flags    : Scoped
  reach    : Reachable,Directly Reachable Address

resolver #2
  search domain[0] : inresonance.com
  nameserver[0] : 10.32.123.82
  nameserver[1] : 10.32.123.87
  nameserver[2] : 10.32.123.82
  if_index : 5 (en1)
  flags    : Scoped
  reach    : Reachable,Directly Reachable Address

resolver #3
  nameserver[0] : 10.41.220.10
  nameserver[1] : 10.41.220.11
  if_index : 8 (ppp0)
  flags    : Scoped
  reach    : Reachable,Transient Connection
share|improve this answer
    
Hi irCristos, same here. The different applications and command line tools behave differently. I assume they use different set of configurations for dns lookup. –  user1248552 Jul 15 '13 at 19:05
add comment

I found a workaround: your VPN DNS will still be ignored, and only 3G-dongle DNS will be used, but just adding your VPN DNS to the list under 3G interface does the trick… The main problem is that 3G connectivity manager overwrites configuration everytime you click connect, and you need connectivity manager to enable Radio on the 3G dongle… so I mixed both solutions in one:

  1. Connect to your VPN and write down your DNS (I have 2 on the list). You can check it in Network Preferences → Advanced → DNS tab. Disconnect VPN. You need to connect to VPN because DNS is assigned dynamically upon connection…

  2. Connect to your 3G and do the same: write the DNS on paper. Then disconnect 3G.

  3. Go to Network Preferences → click on 3G interface → Advanced → DNS Tab, and under DNS table (that typically will be empty as you are not connected) click on '+'. Add all the DNS servers (those from 3G first and then add VPN later). Click OK and Apply.

  4. From now on, to connect to 3G, just plug your USB and wait until you have 3G coverage (you will need to open 3G connectivity manager), but do not use the supplied connectivity manager to connect. And if it automatically connects, go to preferences and uncheck that tick. You need that manager only to turn radio on in the USB Dongle, nothing else.

    If you click on "connect" on your 3G manager, it will overwrite configuration on your 3G interface and you need to repeat step 3 again.

  5. Go to Network → Preferences and click on the 3G interface. Then click connect. It will connect to your 3G using the configured DNS servers (instead of dynamically received), that include both the "public" DNS and your VPN DNS.

  6. Connect to your VPN. It will work as expected.

Just be aware that:

  • If your VPN DNS changes, you need to change it manually. This can easily be checked under Network → VPN interface w Advanced → DNS tab since your VPN DNS is still assigned dynamically to the interface (although ignored by OS X).

  • If your 3G DNS changes (unlikely) you need to change it manually too. If something goes wrong and you cannot navigate you need to go through your 3G connectivity manager, click "Connect" and see what DNS are dynamically assigned… That will require you to go back to step 3 and reconfigure it.

share|improve this answer
add comment

I had the same issue for long time, but now I had time to find a solution that works for me. I didn't change the order of the DNS server, but I'm using the DNS server behind the VPN permanently.

  1. Connect via dial-up.

  2. Connect the VPN connection and copy the DNS server IPs and the search domain from VPN Connection → Advanced → DNS.

  3. Disconnect the VPN connection.

  4. Ping <name> or <hostname> of your VPN server and write down the IP.

  5. Disconnect the dial-up connection.

  6. Duplicate the dial-up connection (e.g. name it "3G for VPN").

  7. Enter the IPs and the search domain into the DNS tab of the dial-up connection. They will be stored and used permanently.

  8. Connect via the new dial-up connection.

  9. Now you have no access to the nameservers (because they are secured by the VPN) - you have to edit the server address of the VPN connection. Replace the host by the IP.

  10. Connect via VPN connection and you should be able to use it.

Note: In general hostnames does not change, but IPs can. So if it's not working someday, do the steps again…

share|improve this answer
    
Hi Alexander, that sounded like a promising approach. However, I did not had any luck although the order of the dns resolver looked pretty good. Have to check again with our IT. –  user1248552 Jul 15 '13 at 19:03
add comment

Does not work in Lion / Mountain Lion, due to a bug which causes the local DNS Server beeing always used instead of the DNS server of the remote network even when Split DNS is correnctly setup in the VPN router.

However, if you use a Cisco ASA IPSEC router, you can force the remote DNS Servers to be used whenever you establish a VPN connection:

If using Cisco ASDM, go to Configuration > Network (Client) Access > Group Policies > (your vpn group for OSX/iPhones) > Advanced > Split Tunneling

There set: DNS Names (uncheck "inherit" and define the internal dns domain names, e.g. myoffice.local) Send All DNS Lookups Throug Tunnel: Set to YES (This is the important setting)

Save it and don't forget to store in the flash for future use.

If you use the IOS command line, set:

group-policy <your-tunnel-group-name> attributes
 split-dns value myoffice.local
 split-tunnel-all-dns enable`
share|improve this answer
add comment

I had the same problem on my Mac, and after fixing it I have figured out that it was caused by FortiClient (VPN client). Even when FortiClient was disconnected - it's DNS still appeared in the scutil.

The solution for me was:

scutil
> list ".*DNS"

This will show you a list of all DNS configs, that will look something like:

subKey [0] = State:/Network/Global/DNS <br>
subKey [1] = State:/Network/MulticastDNS<br>
subKey [2] = State:/Network/OpenVPN/DNS<br>
subKey [3] = State:/Network/OpenVPN/OldDNS<br>
subKey [4] = State:/Network/PrivateDNS<br>
subKey [5] = State:/Network/Service/forticlientsslvpn/DNS <br>

To check each of them run: (until you find the problematic one)

> get key_name
> d.show

…and to fix it run:

> get key_name
> d.remove ServerAddresses
> set key_name

This is how it looked on my machine:

> get State:/Network/Service/forticlientsslvpn/DNS 
> d.show
<dictionary> {
  ServerAddresses : <array> {
    0 : 192.168.30.6
    1 : 192.168.30.15
  }
  SupplementalMatchDomains : <array> {
    0 :
  }
  SupplementalMatchOrders : <array> {
    0 : 100000
  }
}
> d.remove ServerAddresses
> d.show
<dictionary> {
  SupplementalMatchDomains : <array> {
    0 :
  }
  SupplementalMatchOrders : <array> {
    0 : 100000
  }
}
> set State:/Network/Service/forticlientsslvpn/DNS
> exit
share|improve this answer
add comment

Try changing the order of the DNS entries in the Network preference pane:

  1. Open System PreferencesNetwork.

  2. Select your network service in the list on the left.

  3. Unlock the preference pane using the lock in the bottom-left corner.

  4. Click Advanced… and choose the DNS tab.

  5. Change the order of the DNS servers by dragging them up/down.

share|improve this answer
    
This does not provide an answer to the question. To critique or request clarification from an author, leave a comment below their post - you can always comment on your own posts, and once you have sufficient reputation you will be able to comment on any post. –  George Garside Oct 12 '13 at 18:53
    
That is a weird comment. The poster didn't mention if he had tried this in his question and it could be relevant and a simple solution to his problem. Hard to tell without using the same setup. –  user23122 Oct 13 '13 at 19:45
1  
As it is worded, it is written as a request for clarification - answers should be written as answers; the comments is the most appropriate place to request for clarification. This answer was in the Low Quality Post review queue, and in my opinion that stock comment seemed the most appropriate. Indeed, rewording this as an answer (and adding detail such as screenshots and a properly-formatted list of instructions) would make this a full and legitimate answer. –  George Garside Oct 13 '13 at 20:07
    
This is ridiculous. Are you Rainman or what? It was an answer expressed in a passive and humble way (since it is so obvious the person asking the question - who seemed fairly skilled - probably had tried it but just forgot to mention it in the question). And if you had tried my suggestions yourself you would notice that most likely no more steps beyond the steps included (System Preferences -> Network) was necessary for someone as proficient as the OP. –  user23122 Oct 14 '13 at 21:00
    
As I've said, this is simply my opinion. I was not the one who downvoted you by the way. I've edited your answer to include more details about the steps. Feel free to rollback the edit if you believe it was inappropriate. –  George Garside Oct 14 '13 at 21:13
show 2 more comments

The issue is solved for me with OS X Mavericks.

share|improve this answer
add comment

what you said gave me a hint, so I've added the dns ip in the vpn connection to the dns list in the main connection (nothing fancy, just using the graphical interface for Network preferences.) I'm not sure if what you are dealing with is different, but it worked with me.

share|improve this answer
add comment

You can fix this by adjusting the service order of the network connections. Move VPN to the top of the list and the resolver order will follow.

http://support.apple.com/kb/PH14006

share|improve this answer
add comment

Send All DNS Lookups Throug Tunnel doesn't help here. VPN is 1st in the order list, but still sometimes the external DNS Server is used by ML to resolve internal domain addresses. Thats really annoying.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.