Timeline for Force DNS resolution to happen outside VPN
Current License: CC BY-SA 4.0
12 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jul 10, 2019 at 21:56 | comment | added | Neil | @bmike I’m just speculating, so assume it doesn’t work for me, then. I’ll let you know if I can get it working. | |
| Jul 10, 2019 at 21:55 | comment | added | bmike♦ | @Neil Please show us how - any attempt I make to change breaks the VPN connection so you can have your own DNS or you can have a VPN connection - not both. Maybe I'm not seeing the exact usage you invoke, though... | |
| Jul 10, 2019 at 17:55 | comment | added | Neil |
@bmike I don’t think it matters. The question was asking how to have the OS use the regular DNS before using the VPN DNS, and that can be done by editing the DNS configuration with scutil. When connecting, AnyConnect will bash these settings, but it’s at least possible to update manually after each connect. The VPN configuration can’t tell the OS how it can resolve DNS names, so an override should work.
|
|
| Jul 10, 2019 at 17:33 | comment | added | bmike♦ | @Neil What version of Cisco VPN are you able to make this change if the tunnel setup is locked to prevent split VPN? I’d love to learn more. This question is about Cisco AnyConnect when split is explicitly disabled and not about if in general you can do this when it’s not enforced. | |
| Jul 10, 2019 at 17:26 | comment | added | Neil |
This answer is likely incorrect, you can probably make this change with scutil: superuser.com/a/86188
|
|
| Dec 3, 2018 at 1:56 | history | edited | bmike♦ | CC BY-SA 4.0 |
added 343 characters in body
|
| Dec 3, 2018 at 1:51 | comment | added | bmike♦ | It updates to show me what CiscoVPN changes in terms of primary DNS so I include it in my troubleshooting. You're correct in that the file may never be read by macOS, but it does show useful info for me on 10.14.1 to indicate VPN has changed state of DNS. | |
| Dec 3, 2018 at 1:06 | comment | added | Craig Otis |
I don't think /etc/resolv.conf is used these days on macOS. The file contains: This file is not consulted for DNS hostname resolution, address resolution, or the DNS query routing mechanism used by most processes on this system.
|
|
| Dec 3, 2018 at 1:02 | comment | added | bmike♦ |
The link to "change your VPN" has steps to test that Cisco split tunneling was allowed. Can you ping a local non-routable IP address on your local subnet once you connect to the VPN? Also - you might need to add the results of netstat -nr and uncommented lines in /etc/resolv.conf before and after the VPN is established since it's the routing tables that govern things primarily. @CraigOtis
|
|
| Dec 3, 2018 at 0:58 | history | edited | bmike♦ | CC BY-SA 4.0 |
added 236 characters in body
|
| Dec 3, 2018 at 0:57 | comment | added | Craig Otis | I believe the VPN is currently a split tunnel. Once DNS resolution happens (say, to apple.com) over the VPN, the traffic itself is then sent outside the VPN to my ISP. | |
| Dec 3, 2018 at 0:55 | history | answered | bmike♦ | CC BY-SA 4.0 |