1

I am connecting to a Cisco IPSec tunnel from MacOS to a hosted pfsense box that is running a number of other IPSec site-to-sites happily, and the DNS resolution is not working. I also am in full control of the configuration, and am able to make changes if needed to get this working.

When the VPN interface comes up on 10.10.3, I can see in the System Preferences Window that both the Search Domains and DNS Servers have been set properly.

However, when I run "scutil --dns", the resolver shown has mysteriously had a 'p' added to the domain name, e.g.,

internal.mynetwork.com from the system preferences (and, DCHP configuration) has become internal.mynetwork.comp. If I use scutil to correct this configuration (in a similar fashion to here) DNS resolution for *.internal.mynetwork.com works as expected. Unfortunately when I bring the VPN down this configuration is lost.

Here is the relevant output - note the trailing 'p' in the top resolver sections and it's absence in the bottom one. This 'p' has not come from the DHCP configuration and does not appear in the interface configuration in the System Preferences panel. 

DNS configuration

resolver #1
  search domain[0] : internal.mynetwork.comp
  search domain[1] : home
  nameserver[0] : 192.168.1.1
  flags    : Request A records, Request AAAA records
  reach    : Reachable,Directly Reachable Address

resolver #2
  domain   : internal.mynetwork.comp
  nameserver[0] : 192.168.20.1
  flags    : Request A records, Request AAAA records
  reach    : Reachable,Transient Connection
  order    : 100200

DNS configuration (for scoped queries)

resolver #1
  search domain[0] : internal.mynetwork.com
  nameserver[0] : 192.168.20.1
  if_index : 10 (utun0)
  flags    : Scoped, Request A records
  reach    : Reachable,Transient Connection

resolver #2
  search domain[0] : home
  nameserver[0] : 192.168.1.1
  if_index : 4 (en1)
  flags    : Scoped, Request A records, Request AAAA records
  reach    : Reachable,Directly Reachable Address

Is this a known bug with a known solution?

Improve this question
5
  • I'm not sure what to make of the "b" and the "p" you mention. What resolver has problems in particular? Are you looking at the (for scoped queries) portion of scutil --dns or some other part of the output. There are typically 70 lines of output on some builds on 10.10.x from that command so you'll have to be a bit more specific if you don't want to reveal the actual output you are struggling with. Also, let's leave discoveryd out of the text until unless it's relevant. It handles bonjour and not traditional DNS.
    – bmike ♦
    Commented Jun 2, 2015 at 14:28
  • I've added the raw output. I am fairly certain discoveryd performs DNS resolution in addition to bonjour as it seems widely documented to be the root cause of DNS issues in yosemite, see e.g. this Ars article: arstechnica.com/apple/2015/01/…
    – Scott
    Commented Jun 2, 2015 at 14:44
  • I'm painfully aware how discoveryd is breaking things and making it nigh impossible to track down networking issues, bonjour, etc. The article you link is all about .local issues. (renaming, failure to handle DHCP reservations properly, WOE are all non-routable, non-dns issues IMO). Back to the real problem. Are you in control of the IPSec configuration and DNS or did someone else set that up? If you are authorized to test new configs we can probably make progress.
    – bmike ♦
    Commented Jun 2, 2015 at 15:05
  • Yes, I am in full control of the configuration, and am happy to make any changes that you may think are useful. It is being hosted from a pfsense box that is running a number of other IPSec site-to-sites happily.
    – Scott
    Commented Jun 2, 2015 at 15:08
  • Cool - I've added that to the question. Fingers crossed someone has seen it or can help debugging this. :-)
    – bmike ♦
    Commented Jun 2, 2015 at 15:13

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .