-1

I have a VPN to connect to my school's IT department (I volunteer with them), but I am having a problem.

I have added the VPN to the Network Interface list in System Preferences, and can connect just fine. However, let's say I try to ping the server:

PING server_name (67.63.55.3): 56 data bytes
64 bytes from 67.63.55.3: icmp_seq=0 ttl=241 time=95.298 ms

But this IP is not the server... it is my ISP's DNS hijacking page (as established here).

So then I change the Service Order in System Preferences: I move the VPN above my wifi connection. Now I can ping and connect to the server just fine, through my school's internal DNS server.

But now, I cannot browse the internet. Because I have moved the VPN above my Wifi connection, my Mac tries to route all internet traffic through the VPN. However, the VPN does not have internet throughput: it is only for connecting to internal servers. So I ping google:

PING www.google.com (67.218.93.49): 56 data bytes
Request timeout for icmp_seq 0

Which is, of course, bad. Either I can have internet connectivity, or I can have VPN. But not both at the same time.

So, you might say, "You can just tell the VPN to handle specific IPs!" But that doesn't work, because then when I try to ping the server hostname, who's DNS gets the request? My ISP! (instead of my school). If my ISP would not DNS hijack, maybe this would work.

So my question is: Is there some way I can tell my Mac to forward requests that fail on the VPN (like www.google.com, etc) on to the next Network Service, being my Wifi?

Pretty much I want to consult my school DNS first and my real DNS second.

Thanks.

| improve this question | |
  • Can you provide some screen shots of your network settings for the two connections? It's hard to understand how you have things set up -- it sounds like you want VPN connected on one physical interface (ethernet?) without using VPN on another physical interface (your WiFi card?) and then you want traffic to route properly to one interface or the other. Is that correct? – Ian C.♦ Jun 12 '14 at 3:37
  • Sorry, I wasn't clear on that point: I only have Wifi, so the VPN is going out over Wifi. So I want to send all traffic over wifi, just some of it with VPN. – baum Jun 12 '14 at 3:39
  • 1
    As an aside, you can switch your DNS to OpenDNS to get around your ISPs DNS hijacking. – Ian C.♦ Jun 12 '14 at 3:43
  • This is old, for Leopard, but might have some hints in it: superuser.com/questions/4904/… – Ian C.♦ Jun 12 '14 at 3:45
  • But that post assumes it is an IP problem. I am having a DNS problem, that I cannot get the IPs, in the first place. Once I have the IPs, everything works, because the VPN automatically routes IPs on the VPN-subnet through the VPN. – baum Jun 12 '14 at 3:47
1

I was about to give up on this. I had tried numerous modifications across the system, and nothing would work.

But then I found a simple solution... laughably simple:

In Network preferences, choose your primary interface, and hit Advanced.... For me, this was wi-fi, but the same thing should work for ethernet, etc. Whatever you normally use to connect to the internet

In the DNS tab (where you may already have entries), add the VPN DNS. Also make sure that your main DNS(s) are there. Then, add the VPN domain into the search domains box.

Example:

VPN settings http://elibaum.com/img/Screen%20Shot%202014-06-18%20at%2021.18.22.png

Here, 10.0.1.1 is my home wifi router, which in turn routes to my ISP's DNS servers. 10.8.1.22 is the local DNS server on the VPN.

So, if I request www.google.com, the request is sent to my router, whether or not I am on VPN.
However, if I request server while on the VPN, the primary DNS fails, and moves on to the next nameserver. However, since this nameserver (10.8.1.22 in my case) is on the VPN's subnet, traffic is automagically routed to the VPN. The search domain field example.com transforms server into server.example.com, and the DNS lookup succeeds.

Important Note: this workaround requires that your primary DNS fails on non-existent domains — that is, your ISP is not doing DNS hijacking. If they are, switch to OpenDNS, Google Public DNS, etc. Also see my related question: https://superuser.com/questions/766713/what-is-67-63-55-3 in which I sorted out DNS hijacking in relation to this problem.

| improve this answer | |

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .