I want to find a way to force my system to resolve through the local hosts file on my system before it makes a DNS query. There's a reason for this, and here's my context:

  • I live in China. I need a VPN to get to the 'real' Internet. In my case I'm using Astrill.
  • Inside my company, its local DNS points our intranet, wiki and other online resources to local IPs. When outside the company, the DNS entries are obviously those available on external IPs for everyone.

When connected to the VPN, I don't want my machine to look up by public IP, I want to still use the local IP that the local DNS gives me, but all traffic is going through the VPN.

A solution that I thought of was to put the local IPs in a DNS entry in the hosts file.

Then I read about a *nix technique which uses a file called nsswitch.conf to tell the system to always use the file first, then DNS. But OS X doesn't seem to use this (the file doesn't exist in /etc/ anyway).

This would be ideal because then I could always try to use the local resource wherever I am - normal Internet, VPN connection, or inside or outside my company.

I can't find any documentation for OS X support of nsswitch.conf or information about if it automatically checks hosts before DNS anyway.

  • I think you misunderstand how DNS resolution and VPN works! Additionally there is a difference if you use VPN (and which kind of VPN!) to connect from your company/home/neither home or company to the real internet bettering the GreatFirewall or if you use VPN from home/outside your company to the company. Please rework your question.
    – klanomath
    Aug 19, 2016 at 16:25
  • I'm not sure how I can rework my question without further guidance? I asked it given the details that I know. I use Astrill as the service. It has an option 'tunnel international sites' only, which tunnels everything except a list available here: github.com/shadowsocks/ChinaDNS/blob/master/chnroute.txt (which is China's IP address range). I still cannot access local resources when i'm connected to it, even though some EXTERNAL IPs aren't tunnelled through the VPN.
    – ortonomy
    Aug 23, 2016 at 2:11
  • It partly depends on the VPN-app you are using. Some VPN providers like mine provide an app which allows me to either tunnel all traffic or only outbound traffic. At the same time I may also use Tunnelblick (as the "standard" app) to use the same VPN service with a somehow different behavior. The problem of most VPN providers (which sell their services in the PR of China) is the continuing race between the rising height and thickness of the GF and the "tunnel drillers". And it's getting trickier day by day.
    – klanomath
    Aug 23, 2016 at 2:27
  • Until now we didn't even know which service provider you have chosen and we still don't know if you use Tunnelblick or some customized app (like the Astrill app).
    – klanomath
    Aug 23, 2016 at 2:27
  • "we still don't know if you use Tunnelblick or some customized app (like the Astrill app)." - umm, say what? I said I used Astrill. "I think you misunderstand how DNS resolution and VPN works!" - non-helpful criticisms. I do understand how DNS works. This is software question about OSX and how its resolution works. I mean, how helpful do you think you're being by making these comments? It certainly doesn't come across like you're simply trying to 'improve the quality of the questions'.
    – ortonomy
    Aug 24, 2016 at 13:43

1 Answer 1


This is already the default in OS X. I.e. if you specify a host name in the hosts file, lookups will use the IP address you've specified there instead of doing a DNS lookup.

Note that this is only true for programs using the system standard resolver functions. Programs can use their own resolving mechanism that is not guaranteed to honor anything you write in the hosts file. However, those programs should be rare and far between.

  • Seems to be different when tethering. When tethered to my iPhone it seems that even for an IP address URL the system first tries DNS before being able to connect to, which makes it painfully slow.
    – geoidesic
    Nov 10, 2020 at 11:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .