I've got two macs, both on the same network, both using Tunnelblick to connect to vpn. Both with same settings. Both connect fine and both have the same settings for DNS and search domain applied after connection. The only difference actually is that one is Lion and second one is Mountain Lion. That's the end of the differences.

After connecting to my vpn on Mountain Lion I cannot ping nor ssh to any address using domain name. And I don't mean local/private domain. I mean google.com for example. Nothing! However, when using nslookup/dig/host domain name is resolved just fine. On the second machine with Lion everything works just fine. With the exact same settings.

Any thoughts?

I've already tried adding -AlwaysAppendSearchDomains and it didn't work [why would it, google.com is not under the search domain specified in my dns settings...].

  • Same problem here. Did you find a solution for this problem?
    – Oliver F.
    Jun 6, 2013 at 19:01
  • Not really. The only solution for me was to manuall enter the DNS address from vpn [even though it was exactly the same as the address updated by tunnelblick]. it seems that tunnelblick/openvpn is missing a step which would flush/update the dns system on newer mac.
    – Krystian
    Jun 7, 2013 at 10:05
  • BTW, adding the DNS server manually was the only way to solve this issue before switching to an other VPN client. Indeed I had to add two DNS serer. The internal of my company and a public one. Somehow I wasn't able to resolve public names while being connected.
    – Oliver F.
    Jun 7, 2013 at 17:20
  • You tried adding -AlwaysAppendSearchDomains to what? Aug 26, 2014 at 19:40
  • Yes, but it doesn't work even for fully qualified domains.
    – Krystian
    Aug 27, 2014 at 8:13

3 Answers 3


I solved my problem by switching to Vicosity. After installing Viscosity I imported my Tunnelblick configuration and have been able to connect to the VPN of my company instantly. In opposite to Tunnelblick Viscosity is not free. But the price is fine for me.

  • Tried it - doesn't work.
    – mist
    Feb 25, 2016 at 18:42
  • What did you try? Installing Viscosity?
    – Oliver F.
    Feb 25, 2016 at 19:10
  • yes, same result as in tunnelblick, I managed to fix the problem another way
    – mist
    Feb 25, 2016 at 22:29

Currently the solution for tunnelblick [ver 3.3 beta 54] is to manually configure DNS settings to have two entries: 1. your VPN dns address 2. your regular dns address

for me it looks like this:


I know it's not perfect, but it works. I guess that for most people it shouldn't be a problem, especially that in osx you can configure multiple network profiles which will automatically switch when they detect changes in your network configuration.


TLDR: add list push "dhcp-option DOMAIN lan"in the vpn server config. Server config is in /etc/openvpn/server.conf or /etc/config/openvpn or some other place.


After a lot of investigation I found out why it didn't work. Imagine in the network where the vpn server is I have a machine called arch. If I am in the same network pinging arch works.

Now when I connect though the vpn I want to ping arch. But it fails. if I do dig arch or host arch it works. Where's the problem?

Using wireshark I found out that locally if I ping arch it queries the DNS for arch.lan (my dhcp supplies a lan search domain).

I tried dig arch - works.

I also tried dig arch.lan - also works.

When I connect through the vpn (tunnelblick) I checked what it does when I do ping arch, and it does a DNS query for arch.openvpn.

Where does the openvpn come from? Well, it's a stupid Tunnelblick default. TunnelBlick supplies an extra openvpn search domain.

How do we fix it, well we can say to the vpn server to "push" to all vpn clients a search domain which overrides the stupid default from TunnelBlick. That's the line in the top.

I tried viscosity it didn't work prior to the "pushing". Unfortunaly I uninstalled it before I started sniffing with Wireshark. So not sure what the problem with it was.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .