Mac OS X Mountain Lion - DNS resolving uses wrong order on VPN via dial-up connection

Question

I am using a MacBook with Mac OS X 10.8.2 and connect to my company's network via VPN. Everything works great when establishing the VPN connection via LAN or WLAN. However, when I use a dial-up connection (Huawei HSDPA USB Stick) host names are not correctly resolved in applications (e.g. Web-Browser). Command line tools like host name will correctly resolve the IP address, ping name will not resolve.

Using scutil --dns I dumped the DNS configuration when connecting via WLAN vs. dial-up. There is a notable difference in the lookup order:

connecting using WLAN:

resolver #1
  nameserver[0] : 192.168.80.10
  nameserver[1] : 192.168.80.24
  if_index : 6 (ppp0)
  reach    : Reachable,Transient Connection
  order    : 100000

resolver #2
  nameserver[0] : 192.168.80.10
  nameserver[1] : 192.168.80.24
  if_index : 6 (ppp0)
  reach    : Reachable,Transient Connection
  order    : 200000

resolver #3
  domain   : local
  options  : mdns
  timeout  : 5
  order    : 300000

resolver #4
  domain   : 254.169.in-addr.arpa
  options  : mdns
  timeout  : 5
  order    : 300200

resolver #5
  domain   : 8.e.f.ip6.arpa
  options  : mdns
  timeout  : 5
  order    : 300400

resolver #6
  domain   : 9.e.f.ip6.arpa
  options  : mdns
  timeout  : 5
  order    : 300600

resolver #7
  domain   : a.e.f.ip6.arpa
  options  : mdns
  timeout  : 5
  order    : 300800

resolver #8
  domain   : b.e.f.ip6.arpa
  options  : mdns
  timeout  : 5
  order    : 301000

DNS configuration (for scoped queries)

resolver #1
  nameserver[0] : 192.168.1.1
  if_index : 4 (en0)
  flags    : Scoped
  reach    : Reachable,Directly Reachable Address

resolver #2
  nameserver[0] : 192.168.80.10
  nameserver[1] : 192.168.80.24
  if_index : 6 (ppp0)
  flags    : Scoped
  reach    : Reachable,Transient Connection

The ppp0 connection is the VPN connection. As you can see, two servers are connected and they answer correctly on the command line and in applications.

Connecting via UMTS:

resolver #1
  nameserver[0] : 139.7.30.126
  nameserver[1] : 139.7.30.125
  if_index : 6 (ppp0)
  reach    : Reachable,Transient Connection
  order    : 100000

resolver #2
  nameserver[0] : 192.168.80.10
  nameserver[1] : 192.168.80.24
  if_index : 7 (ppp1)
  reach    : Reachable,Transient Connection
  order    : 100000

resolver #3
  nameserver[0] : 192.168.80.10
  nameserver[1] : 192.168.80.24
  if_index : 7 (ppp1)
  reach    : Reachable,Transient Connection
  order    : 200000

resolver #4
  domain   : local
  options  : mdns
  timeout  : 5
  order    : 300000

resolver #5
  domain   : 254.169.in-addr.arpa
  options  : mdns
  timeout  : 5
  order    : 300200

resolver #6
  domain   : 8.e.f.ip6.arpa
  options  : mdns
  timeout  : 5
  order    : 300400

resolver #7
  domain   : 9.e.f.ip6.arpa
  options  : mdns
  timeout  : 5
  order    : 300600

resolver #8
  domain   : a.e.f.ip6.arpa
  options  : mdns
  timeout  : 5
  order    : 300800

resolver #9
  domain   : b.e.f.ip6.arpa
  options  : mdns
  timeout  : 5
  order    : 301000

DNS configuration (for scoped queries)

resolver #1
  nameserver[0] : 192.168.80.10
  nameserver[1] : 192.168.80.24
  if_index : 7 (ppp1)
  flags    : Scoped
  reach    : Reachable,Transient Connection

resolver #2
  nameserver[0] : 139.7.30.126
  nameserver[1] : 139.7.30.125
  if_index : 6 (ppp0)
  flags    : Scoped
  reach    : Reachable,Transient Connection

This time, ppp1 is the VPN connection and ppp0 is the UMTS connection. From the response times of the commands (using the non-existing hostname foo.bar.local) I infer that ping uses the first resolver chain, where as host uses the scoped query configuration. ping takes 5 seconds to return "Unkown host", hostgets back immediately. I assume ping runs into the 5 second timeout of the mdns resolver.

In order to fix my problem with the broken DNS lookups when dialing in via VPN over modem I need to change the order of the resolvers. So far I have not found a way of doing this.

Any ideas welcome.

Answer 1

I had the same problem on my Mac, and after fixing it I have figured out that it was caused by FortiClient (VPN client). Even when FortiClient was disconnected - it's DNS still appeared in the scutil.

The solution for me was:

scutil
> list ".*DNS"

This will show you a list of all DNS configs, that will look something like:

subKey [0] = State:/Network/Global/DNS <br>
subKey [1] = State:/Network/MulticastDNS<br>
subKey [2] = State:/Network/OpenVPN/DNS<br>
subKey [3] = State:/Network/OpenVPN/OldDNS<br>
subKey [4] = State:/Network/PrivateDNS<br>
subKey [5] = State:/Network/Service/forticlientsslvpn/DNS <br>

To check each of them run: (until you find the problematic one)

> get key_name
> d.show

…and to fix it run:

> get key_name
> d.remove ServerAddresses
> set key_name

This is how it looked on my machine:

> get State:/Network/Service/forticlientsslvpn/DNS 
> d.show
<dictionary> {
  ServerAddresses : <array> {
    0 : 192.168.30.6
    1 : 192.168.30.15
  }
  SupplementalMatchDomains : <array> {
    0 :
  }
  SupplementalMatchOrders : <array> {
    0 : 100000
  }
}
> d.remove ServerAddresses
> d.show
<dictionary> {
  SupplementalMatchDomains : <array> {
    0 :
  }
  SupplementalMatchOrders : <array> {
    0 : 100000
  }
}
> set State:/Network/Service/forticlientsslvpn/DNS
> exit

Answer 2

This is still happening in 10.13.0

I have opened a bug report with Apple. It's not normal that "ping internalhostname" works but "host internalhostname" or "nslookup internalhostname" fails with split tunnel VPNs (Cisco IPSec based or IKEv2).

Also, as some have noticed, Cisco IPsec connections as well as IKEv2 connections can not be prioritized with "Set service order" unlike L2TP/IPsec which can.

Another point I'd like to bring up is that split tunnel Cisco IPSec or IKEv2 VPNs do not show any DNS servers or Search Domains in their Advanced settings even though this information does show up with "scutil --dns". L2TP/IPsec VPNs does show this information just fine.

Something has to give and Apple needs to provide some explanation/fix.

Answer 3

I found a workaround: your VPN DNS will still be ignored, and only 3G-dongle DNS will be used, but just adding your VPN DNS to the list under 3G interface does the trick… The main problem is that 3G connectivity manager overwrites configuration everytime you click connect, and you need connectivity manager to enable Radio on the 3G dongle… so I mixed both solutions in one:

1. Connect to your VPN and write down your DNS (I have 2 on the list). You can check it in Network Preferences → Advanced → DNS tab. Disconnect VPN. You need to connect to VPN because DNS is assigned dynamically upon connection…

2. Connect to your 3G and do the same: write the DNS on paper. Then disconnect 3G.

3. Go to Network Preferences → click on 3G interface → Advanced → DNS Tab, and under DNS table (that typically will be empty as you are not connected) click on '+'. Add all the DNS servers (those from 3G first and then add VPN later). Click OK and Apply.

4. From now on, to connect to 3G, just plug your USB and wait until you have 3G coverage (you will need to open 3G connectivity manager), but do not use the supplied connectivity manager to connect. And if it automatically connects, go to preferences and uncheck that tick. You need that manager only to turn radio on in the USB Dongle, nothing else.

   If you click on "connect" on your 3G manager, it will overwrite configuration on your 3G interface and you need to repeat step 3 again.

5. Go to Network → Preferences and click on the 3G interface. Then click connect. It will connect to your 3G using the configured DNS servers (instead of dynamically received), that include both the "public" DNS and your VPN DNS.

6. Connect to your VPN. It will work as expected.

Just be aware that:

• If your VPN DNS changes, you need to change it manually. This can easily be checked under Network → VPN interface w Advanced → DNS tab since your VPN DNS is still assigned dynamically to the interface (although ignored by OS X).

• If your 3G DNS changes (unlikely) you need to change it manually too. If something goes wrong and you cannot navigate you need to go through your 3G connectivity manager, click "Connect" and see what DNS are dynamically assigned… That will require you to go back to step 3 and reconfigure it.

Answer 4

I had the same issue for long time, but now I had time to find a solution that works for me. I didn't change the order of the DNS server, but I'm using the DNS server behind the VPN permanently.

1. Connect via dial-up.

2. Connect the VPN connection and copy the DNS server IPs and the search domain from VPN Connection → Advanced → DNS.

3. Disconnect the VPN connection.

4. Ping <name> or <hostname> of your VPN server and write down the IP.

5. Disconnect the dial-up connection.

6. Duplicate the dial-up connection (e.g. name it "3G for VPN").

7. Enter the IPs and the search domain into the DNS tab of the dial-up connection. They will be stored and used permanently.

8. Connect via the new dial-up connection.

9. Now you have no access to the nameservers (because they are secured by the VPN) - you have to edit the server address of the VPN connection. Replace the host by the IP.

10. Connect via VPN connection and you should be able to use it.

Note: In general hostnames does not change, but IPs can. So if it's not working someday, do the steps again…

Answer 5

Try changing the order of the DNS entries in the Network preference pane:

1. Open System Preferences → Network.

2. Select your network service in the list on the left.

3. Unlock the preference pane using the lock in the bottom-left corner.

4. Click Advanced… and choose the DNS tab.

5. Change the order of the DNS servers by dragging them up/down.

   

Answer 6

what you said gave me a hint, so I've added the dns ip in the vpn connection to the dns list in the main connection (nothing fancy, just using the graphical interface for Network preferences.) I'm not sure if what you are dealing with is different, but it worked with me.

Answer 7

Does not work in Lion / Mountain Lion, due to a bug which causes the local DNS Server beeing always used instead of the DNS server of the remote network even when Split DNS is correnctly setup in the VPN router.

However, if you use a Cisco ASA IPSEC router, you can force the remote DNS Servers to be used whenever you establish a VPN connection:

If using Cisco ASDM, go to Configuration > Network (Client) Access > Group Policies > (your vpn group for OSX/iPhones) > Advanced > Split Tunneling

There set: DNS Names (uncheck "inherit" and define the internal dns domain names, e.g. myoffice.local) Send All DNS Lookups Throug Tunnel: Set to YES (This is the important setting)

Save it and don't forget to store in the flash for future use.

If you use the IOS command line, set:

group-policy <your-tunnel-group-name> attributes
 split-dns value myoffice.local
 split-tunnel-all-dns enable`

Answer 8

You can fix this by adjusting the service order of the network connections. Move VPN to the top of the list and the resolver order will follow.

http://support.apple.com/kb/PH14006

---

Content of link found at https://web.archive.org/web/20170828193724/https://support.apple.com/kb/PH14006?locale=en_US and duplicated here:

OS X Mavericks: Change the priority of your network connections
This article has been archived and is no longer updated by Apple.

If you connect to the Internet or a network in several different ways (using Wi-Fi or Ethernet, for example), you can change the order of the network port configurations your computer tries when connecting to the Internet or network.
If there are multiple active network port configurations when you try to connect, OS X tries the one at the top of the list first, then tries the other port configurations in descending order.

• Choose Apple menu > System Preferences, then click Network.
• Choose Set Service Order from the Action pop-up menu. [The gear icon beside + - ]
• Drag a service, such as Ethernet, to the top of the list.
• Click OK, then click Apply to make the new settings active.

If you connect to the Internet using a virtual private network (VPN), and you selected “Send all traffic over VPN connection” in the advanced options pane of VPN preferences, you don’t need to move the VPN service to the top of the list.
Published Date: Oct 20, 2015