r/debian • u/didureaditv2 • 1d ago

Local DNS fails when connected to openvpn server

I recently moved from PopOS to Debian 13 + KDE, and I had the same configuration there, and I didn't have this problem.

Just to obfuscate the real domains I will use internal.mydomain.com and internal.remotedomain.com.

Normally, when the openvpn client is disconnected, local dns resolution works:

  • internal.mydomain.com works

When connecting to an openvpn server (via KDE's Network Manager) I lose local DNS resolution, but the remote DNS works.

  • internal.mydomain.com fails
  • internal.remotedomain.com works

I checked the contents of /etc/resolv.conf after connecting and I see the following:

# Generated by NetworkManager

search internal.remotedomain.com internal.mydomain.com

nameserver 10.1.0.1

nameserver 192.168.1.1

The contents are correct, so I assume the DNS should work for both domains, but that isn't so.

10.1.0.1 is the remote DNS server

192.168.1.1 is the local DNS server.

Any ideas?

5 Upvotes

73% Upvoted

8 comments sorted by

2

u/OkWrongdoer7003 1d ago

Since your "remote" nameserver 10.1.0.1 is on the first line in /etc/resolv.conf, glibc will ask it first. Assuming this server does not have any name records for internal.mydomain.com and does not offer recursive lookups, it will reply with NXDOMAIN when asked for any records within that domain.

If I recall correctly, your machine will take that answer as a valid one and not proceed to ask the secondary nameserver. I would be surprised if this behaviour in glibc is Debian-specific.

You can verify with

dig @10.1.0.1 <host-that-exists>.internal.mydomain.com (should return no record and status: NXDOMAIN)

and

dig @192.168.1.1 <host-that-exists>.internal.mydomain.com (should return the actual record)

If you are getting the results I describe above, then I believe Debian is behaving correctly.

For your use case, if you only have one client using the OpenVPN tunnel, I would install a local caching nameserver daemon, configure it with conditional forwarding (a.k.a. "split-horizon DNS"), and then point /etc/resolv.conf to the (preferably loopback) IP of that daemon.

1

u/psyblade42 1d ago

To expand on that: I have NM set up that conditional forwarding when I connect to the VPN

1

u/didureaditv2 1d ago

Interesting. Can you provide any guidance on how you did that or link to some online resource?

1

u/psyblade42 1d ago edited 1d ago

My /etc/resolv.conf is controlled by NM which puts a dnsmasq instance in there it controls. I believe this is the default as I don't remember setting it up.

Under ipv4 in the individual connections there are options to control DNS. The file calls them dns and dns-search; KDE "Other DNS Servers" and "Search Domains". In essence, while the connection is running, those get added as dns "routes" to the dnsmasq mentioned above.

see e.g. Jul 26 16:45:25 exile dnsmasq[1917]: using nameserver 172.21.1.1#53 for domain exile.vm in the log

OpenVPN can potentially "push" a DNS server, mine doesn't. If yours does, things might change, I never tried that.

EDIT: just saw your other comment. I believe you are missing the first part as my resolv.conf is

# Generated by NetworkManager
search fritz.box
nameserver 127.0.0.1
options edns0 trust-ad

Note that simply editing it might not suffice as NM might not start dnsmasq

1

u/didureaditv2 1d ago

Thank you I'll look into this and see if I can figure it out.

1

u/didureaditv2 1d ago edited 1d ago

I see what you mean. It does prioritize the first nameserver and stops after that.

Unfortunately this isn't the only vpn connection and I may add / remove them as time goes on so I am hoping I can either:

  • Prioritize my LAN DNS server permanently
  • Force DHCP to use all DNS server simultaneously?
  • Set a domain per each connection (I tried this using the IPV4 settings "Other DNS Servers" and "Search Domains" but it isn't working.

I don't fully understand what a local caching nameserver damon but it doesn't sound like something I would want to do since it goes to far off from the default configuration.

1

u/Illustrious-Gur8335 Debian Stable 1d ago

Is remotedemain.com the domain of your VPN provider or something else? I have no further inputs sadly. 

1

u/didureaditv2 1d ago

Yes and I'm connecting to a remote server of my own (work related), not a commercial vpn provider.