Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'd like to set up an IPSec responder (VPN server) for OSX desktops and laptops.

Everything seems to work fine, except I cannot push a DNS server to be used system-wide on the initiator (VPN client).

I'm using Charon's IKEv1 support in StrongSwan 5.0.4, with Unity extensions, and OSX machines are configured graphically using "Cisco VPN" in Network Preferences.

I did try to change the service order on the client to put the VPN at the top, but that didn't help.

In scutils --dns, the resolver only appears as resolver #1 in the DNS configuration (for scoped queries) section, not in the first section DNS configuration.

Here are the relevant config files:


conn %default

conn main


charon {
  threads = 16
  cisco_unity = yes
  plugins {
    attr {
      dns =
      split-include =,
      split-exclude = 10.65.36/22
    xauth-pam {
      pam_service = ipsec
share|improve this question
up vote 6 down vote accepted

A couple of comments on your config:

  • The subnet you configured for split-exclude is invalid. It should probably be

    split-exclude =
  • If you use the unity plugin you should configure


    instead of split-include in strongswan.conf. This allows assigning different subnets per connection.

  • Likewise, DNS servers may be assigned per connection via the rightdns option.

Regarding your main question, Mac OS X installs DNS servers unscoped only if all traffic is sent via VPN, that is, if leftsubnet= is configured and the client does not receive any UNITY_SPLIT_INCLUDE attributes.

In order to properly resolve host names at your remote site, I suggest you send the proper search domain to the client via a UNITY_DEF_DOMAIN attribute, for instance:

charon {
    plugins {
        attr {
            28674 =

This attribute only takes a single domain name. If multiple domains are required the UNITY_SPLITDNS_NAME attribute can be used:

charon {
    plugins {
        attr {
            28675 =

It takes a space-separated list of domain names that is sent to the client as is (results in a resolver for each domain on the client).

share|improve this answer
Brilliant. Would UNITY_DEF_DOMAIN support multiple domains? – Pierre Carrier Jul 8 '13 at 13:34
In strongswan.conf you could configure more than one domain in a comma-separted list. But the Mac OS X client currently ignores all but the first. – ecdsa Jul 8 '13 at 14:04
Well, using UNITY_SPLITDNS_NAME it is actually possible to send multiple domains. I updated the answer. – ecdsa Jul 8 '13 at 14:19

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.