I'm trying to setup two PCs (one Windows, one Linux, but my understanding is that this problem is more DNS and less OS) as follows:

Home network:
VPN (via OpenVPN server not within the home network): .

I would like a PC on both networks to be able to access three different types of site:

  1. Internet addresses
  2. Addresses on the home network
  3. Addresses on the vpn

However, I'm not sure how/which DNS servers to use. If I prioritize my home DNS server, I can resolve (1) and (2), but not (3). If I prioritize my VPN DNS server, I can't resolve addresses of type (2). Of course, looking up addresses via nslookup and explicitly setting the correct server works, so I know my local DNS servers are OK.

Is there any way I can set up my PCs to fallback on the second DNS server if there is no address found (NXDOMAIN)? Alternatively, is there any way I can tell different queries to go to different servers [maybe by setting up different subdomains; foo.local.something vs. bar.vpn.something]?


  • Just a minor comment. Assuming the first DNS server is up there will be response from the server. Instead of asking to try alternates when there is no response what I believe you want is to try the alternate servers when the response is NXDOMAIN. – Zoredache Mar 21 '10 at 8:57
  • you are completely correct; I specifically meant to exclude the case of NXDOMAIN :) – Mikeage Mar 21 '10 at 12:24
  • Would it also be possible to connect one DNS server to the other? (Probably not - it's just an idea, I'm not an expert in DNS at all) – Chris Lercher Mar 21 '10 at 14:43
  • no; one is my home router, and the other is on a VPN. – Mikeage Mar 22 '10 at 3:21

I haven't used this, but I believe the tool that will most likely fill your need on your Linux machine is dnsmasq.

DNS mask can be set to forward its requests to upstream. At the same time it can also serve names defined in a local /etc/hosts file. You can use the --server option to forward requests to a particular DNS server for domains you define.

-S, --local, --server=[/[]/[domain/]][[#][@|[#]]
Specify IP address of upstream servers directly. Setting this flag does not suppress reading of /etc/resolv.conf, use -R to do that. If one or more optional domains are given, that server is used only for those domains and they are queried only using the specified server. This is intended for private nameservers: if you have a nameserver on your network which deals with names of the form xxx.internal.thekelleys.org.uk at then giving the flag -S /internal.thekelleys.org.uk/ will send all queries for internal machines to that nameserver, everything else will go to the servers in /etc/resolv.conf.

I am not sure how to address this on your Windows computer. If you cannot come up with an alternative one thing you could do to avoid the issue would be to connect to the openvpn server from your Linux computer and then setup routing NAT on the tun* interface on your client and enable ip forwarding. Adjust the routes and DNS settings on all your other systems to point at the Linux box with the OpenVPN connection. This would effectively make your Linux box a gateway that directs traffic across the VPN as needed..

  • This seems like it will work for my Linux machine... any suggestion for the windows one? – Mikeage Mar 21 '10 at 12:25

You can set up 2 DNS servers, one for the home network and one for the VPN. You can make one the master and the other the slave and have replication between the two (having two DNS on the two sides guarantees that if the VPN goes down, both sides can still have DNS) Those servers can also be the recursors for the network.

If you want to use dnsmasq, it can also be a little authoritative server as well. Add the names you want to /etc/hosts on the router and keep the file in sync with the VPN router.

  • at the moment, there's no communication between the two. The one at the home network is the basic one on the router dnsmasq; can it do that? On the VPN, I'm also running dnsmasq, but I could presumably use something more sophisticated if need be. – Mikeage Mar 22 '10 at 18:01
  • Edited the answer. – Dan Andreatta Mar 23 '10 at 9:58

I don't know openvpn at all but with Cisco VPN clients there's something called 'split-dns' that says "if someone's looking for something at whatever.company-I'm-VPNing-into.com then get its IP from the DNS server presented over the VPN otherwise go for the regular one that goes over the internet and/or home stuff". I think that sounds like what you want.

edit - HERE's a link to someone doing just that with openvpn.

  • I don't believe that script has the effect the OP is looking for. It will append the DNS servers from the remote side to the resolv.conf automagically. I don't believe it will do anything to make the resolver try one of the alternate DNS servers if the record doesn't exist on the first. – Zoredache Mar 21 '10 at 8:39
  • fair enough, as I say I don't know openvpn but I do know that he's looking for a split-dns solution. – Chopper3 Mar 21 '10 at 8:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.