The Preamble

I set up a VPN connection from my Macbook, and it seems to connect successfully.

working VPN

However, I can't access my work computer because hostname doesn't get resolved:

$ ping myusername
ping: cannot resolve myusername: Unknown host

The New Workaround

After trying everything I could, I found that this command makes both VPN network and internet available to me:

sudo route add -net

Company's DNS servers are accessible by their IPs. How do I configure the network to use them for everything that starts from 192.168?

The Old Workaround

I found a temporary workaround that allows me to access the network via VPN by modifying two options:

I put a checkmark in Send all traffic over VPN connection:

VPN options

I manually enter Search Domain name in VPN interface's DNS settings:

entering domain name in VPN options

Performing these two steps is enough to make my working computer pingable:

$ nslookup myusername

Name:   myusername.universe.mycompany

$ ping myusername
PING myusername.universe.mycompany ( 56 data bytes
64 bytes from icmp_seq=0 ttl=126 time=126.164 ms

However, as I tunnelled all traffic to go through VPN, I can no longer access the Internet:

$ ping google.com
PING google.com ( 56 data bytes
Request timeout for icmp_seq 0
Request timeout for icmp_seq 1

The Question

How do I properly set up the network so it understands when to go through VPN, and when to use the normal connection? I need it to resolve Windows server names correctly.

If I need to post any console command output, I am willing to do that if you let me know which exactly.
Any help is highly appreciated, as this is a kind of show stopper for me now.


  • What is your VPN subnet mask? If it is you cannot reach the dns server 192.168.10.x because your subnet is 192.168.7.x.
    – hsmiths
    May 29, 2011 at 0:06
  • ifconfig output for ppp0 is flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1396 inet --> netmask 0xffffff00 so I guess it is How do I change it? Thanks.
    – Dan
    May 29, 2011 at 10:12
  • @shsmith, please see the New Workaround section. You were right DNS servers weren't accessible. I used route to make them available because I didn't find a way to change netmask. How do I mark these as "DNS for everything 192.168-related"?
    – Dan
    May 29, 2011 at 10:41
  • I don't know what VPN server you have on the remote end, but I think that's where you should be looking to fix the problem. It looks like the VPN is a split tunnel setup, meaning both access to the VPN end is via VPN, but other (Internet) access is via your normal gateway. The VPN server should be configured to specify the name servers and the domain(s) that these should be used for. Also, your question about marking DNS servers to be used for 192.168.related queries is the wrong way round - it's the domain name part that needs to be 'marked', for use with the internal DNS server, not the IP.
    – barryj
    May 29, 2011 at 10:59
  • @barryj, thanks a lot for your input. I'll ask administrators but I think I'm the only one with this problem so I don't want to take their time if I can make this on my own. As for DNS, I only want to use VPN to access other computers on Windows network, e.g. my working computer for RDC, database server for development, etc.
    – Dan
    May 29, 2011 at 11:07

4 Answers 4


You might want to look at the resolver manpage

To quote one solution:

The configuration for a particular client may be read from a file having the format described in this man page. These are at present located by the system in the /etc/resolv.conf file and in the files found in the /etc/resolver directory. However, client configurations are not limited to file storage. The implementation of the DNS multi-client search strategy may also locate client configuratins in other data sources, such as the System Configuration Database. Users of the DNS system should make no assumptions about the source of the configuration data.

AFAIK you need to put a file named example.com in /etc/resolver with the IPs of the nameservers for that domain if you want special nameservers for example.com -- Could be they use resolv.conf syntax, I can't remember. But you should be able to figure that out :)

EDIT: As far as automating the process goes, I'm pretty sure that's doable with AppleScript or Automator. But I never to my head around it so a second question on that topic might help.


There seems to be an issue with OSX setting the netmask incorrectly. This was my experience using a PPTP VPN in both Snow Leopard and Mountain Lion, and is supported by this thread here.

I found a solution here, which involves setting a routing rule for ppp0 traffic.


$ sudo <your_text_editor_of_choice> /etc/ppp/ip-up

    /sbin/route add -net 192.168 -interface ppp0

$ sudo chmod 755 /etc/ppp/ip-up

This will set the routing rule every time you connect to the VPN.


Mac OSX DNS resolutions is funny. Here's the quick fix.

  1. Put this following code in a file name reset_dns.

    function get_pri_srvc_id ()
      cat <<EOF | scutil | \
        grep 'PrimaryService' | \
        awk -F': ' '{print $2}'
    show State:/Network/Global/IPv4
    function get_srvc_name ()
      cat <<EOF | scutil | \
        grep 'UserDefinedName' | \
        awk -F': ' '{print $2}'
    show Setup:/Network/Service/$1
    function get_srvc_ids ()
      cat <<EOF | scutil | \
        sed -nEe '
    /ServiceOrder/ {
      /[0-9]+ :/ {
        s/ *[0-9]+ : ([0-9A-Z-]+) */\1/p
        b ids
    show Setup:/Network/Global/IPv4
    function get_srvc_id_by_name ()
      local srvc_ids=$(get_srvc_ids)
      for srvc_id in $srvc_ids
        local srvc_name=$(get_srvc_name "$srvc_id")
        if [[ "$srvc_name" == "$1" ]]
          echo $srvc_id
    function get_dns_ips ()
      local srvc_id=$(get_srvc_id_by_name "$1")
      cat <<EOF | scutil | \
        sed -nEe '
    /ServerAddresses/ {
      /[0-9]+ :/ {
        s/ *[0-9]+ : ([0-9.]+) */\1/p
        b ips
    show $2:/Network/Service/$srvc_id/DNS
    function set_dns_ips ()
      networksetup -setdnsservers "$@"
    vpn_srvc_name='MY VPN'
    pri_srvc_name=$(get_srvc_name "$pri_srvc_id")
    if [[ ! -e "$ip_file" ]]
      setup_dns_ips=$(get_dns_ips "$pri_srvc_name" "Setup")
      state_dns_ips=$(get_dns_ips "$pri_srvc_name" "State")
      setup_vpn_ips=$(get_dns_ips "$vpn_srvc_name" "Setup")
      state_vpn_ips=$(get_dns_ips "$vpn_srvc_name" "State")
      echo "set_dns_ips $pri_srvc_name $setup_vpn_ips $state_vpn_ips $setup_dns_ips $state_dns_ips"
      set_dns_ips "$pri_srvc_name" $setup_vpn_ips $state_vpn_ips $setup_dns_ips $state_dns_ips
      if [[ -z "$setup_dns_ips" ]]
      echo $setup_dns_ips >$ip_file
      setup_dns_ips=$(cat $ip_file)
      echo "set_dns_ips $pri_srvc_name $setup_dns_ips"
      set_dns_ips "$pri_srvc_name" $setup_dns_ips
      rm $ip_file
  2. Replace the word 'MY VPN' with the name of your VPN connection.

  3. Once connected to your VPN, run reset_dns from a terminal window

Mac OSX only uses DNS servers associated with your 'Primary' network connection. The above code adds the DNS servers of your VPN connection to the Primary network connection (i.e. usually Wi-Fi or Ethernet) so that your VPN DNS servers will be used first, then your Primary connection DNS servers second.

Run the reset_dns command again after disconnecting form your VPN to remove the entries and restore the original DNS server configuration. This is optional, though, as it usually doesn't hurt anything to just keep the DNS servers associated.


I had the same issue. Turns out my home router was on the same IP range as my work system. Once I changed my home router to a different range I was able to connect.

Not the answer you're looking for? Browse other questions tagged or ask your own question.