I'd like to set up an IPSec responder (VPN server) for OSX desktops and laptops.

Everything seems to work fine, except I cannot push a DNS server to be used system-wide on the initiator (VPN client).

I'm using Charon's IKEv1 support in StrongSwan 5.0.4, with Unity extensions, and OSX machines are configured graphically using "Cisco VPN" in Network Preferences.

I did try to change the service order on the client to put the VPN at the top, but that didn't help.

In scutils --dns, the resolver only appears as resolver #1 in the DNS configuration (for scoped queries) section, not in the first section DNS configuration.

Here are the relevant config files:


conn %default

conn main


charon {
  threads = 16
  cisco_unity = yes
  plugins {
    attr {
      dns =
      split-include =,
      split-exclude = 10.65.36/22
    xauth-pam {
      pam_service = ipsec

A couple of comments on your config:

  • The subnet you configured for split-exclude is invalid. It should probably be

    split-exclude =
  • If you use the unity plugin you should configure


    instead of split-include in strongswan.conf. This allows assigning different subnets per connection.

  • Likewise, DNS servers may be assigned per connection via the rightdns option.

Regarding your main question, Mac OS X installs DNS servers unscoped only if all traffic is sent via VPN, that is, if leftsubnet= is configured and the client does not receive any UNITY_SPLIT_INCLUDE attributes.

In order to properly resolve host names at your remote site, I suggest you send the proper search domain to the client via a UNITY_DEF_DOMAIN attribute, for instance:

charon {
    plugins {
        attr {
            28674 = strongswan.org

This attribute only takes a single domain name. If multiple domains are required the UNITY_SPLITDNS_NAME attribute can be used:

charon {
    plugins {
        attr {
            28675 = strongswan.org hsr.ch

It takes a space-separated list of domain names that is sent to the client as is (results in a resolver for each domain on the client).

| improve this answer | |
  • Brilliant. Would UNITY_DEF_DOMAIN support multiple domains? – Pierre Carrier Jul 8 '13 at 13:34
  • In strongswan.conf you could configure more than one domain in a comma-separted list. But the Mac OS X client currently ignores all but the first. – ecdsa Jul 8 '13 at 14:04
  • 2
    Well, using UNITY_SPLITDNS_NAME it is actually possible to send multiple domains. I updated the answer. – ecdsa Jul 8 '13 at 14:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.