1

Sometimes I have to connect to my work network throughout VPNC. That network has DNS server. I don't have a permission to pull zone files from it. And I have local bind server which forwards to 8.8.8.8 and resolves some internal names of my KVMs. And my resolve.conf directs to 127.0.0.1.

All names from the work network have the same subdomain (company.com).

I would be glad to find a config option with regex to forward resolution domain names matching regex /company.com$/ to another DNS server instead the default.

Yeah, this solution doesn't look technically perfect but it's simple.


Thanks for the idea about dnsmasq. Now it's left get it working.

Now I run the bind9 on an veth only. /etc/resolve.conf is left unchanged. dnsmasq is bound to rest interfaces and forwards to bind9 by default otherwise to the company server.

And everything working if vpn network was established before. But if you start vpnc-connect it fails after hanging some time with complain that vpn.company.com cannot be resolved.

I tried to disable negative cached and setting max cache size to zero. Nothing helped.

This looping don't happened if /etc/resolve.conf points to 8.8.8.8 or to my bind9.

closed as off-topic by yoonix, Ward, mdpc, Andrew Schulman, EEAA Apr 4 '15 at 3:42

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions on Server Fault must be about managing information technology systems in a business environment. Home and end-user computing questions may be asked on Super User, and questions about development, testing and development tools may be asked on Stack Overflow." – Ward, Andrew Schulman, EEAA
If this question can be reworded to fit the rules in the help center, please edit the question.

  • I've updated my answer to handle the problem with your circular resolution – roaima Apr 2 '15 at 20:39
1

dnsmasq will do this for you. Run it locally on your machine and set your /etc/resolv.conf to point to 127.0.0.1.

I don't have the full configuration to hand but the parameters you probably want to investigate are

# Do not read resolv.conf
no-resolv

# Send queries for contoso.com to nameserver 10.1.2.3
server=/contoso.com/10.1.2.3

# Set your local default domain and add it to simple names in /etc/hosts
domain=fabrikam.com
expand-hosts

# DNS "A" records are like this
host-record=vpn.contoso.com,203.0.113.77

You can include other files from the main /etc/dnsmasq.conf file, so one of those could be updated as necessary when you bring vpnc online or offline so that the forwarders are only available when the vpn is up.

If you need to resolve a name such as vpn.contoso.com you can't do that directly, as the contoso.com domain is sent to a nameserver that's only available when the vpn is up. Since we're not wanting to involve chickens and eggs[*] the solution here is to use dnsmasq to define that as a well-known name. This can be added to /etc/hosts or set in dnsmasq.conf as a host-record.

Over time you may want to consider replacing bind with dnsmasq; for an internal network it does just about everything that bind does.

  • The solution with the predefined route for the VPN host is the last resort. It doubles amount of information about the network required for bearing in mind. And yeah looping is natural but why it's DNS resolving is required for a VPN connection establishment. VPN is just about IPs and routes. – Daneel S. Yaitskov Apr 2 '15 at 20:57
  • @daneel If that's the case then you need to stop referring to VPN.yourcompany.com and use an IP address. You can't have it both ways. – roaima Apr 2 '15 at 21:58
  • I forget I've put the VPN host in the vpnc config. Yesterday I thought it goes from vpn server. Anyway I would implement an vpnc option to use DNS servers (inside the program) received from the private network or at least prefer them. E.g. in java it's pretty easy: stackoverflow.com/questions/17444862/… – Daneel S. Yaitskov Apr 3 '15 at 5:54
  • And I found that my vpn.company.com has global IP and it's resolvable by 8.8.8.8. It would be better if dnsmasq could try to resolve names with default DNS server if the dedicated isn't available. – Daneel S. Yaitskov Apr 3 '15 at 6:25

Not the answer you're looking for? Browse other questions tagged or ask your own question.