0

We have a DNS setup for some internal domains that looks like this:

service.company.com CNAME service.company.lan
service.company.lan CNAME service01.company.lan
service01.company.lan A 10.0.3.4

That means we have setup a public DNS (.company.com) entry pointing to an internal one (.company.lan) because of a trusted SSL certificate on (*.company.com).

The internal service is only available by an established OpenVPN connection to be able to connect and resolve internal servers and OpenVPN is configured to use our internal DNS server (10.0.0.5).

This works fine on Mac but it doesn't for me at home with Ubuntu 16.04 :(

The problem is that on an established OpenVPN connection the internal DNS will be used only for *.comapany.lan domains but it doesn't for *.company.com with CNAMEs to *.company.lan.

$ dig service-testing.company.com

; <<>> DiG 9.10.3-P4-Ubuntu <<>> service-testing.company.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 27522
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;service-testing.company.com.       IN  A

;; ANSWER SECTION:
service-testing.company.com.    0   IN  CNAME   service.testing.company.lan.

;; AUTHORITY SECTION:
.           856 IN  SOA a.root-servers.net. nstld.verisign-grs.com. 2017052600 1800 900 604800 86400

;; Query time: 3 msec
;; SERVER: 127.0.1.1#53(127.0.1.1)
;; WHEN: Fri May 26 12:13:53 CEST 2017
;; MSG SIZE  rcvd: 155

-

$ dig service.testing.company.lan

; <<>> DiG 9.10.3-P4-Ubuntu <<>> service.testing.company.lan
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 56868
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;service.testing.company.lan.       IN  A

;; ANSWER SECTION:
service.testing.company.lan.    60  IN  CNAME   service01.testing.company.lan.
service01.testing.company.lan.  60  IN  A   10.0.40.60

;; Query time: 51 msec
;; SERVER: 127.0.1.1#53(127.0.1.1)
;; WHEN: Fri May 26 12:14:52 CEST 2017
;; MSG SIZE  rcvd: 85

If I force the internal DNS server it works:

$ dig @10.0.0.5 service-testing.company.com

; <<>> DiG 9.10.3-P4-Ubuntu <<>> @10.0.0.5 service-testing.company.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 13259
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;service-testing.company.com.       IN  A

;; ANSWER SECTION:
service-testing.company.com.    60  IN  CNAME   service.testing.company.lan.
service.testing.company.lan.    60  IN  CNAME   service01.testing.company.lan.
service01.testing.company.lan.  60  IN  A   10.0.40.60

;; Query time: 127 msec
;; SERVER: 10.0.0.5#53(10.0.0.5)
;; WHEN: Fri May 26 12:17:51 CEST 2017
;; MSG SIZE  rcvd: 119

I could add our internal DNS to /etc/resolv.conf to make it work but this file gets rewritten every time on connect.

Any thoughts?

0

OpenVPN's Update resolv-conf script in /etc/openvpn/update-resolv-conf should automatically update your /etc/resolv.conf on connect when your OpenVPN client configuration file has:

up /etc/openvpn/update-resolv-conf
down /etc/openvpn/update-resolv-conf

It is possible that some GUI network manager has automatic update scripts that updates them back. It seems that Ubuntu has NetworkManager. I suppose that if NetworkManager handles your OpenVPN connection via network-manager-openvpn module, it would know what to do with /etc/resolv.conf.

If NetworkManager already handles the connection, you might need to workaround by changing your network connection profile from Automatic (DHCP) to Automatic (DHCP) addresses only.

|improve this answer|||||
  • I have added both commands into client conf file and reload the configuration but it did not help, also I changed from Automatic to Automatic address only but still the same issue :( – mabe.berlin May 26 '17 at 11:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.