5
2
After connecting with the Kerio VPN client (OS X Leopard) to a server, the internet (~web browsing) stopped working for the client.
After poking around, the issue seems to be bad DNS server (i.e., entering IPs directly works). After disconnecting from the VPN, the invalid DNS server disappears from scutil --dns
and all's well again.
Now, I don't understand why OS X on the client even changes the DNS settings -- internet should be routed through a different interface, through the default gateway, not through the VPN.
Questions:
- By what mechanism does connecting the VPN client change the "default" DNS server?
- How can I stop the VPN client from changing routing/DNS rules? Where is this stuff stored/modified?
Before VPN:
$ scutil --dns
DNS configuration
resolver #1
nameserver[0] : 10.66.77.1 # <---- default gateway = home router; all good
order : 200000
resolver #2
domain : local
options : mdns
timeout : 2
order : 300000
...
VPN connected:
$ scutil --dns
DNS configuration
resolver #1
nameserver[0] : 192.168.1.1 # <--- rubbish
nameserver[1] : 192.168.2.1
order : 200000
resolver #2
domain : local
options : mdns
timeout : 2
order : 300000
...
The VPN doesn't appear among $ networksetup -listallnetworkservices
. It also doesn't appear in the "Network" dialogue of System Preferences. ifconfig
reports it as
kvnet0: flags=8842<BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1400
inet 192.168.2.9 netmask 0xffffff00 broadcast 192.168.2.255
ether 44:45:53:54:4f:53
EDIT: progress -- according to Kerio VPN docs:
The VPN server also assigns the client an address for the primary, and
optionally also secondary DNS server and DNS domain extension. This
allows to specify remote hosts with their names.
The change of DNS configuration has such effect that all DNS queries
from the client host are sent to a DNS server in a remote private
network. Users usually do not even notice any change. Upon closing of
the VPN connection, the original DNS configuration will be recovered.
How do they do that, and how do I stop them from doing it (switch DNS back without closing the VPN)?
Thanks, but as my original post mentions, the VPN network doesn't appear in network preferences at all. Also, I already tried
scutil
. I am now looking for concrete, technical steps to enforce DNS resolution (or to stop the DNS settings from being modified in the first place). – user124114 – 2012-07-12T12:38:03.493If the client doesn't expose a network service, yes you can't use the preferences pane. Since you want to override global settings, you also can't use /etc/resolver files, which apply only for specified domains. Therefore, you're only remaining option is
scutil
. You say you tried it. Did you try clobbering the settings for a particular serviceState:/Network/Service/<hash>/DNS
, or forState:/Network/Global/DNS
? – algal – 2012-07-16T09:15:10.043thanks a lot for your patience. i went for a radical solution and wiped and upgraded the entire OS... – user124114 – 2012-07-16T16:26:30.123