Package: vpndnshelper
VPN DNS HelperThis tool allows local DNS server to coexist with corporate VPN DNS server by
adjusting the dnsmasq configuration dynamically.DescriptionIf you want to set up a split DNS corporate VPN on a Linux system that is itself
included in an advanced local network environment with its own DNS server, you
may encounter anunpleasant issue: once the VPN connection is established, you
can no longer resolve local systems/services because the VPNoverwritesthe
local nameserver with thecompany VPN nameserver.A simple solution would be to add the local systems to/etc/hosts, but what if
there are many, or if they change frequently?A better solution to this problem is presented here: on the system, that needs
to access the corporate VPN (vpn system), we usednsmasqas a resolver on
localhost, and instructdnsmasqto resolve VPN destinations only with the
VPN nameserver. This should work even if your corporate DNS uses public domains
with private subdomains.PrerequisitesInstalldnsmasqon thevpn systemin such a way that nameserver changes on VPN
start (e.g. triggered by the NetworkManager) do not end up in /etc/resolv.conf
but in another file (e.g./run/dnsmasq-resolvers.conf). We do not supply this
file directly todnsmasq, but adjust adnsmasqconfig file dynamically
(e.g./etc/dnsmasq.d/vpndnshelper.conf).On a SUSE system, the network setup is done withnetconfig. For our specific
needs, please check/adjust/etc/sysconfig/network/config:NETCONFIG_DNS_POLICY="auto"
NETCONFIG_DNS_FORWARDER="dnsmasq"
NETCONFIG_DNS_FORWARDER_FALLBACK="no"
NETCONFIG_DNS_STATIC_SEARCHLIST=""
NETCONFIG_DNS_STATIC_SERVERS=""InstallationCreate a config file with the name/etc/dnsmasq.d/vpndnshelper.conf:# force primary interface
interface=lo
bind-interfaces
domain-needed

# disable dhcp
no-dhcp-interface=

# VPN DNS server
#server=/vpndomain.tld/othervpn.tld/12.34.56.78
# VPN DNS revres

# local DNS server
server=12.34.56.78In this file, the section between the VPN DNS comments is adjusted dynamically.
The VPN domain names and the local server need to be set up correctly. Before
the VPN is started, it's a good idea to keep the VPN DNS server disabled.The paths of/run/dnsmasq-forwarders.confand/etc/dnsmasq.d/vpndnshelper.conf,
as well as thednsmasqrestart command can be changed via the environment.
Seevpndnshelper --helpfor further configurability.After installation checksAfter a restart of thevpn system,/etc/resolv.confshould not contain any
nameserver entries. That forces the resolver to resolve vialocalhost, which is
handled bydnsmasq./run/dnsmasq-forwarders.confshould only contain the local
nameserver, which must be manually assigned to the local DNS server in/etc/dnsmasq.d/vpndnshelper.conf.OperationWhen the VPN tunnel is established, netconfig will add the VPN nameserver with
higher priority to/run/dnsmasq-forwarders.conf. We monitor any changes to this
file, adjust/etc/dnsmasq.d/vpndnshelper.confand restartdnsmasq.When the VPN is started, we will rewrite VPN DNSserver=lines. If multiple VPN
nameserver are supplied, the firstserver=line is used as a template for all
entries, and the comments are removed.When the VPN is shut down, theserver=entries are simply commented out again.Issues and CaveatsWe monitor filesystem changes to/run/dnsmasq-forwarders.confwithpyinotify.
During development, we noticed a race betweenIN_CLOSE_WRITEand file mtime
changes.Another option to get noticed from VPN state changes isdbus, but this would
make us depending harder onNetworkManagerand comes with its own can of worms.For now, we rely on being started with a teared down VPN tunnel in order to
collect the local nameserver. If you need to restartvpndnshelperduring
operation, tear down the VPN tunnel first.vpndnshelperwill reset the VPN
DNS server on restart, but will not be able to catch up with current state with
an open VPN tunnel.