MacOS: DNS setting has no effect if the tunnel is not the default gw

MacOS: DNS setting has no effect if the tunnel is not the default gw

[Alexander A. Klimov]

Hello there!

I have two almost identical tunnels. The only difference:

-AllowedIPs=0.0.0.0/0, ::/0
+AllowedIPs=192.168.234.153/32, 64:ff9b::192.168.234.153/128, 
192.168.234.186/32, 64:ff9b::192.168.234.186/128

The first one's setting DNS=192.168.234.153 has an effect, the second 
one's not.

Has anyone seen this problem, too?
Does anyone even know how to workaround it?

Best,
AK

Re: MacOS: DNS setting has no effect if the tunnel is not the default gw

[Chris Johnson]

I am now running into this problem. I'm still running Mojave (10.14.6), 
if that makes any difference.

If AllowedIPs is everything, then /etc/resolv.conf is modified with the 
remote DNS server.
If AllowedIPs is a remote private network(s), then /etc/resolv.conf 
remains untouched, and DNS is local ISP.

Did you ever find a solution or workaround? I do not want all of my 
traffic to go through this tunnel, but I *do* want DNS to resolve for 
those private subnet hosts.

Cheers,

Chris

On 2020/10/31 07:38, Alexander A. Klimov wrote:
> Hello there!
> 
> I have two almost identical tunnels. The only difference:
> 
> -AllowedIPs=0.0.0.0/0, ::/0
> +AllowedIPs=192.168.234.153/32, 64:ff9b::192.168.234.153/128, 
> 192.168.234.186/32, 64:ff9b::192.168.234.186/128
> 
> The first one's setting DNS=192.168.234.153 has an effect, the second 
> one's not.
> 
> Has anyone seen this problem, too?
> Does anyone even know how to workaround it?
> 
> Best,
> AK

Re: MacOS: DNS setting has no effect if the tunnel is not the default gw

[David Crawshaw]

On Wed, Dec 2, 2020 at 8:48 AM Chris Johnson <johnsonc@astro.ucla.edu> wrote:
>
> I am now running into this problem. I'm still running Mojave (10.14.6),
> if that makes any difference.
>
> If AllowedIPs is everything, then /etc/resolv.conf is modified with the
> remote DNS server.
> If AllowedIPs is a remote private network(s), then /etc/resolv.conf
> remains untouched, and DNS is local ISP.
>
> Did you ever find a solution or workaround? I do not want all of my
> traffic to go through this tunnel, but I *do* want DNS to resolve for
> those private subnet hosts.

I believe this behavior has changed in macOS 11 (Big Sur), and
resolv.conf is updated even if you don't set a default route through
the tunnel. I could not find any Apple API that can change this on
earlier versions of macOS.


> Cheers,
>
> Chris
>
> On 2020/10/31 07:38, Alexander A. Klimov wrote:
> > Hello there!
> >
> > I have two almost identical tunnels. The only difference:
> >
> > -AllowedIPs=0.0.0.0/0, ::/0
> > +AllowedIPs=192.168.234.153/32, 64:ff9b::192.168.234.153/128,
> > 192.168.234.186/32, 64:ff9b::192.168.234.186/128
> >
> > The first one's setting DNS=192.168.234.153 has an effect, the second
> > one's not.
> >
> > Has anyone seen this problem, too?
> > Does anyone even know how to workaround it?
> >
> > Best,
> > AK