Comment 17 for bug 1169437

Revision history for this message
hashstat (hashstat) wrote : Re: network-manager dnsmasq openvpn DNS issue

I'm using NetworkManager 0.9.8.8 on Arch Linux and hitting a similar problem. It looks like it boils down to a problem with the temporary dnsmasq.conf file NetworkManager writes. I found the file by looking at the arguments passed to dnsmasq:

$ ps -C dnsmasq -ww --no-headers
/usr/sbin/dnsmasq --no-resolv --keep-in-foreground --no-hosts --bind-interfaces --pid-file=/var/run/NetworkManager/dnsmasq.pid --listen-address=127.0.0.1 --conf-file=/var/run/NetworkManager/dnsmasq.conf --cache-size=400 --proxy-dnssec --conf-dir=/etc/NetworkManager/dnsmasq.d

$ cat /var/run/NetworkManager/dnsmasq.conf
# domains and addresses changed to protect the innocent
server=/example.com/10.101.109.80
server=/101.101.10.in-addr.arpa/10.101.109.80
server=/example.com/10.101.109.47
server=/101.101.10.in-addr.arpa/10.101.109.47
server=10.20.248.22
server=10.20.128.83

NetworkManager is prepending /domain/ strings to the returned DNS servers so that they are only used for the local domain. Remaining queries are falling to the bottom two servers, which are the original pre-VPN DNS servers, for which routes no longer exists causing DNS queries to anything other than example.com domain to fail. The file should really look like this:

$ cat /var/run/NetworkManager/dnsmasq.conf
server=10.101.109.80
server=10.101.109.47
server=10.20.248.22
server=10.20.128.83

Or even better, like this:

$ cat /var/run/NetworkManager/dnsmasq.conf
server=10.101.109.80
server=10.101.109.47

Manually configuring the DNS servers in NetworkManager results in the following:

$ cat /var/run/NetworkManager/dnsmasq.conf
server=/101.101.10.in-addr.arpa/10.101.109.80
server=/101.101.10.in-addr.arpa/10.101.109.47
server=10.20.248.22
server=10.20.128.83

This is still wrong. Prepending the domain should only be used when "Use this connection only for resources on its network" is checked.

Could those of you still having trouble on your Ubuntu systems please verify this?