Comment 1 for bug 1672491

Alright, this is due to a change to 1.2.4:

commit 2f12f485607590d6415cf5fb81ad4db5b04615cd
Author: Beniamino Galvani <email address hidden>
Date: Wed May 11 18:43:41 2016 +0200

    dns: specify egress interface for each dnsmasq upstream server

    Currently we don't specify to dnsmasq which interface must be used to
    contact a given nameserver and so requests can be sent through the
    wrong interface.

    Fix this by concatenating a @interface prefix to each server (unless
    an IPv6 interface scope-id is already present).

    https://bugzilla.gnome.org/show_bug.cgi?id=765153
    (cherry picked from commit b71e104d333a1eb3325274089faf449126a4b157)

Now, this causes _two_ problems.

The first is that for some VPN connections you get traffic going out on tap0, but due to the wonders of ipsec the responses show up on the actual interface, such as eth0 or wlan0. This is a little bit of a pain normally, but it means that dnsmasq simply dies. It is possible that this is something I can fix on my VPN package, but it's _not_ a change that I expected to see in a LTS release.

Second, https://bugzilla.redhat.com/show_bug.cgi?id=1373485 (upstream commit http://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commitdiff;h=2675f2061525bc954be14988d64384b74aa7bf8b fixes it) now matters, and without that fix anything that removes an interface and brings it back up breaks dnsmasq until dnsmasq is restarted.

So, either 16.04 needs to fall back to 1.2.2, or dnsmasq needs the fix applied.

(And if the latter is chosen, VPN plugins which worked before may still be non-functional until additional work on them is done. Again, in an LTS release?)

Regards,
Zephaniah E. Loss-Cutler-Hull.