OpenConnect works but no DNS

OK, I hope the best...explaining that doesn't help though...

  • It seems you want to keep adding those other DNS servers, you have not yet provided information on where those DNS servers are, you seem to think it doesn't matter
  • You didn't seem willing to fix your routes


The servers at are in my employer's data center. They resolve all DNS requests at my place of work.

I'm afraid to mess with my routes because my VPN connectivity is fully functional in every way except for DNS resolution. I can ssh into my router over the VPN and I can even connect to my home NAS via my VPN and move files in both directions. But I can't contact the DNS server on my router, not even with the Windows nslookup utility.

Ping them. Test each end of the connection, using the tunnels IP as the SRC IP for the ping. May even be a firewall thing, as I also suggested.

uci set dhcp.@dnsmasq[0].localservice="0"
uci commit dhcp
service dnsmasq restart

Let the firewall do its job.


So <option localservice '0'> is the first thing I tried when I got into work this morning and of course this fixed my DNS problem immediately (many MANY thanks @vgaetra), but my security spidy-sense is tingling. I'd love to be able to tell dnsmasq that is a local subnet so I can turn localservice back on. I have 2 rental suites in my property and both tenants are on my router, so the less security exposure I have the better. Note that all subnets, MAC addresses and other tokens in the above conversations are not my real configuration.

Many linux distros don't provide safe firewall config from the box.
When their users install dnsmasq it should not create a source of DNS amplification attack.
So the author of dnsmasq added this option.

Your OpenWrt setup is not an unconfigured installation.
It has firewall zones, policies and rules, which you can modify to serve your needs.


Okay thanks ...will leave as is in the absence of other sensible options, which I did not find(that's not say'n much 'cause I'm no guru).