OpenConnect works but no DNS

[lleachii]

@lleachii

Don't see how it was involved, thanks for the clarity. I also don't see on the client where you established a connection, then.

OK, I hope the best...explaining that doesn't help though...

@Stepan

It's a split tunnel so I do need to be able to resolve DNS both via my router and by the DNS servers at my place of work.

• It seems you want to keep adding those other DNS servers, you have not yet provided information on where those DNS servers are, you seem to think it doesn't matter
• You didn't seem willing to fix your routes

@Stepan

I'll try all these things and will report back tomorrow.

[Stepan]

The servers at 192.168.3.46 are in my employer's data center. They resolve all DNS requests at my place of work.

I'm afraid to mess with my routes because my VPN connectivity is fully functional in every way except for DNS resolution. I can ssh into my router over the VPN and I can even connect to my home NAS via my VPN and move files in both directions. But I can't contact the DNS server on my router, not even with the Windows nslookup utility.

[lleachii]

Ping them. Test each end of the connection, using the tunnels IP as the SRC IP for the ping. May even be a firewall thing, as I also suggested.

[vgaetera]

@Stepan

Wow, that's a huge red flag but I'm not sure how to fix it.

uci set dhcp.@dnsmasq[0].localservice="0"
uci commit dhcp
service dnsmasq restart

@Stepan

I will also try setting localservice to off, but I'm not crazy about that solution from a security perspective.

Let the firewall do its job.

[Stepan]

@vgaetera

Let the firewall do its job.

So <option localservice '0'> is the first thing I tried when I got into work this morning and of course this fixed my DNS problem immediately (many MANY thanks @vgaetra), but my security spidy-sense is tingling. I'd love to be able to tell dnsmasq that 192.168.200.0 is a local subnet so I can turn localservice back on. I have 2 rental suites in my property and both tenants are on my router, so the less security exposure I have the better. Note that all subnets, MAC addresses and other tokens in the above conversations are not my real configuration.

[vgaetera]

Many linux distros don't provide safe firewall config from the box.
When their users install dnsmasq it should not create a source of DNS amplification attack.
So the author of dnsmasq added this option.

@http://www.thekelleys.org.uk/dnsmasq/docs/dnsmasq-man.html

--local-service
It is intended to be set as a default on installation, to allow unconfigured installations to be useful but also safe from being used for DNS amplification attacks.

Your OpenWrt setup is not an unconfigured installation.
It has firewall zones, policies and rules, which you can modify to serve your needs.

[Stepan]

Okay thanks ...will leave as is in the absence of other sensible options, which I did not find(that's not say'n much 'cause I'm no guru).