DNS resolution fails on macOS #534
Comments
DimitriPapadopoulos
changed the title
|
Can confirm, same issue here. |
DimitriPapadopoulos
changed the title
|
For now I solve it using In the openfortivpn config file |
|
@rizalp Option |
|
I also have the same issue. Thanks for the workaround 👍 |
|
Can confirm the workaround works. |
|
There are two ways we can fix that:
|
|
I think you meant Objective-C, but that's also not needed. The |
|
Ah right, I seem to recall now that Objective-C was designed to be highly compatible with C (easily called from C). We probably need to link with an additional SystemConfiguration library though. |
|
By the way, the sources of pppd for macOS can be found here: That might give a clue how to fix this. |
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
No new issue, thankfully. Just some frustrating nuance of how pppd adds the DNS setting (at least in 10.15.4). Apparently whatever pppd does with DNS does not work for Last time, by the time I got to Today, I remembered to check My local router/DNS is 10.0.2.1. I replaced my work with dns1/2: Sorry -- you'll probably have to mark this off-topic, too, but I just wanted to note this stupid little detail somewhere in case it's useful for a troubleshooting document note or something. |
|
Just wanted to bump this as I've been unable to get name resolution working on 11.6.1 (big sur). Using settings: Which produces the following in I find this odd:
Unfortunately, neither of these sections correctly display the search domains that are detected when connecting to the VPN, as displayed by the |
|
Hi all, stumbled upon this issue as I was trying to get dns options ironed out. Connection works perfectly fine and using --pppd-use-peerdns=1, dns resolution is working partially. Indeed, the dns searchdomains which are configured server side seems to be correctly received by the client: but not used by osx: I can for example ping (or safari,...) In resolvconf, the name servers and search domains are present, and in I tried adding them manually with a: on both the resolver key and Has someone experienced the same troubles ? |
|
Oh and also, if I add a file in |
|
Finally it only works with the first suffix... |
Re. "a file" -- I needed one file per suffix I wanted to add nameserver entries for. I'd never actually bothered with 'search' lines, but just did a quick test and it seemed to work for me on macOS 12.2.1. I did this to test split DNS. I'm sure there's a better way to simply add DNS servers and search suffixes for general use. From my ip-ip script: All of |
|
See also #987. |
|
@beremour Meanwhile, you could give OpenConnect a try. Does it work any better? |
|
Like many others, I was able to work around this DNS problem by adding: to my openfortivpn config. I don't know if this has been brought up already, but one of our devs is on Ubuntu and using the official FortiClient deb from FortiNet, and has been having similar problems. So seems like this DNS issue is also affecting the official version... |
|
Instead you should be using: The problem is similar on macOS and GNU/Linux, but not identical. On both platforms, the API to modify DNS parameters evolved:
We have not been able to find the resources to support all of those quickly evolving APIs. The fact that FortiClient does not work well on Ubuntu (with DNS leaks and other mishaps) shows it is not straightforward. The best course of action would probably be to change openfortivpn to run the same script as OpenConnect, that is vpnc-scripts. However, vpnc-scripts itself still fails to properly support recent APIs, such as |
|
Sorry to add something so trivial, but it tripped me up as a n00b, and is at least easily fixed!: |
|
I cannot find |
|
Here's what I see: |
|
The man page must in some way be Mac-specific, as it contains a reference to the homebrew cellar:
|
|
Ah right, thank you for pointing me to the exact location. Fixed in #1003. The man page is not specific, it just contains a macro that points to the location of the config file defined at build time. |
|
Still does not work on MacOS. |
|
What did you try exactly? What do you mean by "does not work"? Which version of MacOS and openfortivpn? Because openfortivpn currently lacks the code to properly set the DNS servers on recent MacOS systems, I had suggested to let |
Still doesn't work, get ERR_NAME_NOT_RESOLVED Had flags set to macOS Monterey 12.5.1 Works fine with openconnect with stock settings. Not sure what I need to provide for debugging purposes. |
|
As far I can understand, the VPN tunnel is created, but DNS resolution fails because the company DNS servers are not taken into account. Can you ping company servers by IP address, not by name? As always, (redacted) logs would help. |
|
For me I'm using macOS Ventura 13.0.1 and openfortivpn 1.19.0 |
|
Actually ping is only working for domains inside VPN, but outside of VPN it timeouts. |
|
I can confirm that |
|
When you say you cannot access
|
|
Sorry, looks like I was wrong, it might be a routing issue.
|
This has been the answer for me. Openconnect just works. |
|
If it is a routing issue,
One significant difference between OpenConnect and openfortivpn is IPv6 support. But then, you are unable to ping the IPv4 address |
|
Here is the without VPNRouting tablesInternet:
Internet6:
with OpenConnectRouting tablesInternet:
Internet6:
with openfortivpnRouting tablesInternet:
Internet6:
For the sake of privacy I have marked the specific address parts with |
This worked for a while for me, until today the company DNS restricted to internal domains only. Using this allows digging the right ip in terminal, but not in any other apps, including
|
I have this exact same situation and have come to no avail in regards to solving this. And to make it even more frustrating I just tried Openconnect which failed on me in some other aspect... What to do? |
|
it seems that --set-dns=1 is adding lines in the beginning of the file. keeping the existing lines on the bottom and they are conflicting |
|
Using in my .config file worked perfectly in macOS Sonoma 14.7.2. |
|
this doesn't work with domain search |
As already stated in #501 (comment) currently openfortivpn doesn't properly register itself with the macOS.
The issue boils down to the fact that on macOS
/etc/resolv.confis used as a compatibility layer for software that prefers to do DNS resolution directly instead of using the system provided APIs.This means that while tools like
nslookupwill happily use whatever openfortivpn writes to/etc/resolv.confother tools such aspingwhich gets it's DNS resolution throughgethostbynamewill still be using the data stored in so calledSystemConfigurationframework.Official FortiClient does that by somewhat strange configuration where it registers itself within the SystemConfiguration as piggybacking on
en0.The text was updated successfully, but these errors were encountered: