What is resolv.conf and why VPN client's hack it?

Question

As stated in a previous question I want to connect to 2 VPN servers at the same time and for each connection specify the IPs of computers I want to reach with it. One of this VPN connection is done with vpnc and a default.conf file, and the other one is done with a Cisco client (I am not able, for now at least to connect with vpnc because I don't have the IPSecrete element required to connect).

I am ok with the connection done through vpnc: I am able to connect configure the targeted IPs to use the created interface as following:

#!/bin/sh

#Get default gateway
DEFGW=`ip route list | grep default | awk -F' ' '{print $3 }'`
DEVICE=`ip route list | grep default | awk -F' ' '{print $5 }'`

echo "Default Gatway is: $DEFGW on device $DEVICE"

echo "Starting vpnc"
sudo vpnc

echo "Adding routes to known computers through VPN network interface"
sudo route add -net 132.181.11.0  netmask 255.255.255.0 dev tun0

echo "Adding all other routes through standard network interface"
sudo route del default
sudo route add default gw $DEFGW dev $DEVICE

Now, before running the two connections simultaneously, I am trying to do the same with the Cisco client but I am facing on problem with resolv.conf. This file is modified by the VPN client with a domain value and to DNS servers values. Running the following script result in DNS resolutions errors (reported by chrome)

#!/bin/sh

#Get default gateway
DEFGW=`ip route list | grep default | awk -F' ' '{print $3 }'`
DEVICE=`ip route list | grep default | awk -F' ' '{print $5 }'`

echo "Default Gatway is: $DEFGW on device $DEVICE"

echo "Starting cisco"
sudo /opt/cisco/vpn/bin/vpn connect 134.214.244.203

echo "Adding routes to computers through VPN network interface"
sudo route add -net 132.212.146.156  netmask 255.255.255.255 dev cscotun0

echo "Adding all other routes through standard network interface"
sudo route del default
sudo route add default gw $DEFGW dev $DEVICE

Any help and comments on this, and solve the issue are welcome.

Thanks

Answer 1

/etc/resolv.conf defines how the computer resolves host names (e.g. which, if any, default domain names are searched when you try to resolve a non-FQDN hostname....lookup for a bare www becomes www.yourdomain.example.com), and which name servers are used to do the lookup.

One of the reasons, and the most likely, that VPN clients might modify /etc/resolv.conf is to make the VPN client computer use a particular nameserver for hostname resolution - e.g. if the VPN router runs a caching name-server.

There is nothing stopping you from changing /etc/resolv.conf back to what you want it to be, and the VPN client software may even provide you with some automated method of doing that (otherwise just cp a backup copy of resolv.conf back into place)....but you may have difficulty resolving some names (e.g. some domains are set up with public and private views - outsiders see only "public" names, while insiders - including VPN clients - see all the internal, private names as well).

One way to solve this would be to cp not a backup copy of the original resolv.conf, but a modified copy with both your preferred name-servers and search domains as well as what the VPN client software wants.

Answer 2

/etc/resolv.conf lists the name servers that your computer uses to look up DNS names. To send packets to a computer, you need to know its IP address, but IP addresses are (more or less) tied to a particular Internet service provider and location, and can change, so they aren't normally used to designate computers. Instead, DNS names are used.

Usually whoever provides your Internet access (e.g. your ISP) provides name servers to use. The name servers themselves have to be accessed via their IP address, of course. Usually, when you connect with DHCP or PPP, your computer receives DNS server addresses, and the software updates /etc/resolv.conf automatically to add your provider's DNS servers' addresses, and remove them when you disconnect.

In simple cases, you only need a single DNS server listed in /etc/resolv.conf. That server will interrogate other servers as needed if it doesn't have the answer to a query. Often, when you connect through a provider or inside a large organization, you'll see two addresses: a primary server and a fallback server in case the primary server goes offline.

With Debian-based distributions, ensure you have the resolvconf package installed (it's now installed by default under Ubuntu), as it takes care of managing /etc/resolv.conf. It usually gets things right automatically, and if it doesn't it's easy to tweak.

If, with your two VPNs, you can use a single nameserver, arrange for some working nameserver to end up in /etc/resolv.conf. Preferably, configure the VPN client you don't want DNS from not to overwrite /etc/resolv.conf (any good VPN client should have this as an option in its configuration file or in a companion script).

If you need multiple nameservers, for example because each VPN gives you access to a different internal network, you'll need to connect to a single nameserver that dispatches the requests. I recommend dnsmasq, which is lightweight, easy to configure, and powerful enough for most single-machine and small-network setups. If you run your own nameserver, /etc/resolv.conf must contain nameserver 127.0.0.1 and no other nameserver directive, so ensure that none of your VPN clients override that.