On 29/09/2020 17:21, Paul Wouters wrote:
For the VPN scenario, it is just a little bit more complicated.
For those with proper standards, such as "Cisco IPsec", L2TP/IPsec",
the VPN confiuration is dictated by the server to either send all or
some traffic to the VPN server. If it is not "everything", then these
VPNs convey 1 domain name and one or more IP's of DNS servers to use
to resolve that domain.
For IKEv2 IPsec based VPNs, any number of domain names can be specified
by the server to be used by the client. When doing split-DNS with DNSSEC
trust anchors, these can be conveyed and there are strict rules on when
to allow these to override public DNSSEC trust anchors as per RFC 8598.
For VPN protocols with no real standard, things are more complicated.
OpenVPN can do custom things. It all depends on the provisioning.
As an OpenVPN developer, I can't resist giving a few details here :)
OpenVPN 2.x using the openvpn-client@.service unit files depends entirely on
the OpenVPN configuration. So you are right here.
OpenVPN 2.x using NetworkManager, will let NetworkManager pick up changes and
apply them accordingly to the abilities of the NetworkManager-openvpn plugin.
OpenVPN 3 Linux can be enabled with systemd-resolved support [0], but
out-of-the-box it will modify /etc/resolv.conf directly. Enabling
systemd-resolved support, you will get fairly close to a split-DNS setup but
not completely - but this integration is still considered tech-preview and
we're using the v10_beta release to gain more experience with systemd-resolved
across various distributions. Ubuntu 20.04 has also enabled systemd-resolved
by default, but it seems it has not gone as far as Fedora 33.
Common to all of these alternatives, the VPN server must push DNS options or
the client configuration file must include the appropriate --dhcp-options.
[0]
<
https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg20607...
--
kind regards,
David Sommerseth
OpenVPN Inc