Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 12 replies
  • Subscribers 28 subscribers
  • Views 1368 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

VPN does not resolve local hosts on linux

oldgoodname

Hi guys,

I am using a Sophos XG v19 as gateway and try to connect via SSL VPN from a Linux notebook.

I configured the SSL VPN as in the sophos own video-tutorial and I found some other tutorials showing the same steps.

When I try to connect from terminal, it works fine, except the DNS resolution. The DNS resolves only public domain-entries. So I think it uses a public-dns-server.

I tried different SSL Settings, configuring no dns or the IP of the sophos itself, because the sophos firewall is the internal dns server.  I also activated the "Use as default Gateway" switch, for not having a split-tunnel.

I think everything should be correct, but I am not able to ping internal hosts by there fqdn, but IP address works fine. So I think the DNS could be wrong. I checkt the /etc/resolv.conf, but there is only one entry showing up:

# Generated by Network Manager

nameserver127.0.0.53

So I am not sure, which one really is in use, when connected by VPN. When I am connected directly to the lan, the DNS on the Sophos firewall works without problems.

I also tried to import the config file into the network manager, which works. But when I try to connect, password field always shows up, so I think it does not work generally or with MFA, or I did it wrong.

So my 2 questions are:

  1. Do you have any suggestion, what to configure, that resolving local DNS host is possible via VPN?
  2. How to correctly import the sophos openvpn config file into the network manager, and where to type in the password and where the MFA token, that i correctly works? -> I would prefer this over connecting via terminal.

I currently use KDEneon distribution.

Thanks a lot in advance and best regards



Edited TAGs
[edited by: Erick Jan at 6:25 AM (GMT -8) on 15 Nov 2022]

Top Replies

  • in reply to Bharat J +1

    Hi Bharat,

    I try to begin again to make clear, what I have configured and how it looks like on my linux notebook. As I mentioned before, I have everything set up as described in this video: https://support.sophos.com/support/s/article/KB-000035542?language=en_US

    So far so easy. I think it could be a DNS problem, so this is the DNS config in the global SSL VPN config:

    IPv4 DNS = 10.xx.xx.xx as primary and 9.9.9.9 as secondary

    The internal DNS is the sophos xg itself. It is the IP address of the management-vlan with a vlan-id. So I think it should be reachable to the ssl-vpn user, even if it is another vlan, because it directly terminates on the sophos xg.

    The sophos is also the DNS in my local network, which works perfect because the DHCP sets the DNS server 10.xx.xx.xx for all DHCP clients. No problem here. If the host is not in my local network, I forward the request to a global DNS as described in the earlier post:

    DNS1: 9.9.9.9

    DNS2: 149.112.112.112

    DNS3: 84.200.69.80

    And I think it is not best practice, that the sophos xg ip is DNS1.

    When I connect via vpn with the terminal command: sudo openvpn --config config.ovpn

    and I check the DNS settings with: resolvectl status tun0

    I get the following:

    Current scopes: none

    No configured DNS server shows up. So maybe it uses the DNS server from wifi connection??? Don't know how to check 100% which is in use.

    When I import the config file into the network manager of linux and i connect, the following DNS settings show up:

    Current scopes: DNS

    Currend DNS Server: 10.xx.xx.xx

    DNS Server: 10.xx.xx.xx and 9.9.9.9

    So it shows up as configured in the global ssl vpn config. So far so good, because I prefer this method over the one in the terminal because its more comfortable. I can ping internal clients and open theire web-site.

    So for me, everything works as expected and I am happy, because I prefer the connection within the GUI then on the terminal. Yesterday I had problems with this method, because I thought, it will use the correct username of the user, from which I downloaded the config file. But I think the config file do not have user specific configuration, so I had to configure the username in the network manager.

    Personally I don't need help anymore, even VPN over terminal still isn't working due to missing DNS config on the client.

    thanks guys an best regards

    Jump to answer
Parents
  • 0

    DNS server (this is a hierarchical system that allows you to forward requests to other servers and find answers). You cannot resolve localhost DNS unless you have a DNS server with an entry for localhost. Try setting it up on a Linux host. Note that Meraki does not have a DNS server (some firewalls do).


    hostname resolution in the office-This works for some hosts on the same VLAN, but over broadcast, not over DNS. IT does not work between subnets (different VLANs). Again, the answer is: Implement a DNS server.


    MAC Address Resolution-MAC addresses apply only to the local LAN segment (same physical network). In this case, it is the same VLAN. Therefore, Mac addresses such as remote VPN hosts will not be resolved.

    This may help,
    J Wick

  • 0 in reply to Jimmy Wick

    Hi Jimmy,

    thanks for your reply. See my answer above.

    best regards

Reply Children
No Data