Setting DNS parameters on Fedora #590
Comments
DimitriPapadopoulos
changed the title
mrbaseman
changed the title
|
When using vpn nameservers I need nameserver records to be inserted rather than appended by openfortivpn. It is unclear for me is this mode is completely impossible or not in my configuration. I'm currently using fedora 31 xfce spin, /etc/resolv.conf is a symlink to systemd-resolved /usr/lib/systemd/resolv.conf , NetworkManager is in 'default' mode . It receives dns from dhcp and in /run/systemd/resolve/resolve.conf I see: The problem I wish to solve - dns over vpn - how to configure openforticlient in that way, when these records received from vpn upstream: nameserver 10.126.126.137 are placed upper than record received from dhcp via NetworkManager when dell15 has ethernet plugged in: nameserver 8.8.4.4 and remove inserted on vpn down. This may appear to be a task of systemd, not openfortivpn? Can openfortivpn instruct systemd-resolved to insert records ? |
|
I believe we agree but this issue is quite complex:
|
|
@grey-olli That said the records are not appended on my Fedora 31 virtual machine, they are properly inserted in front of the rest: Before: $ cat /etc/resolv.conf
# Generated by NetworkManager
nameserver 10.0.2.3
$ Running openfortivpn: $ sudo /opt/openfortivpn/bin/openfortivpn -u xxxxxxx xxxxx.xxxx.de
VPN account password:
INFO: Connected to gateway.
INFO: Authenticated.
INFO: Remote gateway has allocated a VPN.
Using interface ppp0
Connect: ppp0 <--> /dev/pts/1
INFO: Got addresses: [10.212.134.200], ns [xxx.xx.252.252, xxx.xx.252.202]
INFO: negotiation complete
INFO: negotiation complete
local IP address 10.212.134.200
remote IP address 192.0.2.1
INFO: Interface ppp0 is UP.
INFO: Setting new routes...
INFO: Adding VPN nameservers...
INFO: Tunnel is up and running.After: $ cat /etc/resolv.conf
nameserver xxx.xx.252.252
nameserver xxx.xx.252.202
search xxxx.de xxx.xxxx.de xxx.de
# Generated by NetworkManager
nameserver 10.0.2.3
$ Which version of openfortivpn are you using? Which options? |
|
For what it's worth on a default installation of Fedora 31: $ rpm -q systemd
systemd-243.7-1.fc31.x86_64
$
$ rpm -q openfortivpn
openfortivpn-1.12.0-1.fc31.x86_64
$ Here is what I see: $ ls -l /etc/resolv.conf
-rw-r--r--. 1 root root 136 Mar 24 15:30 /etc/resolv.conf
$ whether systemd is enabled: or not: |
|
Also (while openfortivpn is running): |
|
In any case:
I am still unable to grasp how DNS is configured on Fedora and how to modify the DNS parameters. My experience is that it has always been complicated on Fedora / CentOS. |
|
@DimitriPapadopoulos presets:
tested combinations:
Above 4 combinations with openfortivpn using all 3 combinations of settings: I mean 1/0 ; 0/1 ; 1/1 . 0/0 seem to be useless for my task. Result: [olli@dell15 ~]$ resolvectl | head -n 13 When vpn is up I have something like this: [root@dell15 ~]# resolvectl dns Who should pickup at least one ppp0 DNS server and append it to Global list? systemd? |
|
@grey-olli did you notice that we have issue #555 with openfortivpn 1.12.0 on Fedora? It's fixed in openfortivpn 1.13.1 for which packages are on their way. I believe with those you can achieve what you want: If you want to have the dns entries prepended, you could use Since you are mentioning dhcp, where your lease might expire, you might also want to use |
|
@grey-olli I'm terribly sorry but I have mistakenly selected "Edit" instead of "Quote reply" and modified your post. Don't know how to revert, did my best 😥 |
Yes, I interpret that as pppd being broken on Fedora but I may be wrong.
Strange. On my machine opnefortivpn prepends DNS records sent by the FortiGate appliance before all the rest so they should have priority. See my own example:
Strange. openfortivpn does not modify
Yes. This is because there is a local DNS servers that hides the DNS servers behind it. It does not necessarily mean that the modified I really don't know. The DNS subsystem is extremely complex on Fedora / CentOS. Reading and understanding systemd-resolved.service(8) is beyond my current capabilities. Our best bet is probably to support
Yes, same here. That's built-in by Fedora.
I don't know. I'm lost in the complexity of the DNS subsystem and the multiple cases above. I cannot help. Perhaps it would be easier to focus on a single case you think should work and investigate it thoroughly in a new issue. The new issue should:
But then I cannot guarantee I will have time to look into it |
|
@mrbaseman as about #555 - I've downloaded package for x86_64 fedora31 directly & used dnf install /path/to/openfortivpn-1.13.1-1.fc31.x86_64.rpm . It upgraded w/o warnings, though on my system it seem to ignore the option configured in configfile (and noted in man page): [root@dell15 etc]# openfortivpn Though /etc/resolv.conf (non-symlink) is updated exactly as I wanted it to be (configuration inserted into begining, not appended & successfully removed when vpn stops). Note, that a 'query' operation from resolvectl starts systemd-resolved (once it is enabled ). If I use /etc/resolv.conf as a symlink to /run/systemd/resolve/stub-resolve.conf the systemd-resolved configuration is updated through symlink & the /run/systemd/resolve/resolve.conf contain correct configuration (indirect update, most probably it does the openforticlient executable, since systemd-resolved was stopped at the moment). All above was done with NetworkManager stopped. Though once I've started NetworkManager when
The only servers configured in Network Manager are two ones - 1) the 8.8.4.4 received from dhcp for entire LAN network & 2) the 127.0.0.53 - the systemd-resolved itself .. Everything else is a result of NetworkManager start after vpn is UP (vpn was connected when NetworkManager was stopped). NetworkManager does NOT respect modifications of /etc/resolve.conf by external programs - it was its default behaviour years ago - looks like it is the same. There should be a way to notify Network Manager about already running connection, I guess. NetworkManager is default for most linux workstations. It seems that openfortivpn cli should somehow tell NetworkManager about new dns servers. Anyway this seem to be race condition between openfortivpn and NetworkManager (looks like systemd-resolved has no problems with openfortivpn alone). After above I've removed additional systemd-resolved dns server from my ethernet connection in NetworkManager (I don't remember how it appeared there) and started openfortivpn again. The things are getting better - no mess with systemd-resolved configuration in /run/systemd/resolve/stub-resolv.conf (openfortivpn prepended nameservers there - all goes correct), but the 'resolvectl dns' command seem to NOT understand the real configuration. It does NOT show new prepended dns servers at all, 'global' dns is empty, LAN dhcp-provided dns is now shown in As about '--half-internet-routes=1' - my vpn is corporate one - them do not provide default routes - they give routes for private IPV4 address space & provide private dns servers.. In general I've 3 dns areas:
I would like to switch between 2 & 3 when VPN is up, but I'm unaware on easy GUI or commandline that transparently integrates with NetworkManager and is able to prepend custom DNS (not append) by user action. Now getting into NetworkManager thing - after upgrade of openfortivpn to openfortivpn-1.13.1-1.fc31.x86_64.rpm (via direct download) I'm still unable to use NetworkManager integration. I had a few unsuccessfull attempts to configure vpn with NetworkManager 'Fortinet SSL VPN' - it times out & NetworkManager interface for VPN has no 'debug' mode - I see almost no details in journalctl -f when connecction attempt is made. Is NetworkManager 'Fortinet SSL VPN' is something developed here or I should adress this question somethere else? |
|
as about 'Our best bet is probably to support resolvectl when it is available.' - I don't think it's best bet - the best bet from my point of view is having some interaction with NetworkManager - current support of resolve.conf after #555 fix seem to be sufficient for interacting with systemd-resolved , but not the NetworkManager. |
Fair enough, but how does one interact with NetworkManager? Also some users prefer to disable NetworkManager. I thought |
Here is the page for NetworkManager-fortisslvpn: NetworkManager-fortisslvpn is probably the way to go if you're running NewtorkManager on your computer. It runs openfortivpn under the hood with options But you're right, perhaps we should somehow integrate the command line parts of these two programs. |
Yep, if NetworkManager-fortisslvpn has options --set-dns=0 --pppd-use-peerdns=0 hardcoded , then everyone who has fedora default NetworkManager enabled will deal with race conditions on /etc/resolve.conf from openfortivpn cli and NetworkManager - as I do. In any condition the NetworkManager 'NetworkManager-fortisslvpn' plugin should have I see you made merge request for new openfortivpn features - could you implement '--use-syslog' option as optional verbosity flag? |
Not sure about this one. Precisely because NetworkManager-fortisslvpn calls openfortivpn with options That's a different issue if using openfortivpn directly, but then why not use NetworkManager instead of calling openfortivpn directly if you're running NetworkManager?
You'd have to ask that on the NetworkManager-fortisslvpn page: |
DimitriPapadopoulos
changed the title
|
This issue has been focusing on a very specific issue. I have renamed it and opened a new one for the more general discussion of setting DNS parameters. @grey-olli Since you seem to have solved your problem, can we close this issue? |
Indeed the option can be found in the man page because the man page is not modified by the build process. Yet this specific option is disabled on Fedora because |
I've noticed this issue https://gitlab.gnome.org/GNOME/NetworkManager-fortisslvpn/-/issues/22 , please vote. You may close. |
|
I've submitted a pending PR for supporting DNS record management using |
I suspect the official way to modify DNS parameters on CentOS >= 8 and Fedora is running
resolvectl, at least whenresolvectlis available.Therefore I would recommend the following mechanism when
--set-dns=1:resolvectlis available and works properly, run it to modify DNS parameters. Decide at build-time or run-time?resolvconfis available and works properly (either openresolv or resolvconf but not resolvectl), run it to modify DNS parameters. Decide at build-time or run-time?/etc/resolv.confdirectly.I recommend the above order,
resolvectlbeforeresolvconf, becauseresolvconfmight be available but doesn't seem to be working properly on Fedora.Man pages:
Hopefully we can get some info from this bug report:
https://bugzilla.redhat.com/show_bug.cgi?id=1815605
The text was updated successfully, but these errors were encountered: