<div class="gmail_quote">Thanks for your help; responses inline:</div><div class="gmail_quote"><br></div><div class="gmail_quote">On Fri, Jul 10, 2009 at 10:04 PM, Tom Metro <span dir="ltr"><<a href="mailto:tmetro%2Bdnsmasq@gmail.com">tmetro+dnsmasq@gmail.com</a>></span> wrote:<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
What does "ipconfig /all" report on the Windows machine before and after activating the VPN?<br>
</blockquote><div><br></div><div>I ran it with/without VPN and with/without dnsmasq. I can attach all output if you'd like, but here's a condensed version of dnsmasq + vpn:</div><div><div><br></div><div>Windows IP Configuration</div>
<div><br></div><div> Host Name . . . . . . . . . . . . : myhost</div><div> Primary Dns Suffix . . . . . . . :</div><div> Node Type . . . . . . . . . . . . : Peer-Peer</div><div> IP Routing Enabled. . . . . . . . : No</div>
<div> WINS Proxy Enabled. . . . . . . . : No</div><div> DNS Suffix Search List. . . . . . : mysuffix</div><div><br></div><div>Ethernet adapter Wireless Network Connection:</div><div><br></div><div> Connection-specific DNS Suffix . : mysuffix</div>
<div> Dhcp Enabled. . . . . . . . . . . : Yes</div><div> Autoconfiguration Enabled . . . . : Yes</div><div> IP Address. . . . . . . . . . . . : 192.168.2.51</div><div> Subnet Mask . . . . . . . . . . . : 255.255.255.0</div>
<div> Default Gateway . . . . . . . . . : 192.168.2.1</div><div> DHCP Server . . . . . . . . . . . : 192.168.2.31</div><div> DNS Servers . . . . . . . . . . . : 192.168.2.31</div><div><br></div><div>PPP adapter mycompany</div>
<div><br></div><div> Connection-specific DNS Suffix . :</div><div> Description . . . . . . . . . . . : WAN (PPP/SLIP) Interface</div><div> Dhcp Enabled. . . . . . . . . . . : No</div><div> IP Address. . . . . . . . . . . . : 192.168.1.??</div>
<div> Subnet Mask . . . . . . . . . . . : 255.255.255.255</div><div> Default Gateway . . . . . . . . . : 192.168.1.??</div><div> DNS Servers . . . . . . . . . . . : 192.168.1.??</div><div><br></div><div>
Without Dnsmasq:</div><div><br></div><div>1. No 'DNS Suffix Search List' entry</div><div>2. The 'Connection-specific DNS Suffix' is empty</div><div>3. Ethernet adapter 'DHCP Server' is 192.168.2.1</div>
<div>4. Ethernet adapter 'DNS Servers' lists the two OpenDNS servers</div><div><br></div><div>Aside from that they're identical. When the VPN is disconnected (with or without dnsmasq), the PPP adapter section disappears; the rest remains the same.</div>
</div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
Are you sure the private server doesn't resolve the public addresses? If so, that would suggest things are somewhat broken for the people within <a href="http://company.com" target="_blank">company.com</a>'s LAN, if they're using the same private server.<br>
</blockquote><div><br></div><div>Sorry, you're right; I was mistaken about that. I must have made a mistake or typo when trying that.</div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
Your hack #2 worked because you made the public server unreachable, though I'm not entire clear on how you did that, as you seemed to imply there was a DNS lookup for the DNS server itself, which is usually something that doesn't happen. (Post your relevant Dnsmasq config lines.)</blockquote>
<div><br></div><div>There's a setting (set by default) on VPN connections in Windows where, according to its label text, if Windows tries to resolve an address using local DNS, and that fails, it tries again with the VPN DNS. That setting didn't come into play before, since the VPN DNS was used first.</div>
<div><br></div><div>Once the VPN DNS was no longer first, it would try OpenDNS (via dnsmasq). But OpenDNS rewrites NXDOMAIN to point to a revenue-generating website. In dnsmasq.conf, I added:</div><div><br></div><div>bogus-nxdomain=208.67.217.132</div>
<div><br></div><div>Then the failures were properly reported as such, causing Windows to retry using the VPN DNS (or so I understand it, at least).</div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
Technically, if the VPN is only accessible from one machine on your LAN, the Dnsmasq being used by all the machines on your LAN is not the best place to inject your fix. You'd be better off applying some fix to the Windows box directly.</blockquote>
<div><br></div><div>That is a much better idea, but I haven't yet found anything I can do locally to mimic the old behavior. It's mostly about one machine in particular where it's much more convenient if the internal IP is used when the VPN is connected, and the public IP is used when VPN is not connected.</div>
<div><br></div><div>Thanks again,</div><div><br></div><div>David</div></div>