Intermittent DNS Resolution Failure about openfortivpn

[DimitriPapadopoulos]

I don't think resolvconf is made for systemd. You've probably got the wrong one, this is the one I was referring to.

[DimitriPapadopoulos]

I don't know much about Artix Linux. I guess it is not based on systemd. More importantly, I have no clue how it manages name resolution. My guess is that something like NetworkManager overwrites attempts by openfortivpn or pppd to modify those settings. Please monitor changes of /etc/.resolv.conf. Do they coincide with openfortivpn initialisation, and later with your DNS problems?

You can force the DNS server when running **dig**, thus bypassing any DNS server set in /etc/resolv.conf. Just for testing (that's not a workaround) try the following, where 192.168.10.2 is the IP address of your DNS server:

dig +short @192.168.10.2 <internal>.com

[DimitriPapadopoulos]

However, the above does not explain why it worked with 1.17.1, but not with 1.21. Perhaps that's more related to the version of pppd than the version of openfortivpn. Said otherwise, if you let pppd handle DNS settings, perhaps pppd < 2.5.0 used to handle that as expected (by us), whereas pppd ≥ 2.5.0 has issues.

[Daniel-Boll]

I kept checking /etc/resolv.conf as you suggested and nothing has changed at all time.

I ran watch cat /etc/resolv.conf and then the usual openfortivpn command, although it logs:

DEBUG:  Attempting to modify /etc/resolv.conf directly.
DEBUG:  Adding "nameserver 192.168.10.2", to /etc/resolv.conf.
DEBUG:  Adding "nameserver 192.168.10.2", to /etc/resolv.conf.

Nothing is really added

[Daniel-Boll]

Dig forcing the DNS server worked, but so does everything at the begging, I will let the VPN run for a while and when I can no longer access the DNS by normal means I will try the dig command again to check.

[Daniel-Boll]

@DimitriPapadopoulos apparently it was the gateway, I changed gateways and it worked:

> cat /etc/resolv.conf
nameserver 192.168.10.2
nameserver 192.168.10.2

I think there may be a configuration that does not apply the changes in resolv.conf; If I had the gateway configurations I would provide to enlighten you guys in a possible problem, but as of now I don't have it. I will try to get it, but I think this issue can be closed for now.

Thank you very much for the help.
Best Regards,
Daniel Boll. 🎴

[DimitriPapadopoulos]

There are 3 possibilities:

1. openfortivpn modifies /etc/resolv.conf
2. openfortivpn call resolvconf to handle DNS settings
3. pppd takes over

Option --pppd-use-peerdns triggers case 3, but then that would be a pppd issue, it would not be an openfortivpn issue, would it?

Case 1 works for legacy Linux distributions, and may work for more recent Linux distributions, although modifying /etc/resolv.conf really should be avoided.

Case 2 is supposed to be the best option, but then it depends on resolvconf being available and doing the right thing.

[DimitriPapadopoulos]

This tells me you're in case 1:

DEBUG:  Attempting to modify /etc/resolv.conf directly.
DEBUG:  Adding "nameserver 192.168.10.2", to /etc/resolv.conf.
DEBUG:  Adding "nameserver 192.168.10.2", to /etc/resolv.conf.

Is resolvconf installed?

[Daniel-Boll]

This tells me you're in case 1:

DEBUG:  Attempting to modify /etc/resolv.conf directly.
DEBUG:  Adding "nameserver 192.168.10.2", to /etc/resolv.conf.
DEBUG:  Adding "nameserver 192.168.10.2", to /etc/resolv.conf.

Is resolvconf installed?

No, I was searching how to modify resolv.conf and stumbled upon resolvconf, didn't installed it before trying to modify the gateway, which in turn worked.

[Daniel-Boll]

Because mainly resolvconf is made for systemd, I am not sure if I can use it

[Daniel-Boll]

Oh, I see, I will test with this one. I am running only: sudo openfortivpn -c config.vpn -v

[Daniel-Boll]

Everything seems good, test very thoroughly today. I will be closing the issue, openresolv really solved the matter. Thank you very much.