deraps
I have an split tunnel environment where I need to have multiple search domains, but NOT split DNS. The client should get a single DNS server sent and use it for everything.
I don't see a way to do this via the GUI. Default domain suffix only seems to be made for a single suffix, and when you put a list of domains in the DNS resolution zones field, it only resolves those domains using the DNS server set in the GUI(everything else will use the client's default resolver).
Is there a way to do this perhaps via client config directives?
Again, the three requirements I have are: Split tunnel, multiple search domains, single DNS server for ALL lookups.
I opened a support ticket a week ago but it hasn't even been looked at yet, so I'm hoping someone here has an idea on how to proceed 😃
thanks!
rsenio
Why isn't that do-able?
From the GUI:
DNS resolution zones (optional)
For split tunnels that only route private traffic (not internet traffic), specify a comma-separated list of internal domains that clients will resolve through the AS-pushed DNS server(s). Note that some clients (such as Windows) may only respect the first domain given.
As for pushing one DNS server, that's fine too. Does the DNS you want to push know about all the other domain's you're trying to resolve?
deraps
With split tunnel enabled, when you put a list of domains in the DNS resolution zones it pushes the DNS server just for that list of domains. On a mac if you do scutil --dns the default resolver will use whatever DNS server the client had before connecting, and a separate resolver for each of the listed domains. I want the default resolver to be the one pushed by the server, not the one from the client's DHCP.
The reason this is kind of a weird setup is that we have a few hundred domains on private DNS that don't exist in public DNS. There are also 10 domains that need to be in the search domain list. They are also the ones by far most resolved, but I need to support all the private ones too.
I haven't tried adding all 200+ private domains to that list, but I have a feeling it probably hit a limit.
A workaround for this is to use the Viscosity client, and select the Full DNS option. This forces all resolution to use the server's DNS...but this mode breaks the OpenDNS umbrella client that we also install, so I would rather not do it.
