I either don't understand this new setting, or I'm using it wrong.
I use AWS and take advantage of the fact that Route53 supports public and private DNS resolution. E.g. "dig domain" could return a different IP depending on if I'm inside of AWS or outside. Using the "Have clients use the same DNS servers as the Access Server host" I successfully provide private services for my company. An example: metrics.domain outside of the VPN does nothing but on the inside is a website full of business metrics. I have a production and test environment each based on a different domain (domain1 and domain2). A slight pain is I can't connect to both VPNs at the same time and have the DNS trick working. I had hoped this new setting would solve this problem (e.g. production VPN sets DNS resolution zones setting=domain1 and test=domain2).
After installing a new version of OpenVPN AS (2.1.3 using the community VM in AWS) I'm unable to get DNS working at all using the above setting. I think OpenVPN is pushing the new setting, but OS X is resolving DNS in the wrong order. With just "Have clients use the same DNS servers as the Access Server host" OpenVPN seems to change /etc/resolv.conf from 192.168.1.1 to 172.18.0.2. The new setting seems to leave /etc/resolve.conf the same but changes other aspects of DNS resolution on OSX.
Before connecting to the VPN I see:
resolver #1
nameserver[0] : 192.168.1.1
if_index : 4 (en0)
flags : Request A records
reach : Reachable, Directly Reachable Address
//MORE STUFF
And after I connect (with the new setting) I see:
resolver #1
search domain[0] : domain1
nameserver[0] : 192.168.1.1
if_index : 4 (en0)
flags : Request A records
reach : Reachable, Directly Reachable Address
resolver #2
domain : domain1
nameserver[0] : 172.18.0.2
flags : Request A records
reach : Reachable
order : 101600
//MORE STUFF
And if I dig something in domain1 I get the public IP, I believe because 192.168.1.1 is resolving the IP instead of 172.18.0.2.
A related issue is that the OpenVPN Connect (2.1.1.101) client only seems to support one VPN at a time and this fix didn't work for me:
https://docs.openvpn.net/under-the-hood/vpn-client-basic/
Any help or advice is appreciated.
Thanks!
