3 ms·
Tangentially: We set up StrongSwan recently to use as a VPN into Google Cloud, to allow developers (who all run macOS) to use the nodes seamlessly and interact
by lobster_johnson 10y ago
Tangentially: We set up StrongSwan recently to use as a VPN into Google Cloud, to allow developers (who all run macOS) to use the nodes seamlessly and interact with Kubernetes and other internal services over a secure connection.
But we met a roadblock when we tried to get DNS to work automatically -- we wanted the GCP boxes to be resolved to their internal IPs, so we set up a DNS server (dnsmasq) on GCP, but there seemed to be no way to tell the client to use it to resolve .internal. There's a plugin/extension available for IKEv1, apparently, but we couldn't find a way to do it for IKEv2. The only way was to configure each client machine's DNS server list (and default domain list) manually, which is not really acceptable.
For now we've switched to OpenVPN, which is fine but requires installing a third-party VPN client on macOS. I would love to know if we could solve the DNS issue and go back to IKEv2. Anyone done this?
- jlgaddis 10y agoThe "typical" practice is to use an "up"/"down" scripts to modify the DNS servers when the VPN link goes up/down. If you just want to use your GCP dnsmasq instance for the .internal top-level domain (not all DNS queries), then you'd want to run a resolver locally that you can configure to selectively forward queries. This is pretty easy on Linux but I've never attempted it on MacOS. I realize it's probably not ideal but perhaps you can install dnsmasq or unbound on MacOS via homebrew or Macports?
- lobster_johnson 10y agoThe idea is to avoid any unnecessary client-side configuration aside from the connection itself. Adding a resolver on macOS is easy enough (just create a file /etc/resolver/internal for .internal, containing the IP of the DNS server), but the nice thing about OpenVPN is that you get the DNS config automatically.