1

I run an LDAP server on my home network to store accounts, automount entries, etc. I spent a lot of time getting the LDAP server configured properly for OS X clients, and everything seems to work, except when I login to my employer's VPN using Cisco VPN Client on OS X 10.5.

So far, I've traced the problem down to the fact that the OS X Directory Service does a reverse DNS (PTR) lookup for the LDAP server, and it appears the Cisco VPN Client is intercepting those DNS requests. To figure this out, I enabled debugging in the directory service, and the following appears in the debug log:

2010-02-11 18:02:02 EST - T[0xB031C000] - CLDAPConnectionManager::CheckFailed - checking 1 node connections
2010-02-11 18:02:02 EST - T[0xB031C000] - CLDAPNodeConfig::CheckWithSelect - good socket to host 192.168.1.11 but failed check, clearing from poll

Digging further with tcpdump, I found that I can do DNS lookups for the directory server's hostname, but reverse lookups aren't getting to my LAN's DNS server at all. Instead, the VPN client appears to be eating them and refering them to prisoner.iana.org.

Now, I know that this is how things are normally supposed to work when you query an internet DNS server for a private network address in RFC 1918 address space. However, the query is supposed to be going to my LAN's DNS server (just dnsmasq running on a Linksys WRT54G.) And, when the VPN client isn't running, these requests come back fine, and OS X can connect to my LDAP server, and I'm happy. But once I start Cisco VPN Client, it seems to be intercepting these requests, which blocks access to my LDAP, which means my automount shares don't come up, which is very annoying.

So, does anyone know why the VPN Client would do something like this, and can anyone think of any workarounds?

1
  • Sorry if this is just too crude, but have you tried just putting your LDAP server into /etc/hosts? That's my simplistic solution to all problems with DNS and nearby hosts.
    – Stabledog
    Feb 12, 2010 at 0:20

2 Answers 2

1

It sounds like the Cisco VPN Client has been configured to block access to your local network and only provide network connectivity to the internal VPN network. This is normally done for security reasons to prevent bridging the networks together. As part of this it has set your DNS settings for the VPN to be the VPN LAN ones so that you can resolve DNS names of your company network hence your problem.

There will be an option to "Allow Local LAN access" in the VPN settings but that is normally administratively turned off. Here is a link showing you How to turn on Allow Local LAN Access but your VPN admins have probably locked that down to prevent it.

2
  • Actually, I manage this machine myself, so "Allow Local LAN Access" isn't locked down. In fact, I discovered that option during my attempts to debug this problem, and checking it doesn't change the client's behavior -- it's still intercepting PTR requests for my local network (and only PTR requests for my own network -- it lets through normal DNS requests.)
    – tonycpsu
    Feb 12, 2010 at 5:30
  • You may manage the machine yourself but the VPN client will receive policies set by the VPN Admins at your company, which presumably include not allowing local LAN access. So though you maybe able to change it, it may not actually be changing the behaviour.
    – Sim
    Feb 12, 2010 at 5:47
1

It may be a question of certificates if you're using ldaps (ssl/tls) to connect. The bind done with a reverse ptr lookup address will fail because it's not the address given in the x509 certificate. There's an option you can put in your ldap.conf/slapd.conf: reverse-lookup off

There and again it could easily be something else but worth checking I think

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .