After connecting with the Kerio VPN client (OS X Leopard) to a server, the internet (~web browsing) stopped working for the client.
After poking around, the issue seems to be bad DNS server (i.e., entering IPs directly works). After disconnecting from the VPN, the invalid DNS server disappears from
scutil --dns and all's well again.
Now, I don't understand why OS X on the client even changes the DNS settings -- internet should be routed through a different interface, through the default gateway, not through the VPN.
- By what mechanism does connecting the VPN client change the "default" DNS server?
- How can I stop the VPN client from changing routing/DNS rules? Where is this stuff stored/modified?
$ scutil --dns DNS configuration resolver #1 nameserver : 10.66.77.1 # <---- default gateway = home router; all good order : 200000 resolver #2 domain : local options : mdns timeout : 2 order : 300000 ...
$ scutil --dns DNS configuration resolver #1 nameserver : 192.168.1.1 # <--- rubbish nameserver : 192.168.2.1 order : 200000 resolver #2 domain : local options : mdns timeout : 2 order : 300000 ...
The VPN doesn't appear among
$ networksetup -listallnetworkservices. It also doesn't appear in the "Network" dialogue of System Preferences.
ifconfig reports it as
kvnet0: flags=8842<BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1400 inet 192.168.2.9 netmask 0xffffff00 broadcast 192.168.2.255 ether 44:45:53:54:4f:53
EDIT: progress -- according to Kerio VPN docs:
The VPN server also assigns the client an address for the primary, and optionally also secondary DNS server and DNS domain extension. This allows to specify remote hosts with their names. The change of DNS configuration has such effect that all DNS queries from the client host are sent to a DNS server in a remote private network. Users usually do not even notice any change. Upon closing of the VPN connection, the original DNS configuration will be recovered.
How do they do that, and how do I stop them from doing it (switch DNS back without closing the VPN)?