I have an OpenVPN server setup in data center and use tunnelblick as a client. Once connected it add routes to my DC LAN 10.0.0.0/24 network and uses 10.0.0.1 as primary DNS, 220.127.116.11 as secondary DNS.
10.0.0.1 host my subdomain DNS entries in dc.example.com
The issue is when the VPN tunnel established, DNS resolution does not work consistently.
As I checked, both /etc/resolve.conf and "System Preference - Network - DNS Servers" shows the same result, which has "10.0.0.1" and "18.104.22.168" as expected.
However, in the terminal, I got mixed result between "dig" and "ping". For dig I can get sth like
➜ ~ dig ftp.dc.example.com ; <<>> DiG 9.8.3-P1 <<>> ftp.dc.example.com ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 22990 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0 ;; QUESTION SECTION: ;ftp.dc.example.com. IN A ;; ANSWER SECTION: ftp.dc.example.com. 3600 IN A 10.0.1.13 ;; Query time: 84 msec ;; SERVER: 10.0.0.1#53(10.0.0.1) ;; WHEN: Thu Nov 24 15:39:21 2016 ;; MSG SIZE rcvd: 55
But for ping I got
➜ ~ ping ftp.dc.example.com ping: cannot resolve ftp.dc.example.com: Unknown host
And in other application like browser I got the same result as "ping", basically unresolvable.
As you can see there's no network issue or issue with DNS server, otherwise "dig" wouldn't work.
But, if I query "www.google.com" then both "ping" and "dig" will work.
So it seems when the VPN connection established, the resolve.conf is updated accordingly, but some applications might be still querying old DNS server.
I tried to reopen terminal application, or use different terminal like iTerm, same result. But if I wait for a while, say 10-15 minutes, then ping and browser will work.