Overriding DHCP- or VPN-assigned DNS servers in Mac OS X Leopard

It isn't just vpn's managed by an operator from hell. If the local network uses split horizon, ie: internal DNS that lists hosts that don't need to be resolved externally, you lose that when you connect the vpn because you lose the internal DNS server for your local network.

For instance, when I connect to my home office VPN, I can resolve the internal ip addresses there fine (and external ip addresses work fine), however I lose the ability to resolve the internal ip addresses at our main office, so my email, bug tracking, call management and pretty much everything else that depends on DNS goes away. This completely breaks the standards for DNS where it would and should fall back to the other listed DNS servers to try when earlier ones fail to resolve.

Using the raw solution here would just make me lose the ability to resolve internal hosts on the VPN. While I haven't tried it yet, I presume a similar script to *add* local DNS servers to the list when connected would work. Either that or doing manual DNS entries for the VPN setup that include the remote DNS and local DNS, then you don't need to run the script at all.

Here is a script that I put together to run that rebuilds the /etc/resolv.conf from the scutil DNS dictionary.

-John

#
# Used to reconstruct the /etc/resolv.conf from the scutil dictionary of the current DNS configuration
# A backup copy of the file is made in /tmp with the date-time suffix added
#
RSLV=/etc/resolv.conf
BKUP=/tmp/resolv.conf.`date +%Y-%m-%d_%H%M%S`

# Backup copy of current resolv.conf file
cp $RSLV $BKUP

# Copy Mac OS comments to new version of file
egrep '^#' $BKUP > $RSLV

DOMAIN=$(scutil --dns | egrep '^  domain : ' | grep -v 'domain : local' | egrep -v '\.arpa$' | awk '{print $3}')
echo "domain $DOMAIN" >> $RSLV
echo "search $DOMAIN" >> $RSLV

IPS=$(scutil --dns | grep nameserver | awk '{print $3}')
for IP in $IPS
do
  echo "nameserver $IP" >> $RSLV
done

You can also look for PPP services, find the one with the appropriate $IFNAME, and insert an empty dict in place of its DNS.

My 2cts .-)

SERVICES=$(echo "list State:/Network/Service/[^/]+/PPP" | scutil | cut -c 16- | cut -d / -f 1-4)

for SERVICE in $SERVICES
do
  if [ "$(echo show $SERVICE/PPP | scutil | grep InterfaceName | cut -c 19-)" == "$IFNAME" ]; then
    echo "set $SERVICE/DNS" | scutil
  fi
done

Following my previous comment, I'd like to share the script I added when the ppp connection goes up so this scutil session can be done automatically.

Create the following script as root /etc/ppp/ip-up and make it executable:

#!/bin/sh
# When the ppp link comes up, this script is called with the following
# parameters
#       $1      the interface name used by pppd (e.g. ppp3)
#       $2      the tty device name
#       $3      the tty device speed
#       $4      the local IP address for the interface
#       $5      the remote IP address
#       $6      the parameter specified by the 'ipparam' option to pppd

DEBUGFILE=/tmp/ip-up-debug.txt

# Here I create my routes using /sbin/route add ...

# Running the scutil session
`/usr/sbin/scutil < /etc/ppp/scutil_session.txt`
echo "vpn_no_dns => $?" >> $DEBUGFILE

Here are the needed lines to be executed within scutil, stored in /etc/ppp/scutil_session.txt

Note that /Network/Service/87FB33AE-EEBD-4675-A4FC-7BB0E576BC90/DNS is specific to my Network Service

d.init
get State:/Network/Service/87FB33AE-EEBD-4675-A4FC-7BB0E576BC90/DNS
d.add ServerAddresses *
set State:/Network/Service/87FB33AE-EEBD-4675-A4FC-7BB0E576BC90/DNS

I'm not expert at bash scripting, so if anyone could improve this script to dynamically retrieve the Network Service to reset, it would be nice

Hth

Julien

ps: Hannes, it seems format filters are not run through comments, even using p tags ...