[Bug 1624317] Re: systemd-resolved breaks VPN with split-horizon DNS

[Nicholas Stommel]

Please note that this patch and fix only works for Ubuntu 17.04 which relies on
systemd-resolved as a DNS/DNSSEC stub resolver, as well as an LLMNR resolver.

You also need to be using a network-manager plugin like network-manager-openvpn-gnome.
Install and configure an openvpn connection after going 'sudo apt-get install network-manager-
openvpn-gnome', importing a config file, connecting (if possible), and observing the fact that
there are DNS leaks (queries WILL be routed to your ISP) with online tools like those at
https://dnsleaktest.com. Otherwise, just know that systemd-resolved naturally leaks DNS queries
over all configured domains on all interfaces by design unless a specific system bus call is made.
In this case, the SetLinkDomains(in  i ifindex, in  a(sb) domains) method, if passed
the interface index followed by an array containing the "routing-only" domain "~." 
(see https://manpages.debian.org/testing/systemd/systemd.network.5.en.html) and the boolean true.
But enough with the technical details, lets move on to the fix!

First, make sure you have all necessary packages to build the network
manager, install with:

sudo apt update
sudo apt-get build-dep network-manager

cd ~/Documents
mkdir nm && cd nm
apt-get source network-manager
cd network-manager-1.4.4/

Copy the patch file into the network-manager-1.4.4 directory:

cp ~/Downloads/resolved-vpn-dns-leak-fix.patch .

Apply the patch with:

patch -p1 < resolved-vpn-dns-leak-fix.patch

Remove patch from source directory before compilation:

rm resolved-vpn-dns-leak-fix.patch

Compile and build .deb package for installation (this will take a
while):

dpkg-buildpackage -us -uc -b

The compiled .debs should be in the parent directory you created nm:

cd ../

First, stop all network services:

sudo service network-manager stop
sudo service networking stop

Install just the patched network manager (the other .debs are not
necessary):

sudo dpkg -i network-manager_1.4.4-1ubuntu3_amd64.deb

Bring network services back up:

sudo service networking start
sudo service network-manager start

Connect to standard openvpn via network-manager-openvpn GUI (or other plugin)
Search the syslog for something like:

NetworkManager[876]: <info>  [1496716774.9849] systemd-resolved[0x55b0132ec2b0]: Link type is VPN
TUN or TAP, fixing DNS leak...

and verify that the VPN link (for example tun0) includes the descriptor:
	DNS Domain: ~.
	
using the command:

systemd-resolve --status

When compiling network manager, several bogus links are created and will show up when
you type 'systemd-resolve --status', don't worry they will disappear once you reboot.

Then open your browser, navigate to https://dnsleaktest.com and select Extended test
You should only see your VPN provider's DNS servers. For example, with PIA you should see
something like:

Test complete

Query round Progress... Servers found
  1          ......              1
  2          ......              1
  3          ......              1
  4          ......              1
  5          ......              1
  6          ......              1

IP	Hostname	ISP	Country
173.239.220.5 	ip-5-220-239-173.east.us.northamericancoax.com 	GoLightSpeed 	United States

Now, to prevent Ubuntu apt from replacing your patched, VPN-DNS-leak-
free version of network manager that relies on systemd-resolved, use the
command:

sudo apt-mark hold network-manager

Thats all, you're done. Congrats, no DNS leaks on Ubuntu 17.04!
I hope that I was able to make your life easier and more secure using openvpn or other
vpn services through the built-in GUI for the Gnome NetworkManager on Ubuntu 17.04 :)

(Side note: I am a college student and C/C++ dev who loves Ubuntu <3 Also, this took quite a bit
of research on the GLib API, systemd-resolved API, and much much tracing using our good friend
'grep -r' for built in functions and enums of the Gnome network manager itself. No additional
compiler warnings are generated, the patch conforms to the C90 standard, and the syntax style 
used throughout the network manager source code was maintained.)

I will attach the small text patch generated using 'diff -u' along with the patched generated 
.deb file for your convenience. Cheers, and I hope this helps you all!

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to systemd in Ubuntu.
https://bugs.launchpad.net/bugs/1624317

Title:
  systemd-resolved breaks VPN with split-horizon DNS

Status in systemd:
  New
Status in network-manager package in Ubuntu:
  Confirmed
Status in systemd package in Ubuntu:
  Confirmed

Bug description:
  I use a VPN configured with network-manager-openconnect-gnome in which
  a split-horizon DNS setup assigns different addresses to some names
  inside the remote network than the addresses seen for those names from
  outside the remote network.  However, systemd-resolved often decides
  to ignore the VPN’s DNS servers and use the local network’s DNS
  servers to resolve names (whether in the remote domain or not),
  breaking the split-horizon DNS.

  This related bug, reported by Lennart Poettering himself, was closed with the current Fedora release at the time reaching EOL:
  https://bugzilla.redhat.com/show_bug.cgi?id=1151544

To manage notifications about this bug go to:
https://bugs.launchpad.net/systemd/+bug/1624317/+subscriptions