Re: Best practice for managing default routes over only VPN connections?

On Sun, 2016-11-06 at 19:30 -0500, Paul Swanson wrote:


I've recently been configuring my Ubuntu 16.10 laptop for default
routing via VPN only and have discovered some difficulties.

My goal is to only connect to the Internet via a VPN and ensure that
DNS requests are resolved by a trusted server only.

One thing I've noticed is that DNS resolution seems to be handled by
NM on a connection by connection basis, but I want to ensure that DNS
resolvers are fixed to my choice regardless of the underlying
connection, without giving up NM control and dnsmasq for caching.

From what I've seen so far, the configuration bias is towards VPN
connections providing tangential access to a private network and NOT
as the default route.

You ask here only about DNS. That is actually possible since 1.4.0 by
setting ipv4.dns-priority to a negative value. See

  nmcli connection modify $VPN_CONNECTION ipv4.dns-priority -1
  nmcli connection up $VPN_CONNECTION

Another thing is ensuring that all traffic is routed via the VPN (that
is, controlling the configured routes). That is not supported by NM
directly (besize that you can manually configure your underlying
connection to have no default-route and only give a default-route to
the VPN connection). See for example .

Is anyone aware of any clear guidance for configuring NM's behaviour
when seeking to use VPN for default routing and DNS safe connections?

I've had further issues with NetworkManager SSH VPN configuration.

I would like to be able to link my VPN configuration to the
underlying network adapters on my machine, so that regardless of
which Wireless SSID or ethernet connection is activated the VPN
connection is automatically and subsequently brought up and down as
required. Right now, this is a manual process for me.

A VPN connection can be set as "secondary" of another connection.
Another option might be to write a dispatcher script.


Attachment: signature.asc
Description: This is a digitally signed message part

[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]