You are not logged in.
- Topics: Active | Unanswered
#1 2017-12-17 15:03:53
- CarbonChauvinist
- Member
- Registered: 2012-06-16
- Posts: 413
- Website
Forticlientsslvpn and DNS: Using resolved and networkd
I'm trying to get DNS for the forticlientssl-vpn to work properly on my box.
I've installed forticlient packages from aur:
ghost ~ yay -Q|ag forti
forticlientsslvpn 4.4.2333-1
forticlientsslvpn-systemd 1-4I'm able to use the cli client for forticlientssl-vpn, but not the gui client, to connect after entering my password and fortitoken code:
ghost ~ forticlientsslvpn_cli --server vpn.server.com:443 --vpnuser myusername
Password for VPN:
STATUS::Setting up the tunnel
STATUS::Connecting...
A FortiToken code is required for SSL-VPN login authentication.
129679
STATUS::Login succeed
STATUS::Starting PPPd
STATUS::Initializing tunnel
STATUS::Connecting to server
STATUS::Connected
Press Ctrl-C to quit
STATUS::Tunnel runningI'm simply using networkd and systemd-resolved to manage my network, no networkmanager. When not connected to the vpn here's systemd-resolve status:
ghost ~ systemd-resolve --status
Global
DNSSEC NTA: 10.in-addr.arpa
16.172.in-addr.arpa
168.192.in-addr.arpa
17.172.in-addr.arpa
18.172.in-addr.arpa
19.172.in-addr.arpa
20.172.in-addr.arpa
21.172.in-addr.arpa
22.172.in-addr.arpa
23.172.in-addr.arpa
24.172.in-addr.arpa
25.172.in-addr.arpa
26.172.in-addr.arpa
27.172.in-addr.arpa
28.172.in-addr.arpa
29.172.in-addr.arpa
30.172.in-addr.arpa
31.172.in-addr.arpa
corp
d.f.ip6.arpa
home
internal
intranet
lan
local
private
test
Link 2 (wifi0)
Current Scopes: DNS LLMNR/IPv4 LLMNR/IPv6
LLMNR setting: yes
MulticastDNS setting: no
DNSSEC setting: no
DNSSEC supported: no
DNS Servers: 192.168.1.1
DNS Domain: lanAnd here's my networkctl status:
ghost ~ networkctl
IDX LINK TYPE OPERATIONAL SETUP
1 lo loopback carrier unmanaged
2 wifi0 wlan routable configured
2 links listed. And lastly my /etc/resolv.conf
ghost ~ cat /etc/resolv.conf
#
# /etc/resolv.conf
#
#search <yourdomain.tld>
#nameserver <ip>
# End of fileFrom what I can tell all appears to be in order. However, when I connect to the VPN I'm unable to access using device names and have to use the actual ip addresses. I must be missing a step, but not sure what it is. Obviously, the goal is to have link 3 (ppp0) list the correct dns servers (192.168.0.2 and 192.168.0.5) as well as the correct domain (vpn.local for example).
Here's my systemd-resolv --status when connected to said vpn:
ghost ~ systemd-resolve --status
Global
DNSSEC NTA: 10.in-addr.arpa
16.172.in-addr.arpa
168.192.in-addr.arpa
17.172.in-addr.arpa
18.172.in-addr.arpa
19.172.in-addr.arpa
20.172.in-addr.arpa
21.172.in-addr.arpa
22.172.in-addr.arpa
23.172.in-addr.arpa
24.172.in-addr.arpa
25.172.in-addr.arpa
26.172.in-addr.arpa
27.172.in-addr.arpa
28.172.in-addr.arpa
29.172.in-addr.arpa
30.172.in-addr.arpa
31.172.in-addr.arpa
corp
d.f.ip6.arpa
home
internal
intranet
lan
local
private
test
Link 3 (ppp0)
Current Scopes: none
LLMNR setting: yes
MulticastDNS setting: no
DNSSEC setting: no
DNSSEC supported: no
Link 2 (wifi0)
Current Scopes: DNS LLMNR/IPv4 LLMNR/IPv6
LLMNR setting: yes
MulticastDNS setting: no
DNSSEC setting: no
DNSSEC supported: no
DNS Servers: 192.168.1.1
DNS Domain: lanAnd my networkctl again when connected to vpn:
ghost ~ networkctl
IDX LINK TYPE OPERATIONAL SETUP
1 lo loopback carrier unmanaged
2 wifi0 wlan routable configured
3 ppp0 ppp routable unmanaged
3 links listed.What's interesting to me is that it appears as if my resolv.conf is updated when connected to the VPN as seen below b/c the 0.2 and 0.5 addresses are the DNS servers on the vpn I'm connecting to:
ghost ~ cat /etc/resolv.conf
nameserver 192.168.0.2
nameserver 192.168.0.5
#
# /etc/resolv.conf
#
#search <yourdomain.tld>
#nameserver <ip>
# End of fileLooking at the log for systemd-networkd shows the connection to ppp0:
ghost ~ systemctl status systemd-networkd
● systemd-networkd.service - Network Service
Loaded: loaded (/usr/lib/systemd/system/systemd-networkd.service; enabled; vendor preset: enabled)
Active: active (running) since Sat 2017-12-16 14:54:40 EST; 18h ago
Docs: man:systemd-networkd.service(8)
Main PID: 357 (systemd-network)
Status: "Processing requests..."
Tasks: 1 (limit: 4915)
CGroup: /system.slice/systemd-networkd.service
└─357 /usr/lib/systemd/systemd-networkd
Dec 16 19:57:08 5510 systemd-networkd[357]: wifi0: Gained carrier
Dec 16 19:57:09 5510 systemd-networkd[357]: wifi0: DHCPv4 address 192.168.1.82/24 via 192.168.1.1
Dec 16 19:57:09 5510 systemd-networkd[357]: wifi0: Configured
Dec 17 07:34:08 5510 systemd-networkd[357]: wifi0: Lost carrier
Dec 17 07:34:08 5510 systemd-networkd[357]: wifi0: DHCP lease lost
Dec 17 07:34:12 5510 systemd-networkd[357]: wifi0: Gained carrier
Dec 17 07:34:14 5510 systemd-networkd[357]: wifi0: DHCPv4 address 192.168.1.82/24 via 192.168.1.1
Dec 17 07:34:14 5510 systemd-networkd[357]: wifi0: Configured
Dec 17 09:11:59 5510 systemd-networkd[357]: ppp0: Gained carrier
Dec 17 09:16:38 5510 systemd-networkd[357]: ppp0: Lost carrier But, the log for resolved doesn't show anything re: connecting to the vpn:
ghost ~ systemctl status systemd-resolved
● systemd-resolved.service - Network Name Resolution
Loaded: loaded (/usr/lib/systemd/system/systemd-resolved.service; enabled; vendor preset: enabled)
Active: active (running) since Sat 2017-12-16 14:54:41 EST; 18h ago
Docs: man:systemd-resolved.service(8)
https://www.freedesktop.org/wiki/Software/systemd/resolved
https://www.freedesktop.org/wiki/Software/systemd/writing-network-configuration-managers
https://www.freedesktop.org/wiki/Software/systemd/writing-resolver-clients
Main PID: 489 (systemd-resolve)
Status: "Processing requests..."
Tasks: 1 (limit: 4915)
CGroup: /system.slice/systemd-resolved.service
└─489 /usr/lib/systemd/systemd-resolved
Dec 16 14:54:41 5510 systemd[1]: Starting Network Name Resolution...
Dec 16 14:54:41 5510 systemd-resolved[489]: Positive Trust Anchors:
Dec 16 14:54:41 5510 systemd-resolved[489]: . IN DS 19036 8 2 49aac11d7b6f6446702e54a1607371607a1a41855200fd2ce1cdde32f24e8fb5
Dec 16 14:54:41 5510 systemd-resolved[489]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d
Dec 16 14:54:41 5510 systemd-resolved[489]: Negative trust anchors: 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.
Dec 16 14:54:41 5510 systemd-resolved[489]: Using system hostname '5510'.
Dec 16 14:54:41 5510 systemd[1]: Started Network Name Resolution.I've seen the page in the OpenVPN arch-wiki that deals with a script for systemd to update the DNS (https://wiki.archlinux.org/index.php/OpenVPN#DNS) but am unsure of how to implement this with forticlientsslvpn as I don't have OpenVPN installed.
Do I need to setup a new networkd configuration for the ppp0 interface? Here's the config for my wifi interface:
ghost / etc systemd network cat wifi.network
[Match]
Name=wifi0
[Network]
DHCP=ipv4
[DHCP]
UseDomains=trueAny help/hints are very welcome.
"the wind-blown way, wanna win? don't play"
Offline