Arch Linux

zandana

Member

Registered: 2020-04-29

Posts: 16

No internet access after connecting to VPN

Hello, I'm using pulse-secure AUR package to connect to a VPN.
After successful connection, I lost my internet access to any web address.

Route table before conecction:

ip route

default via 192.168.1.1 dev eno1 proto dhcp metric 100
192.168.1.0/24 dev eno1 proto kernel scope link src 192.168.1.2 metric 100
192.168.1.1 dev eno1 scope link metric 1

and after the connection:

ip route

default via 192.168.1.1 dev eno1 proto dhcp metric 100
10.205.122.16/28 via 192.168.215.240 dev tun0 scope link metric 1
185.134.60.33 via 192.168.1.1 dev eno1 metric 1
192.168.1.0/24 dev eno1 proto kernel scope link src 192.168.1.2 metric 100
192.168.1.1 dev eno1 scope link metric 1
192.168.1.11 via 192.168.215.240 dev tun0 scope link metric 1
192.168.5.67 via 192.168.215.240 dev tun0 scope link metric 1

NetworkManager log when connecting to the VPN:

journalctl -au NetworkManager --since=now --follow

-- Logs begin at Wed 2020-04-15 16:31:32 EEST. --
Jun 14 22:28:23 archie NetworkManager[523]: <info>  [1592162903.3857] manager: (tun0): new Tun device (/org/freedesktop/NetworkManager/Devices/4)
Jun 14 22:28:23 archie NetworkManager[523]: <info>  [1592162903.3999] device (tun0): state change: unmanaged -> unavailable (reason 'connection-assumed', sys-iface-state: 'external')
Jun 14 22:28:23 archie NetworkManager[523]: <info>  [1592162903.4013] device (tun0): state change: unavailable -> disconnected (reason 'connection-assumed', sys-iface-state: 'external')
Jun 14 22:28:23 archie NetworkManager[523]: <info>  [1592162903.4018] device (tun0): Activation: starting connection 'tun0' (55cd9117-ac66-402c-9f89-f6d50bc73864)
Jun 14 22:28:23 archie NetworkManager[523]: <info>  [1592162903.4020] device (tun0): state change: disconnected -> prepare (reason 'none', sys-iface-state: 'external')
Jun 14 22:28:23 archie NetworkManager[523]: <info>  [1592162903.4022] device (tun0): state change: prepare -> config (reason 'none', sys-iface-state: 'external')
Jun 14 22:28:23 archie NetworkManager[523]: <info>  [1592162903.4024] device (tun0): state change: config -> ip-config (reason 'none', sys-iface-state: 'external')
Jun 14 22:28:23 archie NetworkManager[523]: <info>  [1592162903.4025] device (tun0): state change: ip-config -> ip-check (reason 'none', sys-iface-state: 'external')
Jun 14 22:28:23 archie NetworkManager[523]: <info>  [1592162903.4134] device (tun0): state change: ip-check -> secondaries (reason 'none', sys-iface-state: 'external')
Jun 14 22:28:23 archie NetworkManager[523]: <info>  [1592162903.4135] device (tun0): state change: secondaries -> activated (reason 'none', sys-iface-state: 'external')
Jun 14 22:28:23 archie NetworkManager[523]: <info>  [1592162903.4143] device (tun0): Activation: successful, device activated.

I can't find any configuration files for pulse-secure.

I'm not sure what are my next steps to fix this...

Last edited by zandana (2020-06-14 20:22:04)

heywoodlh

Member

Registered: 2016-10-31

Posts: 26

Website

Re: No internet access after connecting to VPN

Can you give any more information on what you think the symptoms are that you are seeing? "I lost my internet access to any web address" doesn't give that much detail.

Are you able to

ping 1.1.1.1

? Does pulse-secure provide any log files or provide anything useful to journald?

zandana

Member

Registered: 2020-04-29

Posts: 16

Re: No internet access after connecting to VPN

Sorry if I was not clear.

Yes I can ping 1.1.1.1:

[11:19] archie | ping 1.1.1.1
PING 1.1.1.1 (1.1.1.1) 56(84) bytes of data.
64 bytes from 1.1.1.1: icmp_seq=1 ttl=59 time=2.11 ms
64 bytes from 1.1.1.1: icmp_seq=2 ttl=59 time=2.04 ms
64 bytes from 1.1.1.1: icmp_seq=3 ttl=59 time=1.88 ms
64 bytes from 1.1.1.1: icmp_seq=4 ttl=59 time=1.89 ms
^C
--- 1.1.1.1 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3004ms
rtt min/avg/max/mdev = 1.878/1.979/2.113/0.099 ms

but i can't ping any website and i'm not using firewall:

ping www.google.com

ping www.archlinux.org

When I disconnect from the VPN, I can ping www.google.com and everything is back to normal.

I tested the VPN connection also in WIndows partition and it does not block my web access, so I'm pretty sure it is Arch related.

I'm aware only of this pulse log (searched the system) , but i'm not sure how useful it is:

cat pulse_secure/pulse/pulsesvc.log

20200616112654.783275 pulsesvc[p5478.t5478] pulseui.info Active connection status Connected connection_status 3 (pulseUi.cpp:1455)
20200616112656.136970 pulsesvc[p5654.t5654] session.info received 105 msg from UI (session.cpp:143)
20200616112656.137063 pulsesvc[p5478.t5651] pulseui.info bytes sent = 4468, recvd = 0 (pulseUiLib.cpp:78)
20200616112656.137092 pulsesvc[p5478.t5651] pulseui.info ncgui_update_connection_status 3 (pulseUi.cpp:1398)
20200616112656.137103 pulsesvc[p5478.t5651] pulseui.info notifiying fd: 17 (pulseUiLib.cpp:57)
20200616112658.139320 pulsesvc[p5654.t5654] session.info received 105 msg from UI (session.cpp:143)
20200616112658.139527 pulsesvc[p5478.t5651] pulseui.info bytes sent = 4468, recvd = 0 (pulseUiLib.cpp:78)
20200616112658.139598 pulsesvc[p5478.t5651] pulseui.info ncgui_update_connection_status 3 (pulseUi.cpp:1398)
20200616112658.139627 pulsesvc[p5478.t5651] pulseui.info notifiying fd: 17 (pulseUiLib.cpp:57)
20200616112659.787816 pulsesvc[p5478.t5478] pulseui.info Command from javascript ShowCollapseScreen (pulseUi.cpp:678)
20200616112659.787834 pulsesvc[p5478.t5478] pulseui.info Active connection status Connected connection_status 3 (pulseUi.cpp:1455)
20200616112700.141808 pulsesvc[p5654.t5654] session.info received 105 msg from UI (session.cpp:143)
20200616112700.141942 pulsesvc[p5478.t5651] pulseui.info bytes sent = 4468, recvd = 0 (pulseUiLib.cpp:78)
20200616112700.141985 pulsesvc[p5478.t5651] pulseui.info ncgui_update_connection_status 3 (pulseUi.cpp:1398)
20200616112700.142003 pulsesvc[p5478.t5651] pulseui.info notifiying fd: 17 (pulseUiLib.cpp:57)
20200616112702.144224 pulsesvc[p5654.t5654] session.info received 106 msg from UI (session.cpp:143)
20200616112702.144374 pulsesvc[p5654.t5654] session.info received 105 msg from UI (session.cpp:143)
20200616112702.144417 pulsesvc[p5478.t5651] pulseui.info notifiying fd: 17 (pulseUiLib.cpp:57)
20200616112702.144500 pulsesvc[p5478.t5651] pulseui.info bytes sent = 4468, recvd = 0 (pulseUiLib.cpp:78)
20200616112702.144525 pulsesvc[p5478.t5651] pulseui.info ncgui_update_connection_status 3 (pulseUi.cpp:1398)
20200616112702.144546 pulsesvc[p5478.t5651] pulseui.info notifiying fd: 17 (pulseUiLib.cpp:57)
20200616112704.146687 pulsesvc[p5654.t5654] session.info received 105 msg from UI (session.cpp:143)
20200616112704.146827 pulsesvc[p5478.t5651] pulseui.info bytes sent = 4468, recvd = 0 (pulseUiLib.cpp:78)
20200616112704.146867 pulsesvc[p5478.t5651] pulseui.info ncgui_update_connection_status 3 (pulseUi.cpp:1398)
20200616112704.146882 pulsesvc[p5478.t5651] pulseui.info notifiying fd: 17 (pulseUiLib.cpp:57)
20200616112704.792513 pulsesvc[p5478.t5478] pulseui.info Command from javascript ShowCollapseScreen (pulseUi.cpp:678)

pk.gmp

Member

Registered: 2020-06-15

Posts: 44

Re: No internet access after connecting to VPN

You may have a DNS problem.

1. What are contents of your /etc/resolv.conf?
2. With your VPN confuguration, did you specify DNS provider anywhere?

Last edited by pk.gmp (2020-06-16 08:58:20)

zandana

Member

Registered: 2020-04-29

Posts: 16

Re: No internet access after connecting to VPN

You may have a DNS problem.

1. What are contents of your /etc/resolv.conf?
2. With your VPN confuguration, did you specify DNS provider anywhere?

1 ./etc/resolv.conf before connection to VPN:

# Generated by NetworkManager
nameserver fe80::1%eno1
nameserver 192.168.1.1

after the connection:

search ezpa.cz
nameserver 192.168.5.5
nameserver 192.168.4.4

2. I just log in with username and password in Pulse Secure, I searched but I can't find any VPN configurations.

heywoodlh

Member

Registered: 2016-10-31

Posts: 26

Website

Re: No internet access after connecting to VPN

So your DNS servers are most definitely the issue if you can ping WAN IP addresses but can't resolve domain names.

You can modify your DNS settings in NetworkManager. If you are running GNOME or another DE you can usually do that from your Network settings in the settings application.

The GNOME Project has a page on DNS configuration in NetworkManager

This is my personal preference so feel free to discard this, but I prefer to just bypass NetworkManager's DNS configuration. What I do is set my DNS servers in /etc/resolv.conf manually, like so (replace Cloudflare's server IPs with your preferred DNS provider):

(The following commands should be run as root)

First, remove the NetworkManager symlink to /etc/resolv.conf:

rm /etc/resolv.conf

Add the following to /etc/resolv.conf:

nameserver 1.1.1.1
nameserver 1.0.0.1

Then run the following command to make sure NetworkManager doesn't mess with it:

chattr +i /etc/resolv.con

Again, you are bypassing NetworkManager at this point and certain applications may have issues with this. For my workflows, I haven't encountered any serious issues with this workaround.

finoderi

Member

Registered: 2020-06-12

Posts: 76

Re: No internet access after connecting to VPN

If you

rm /etc/resolv.conf

, then there will be no resolv.conf to add those Cloudflare magic wands.

heywoodlh

Member

Registered: 2016-10-31

Posts: 26

Website

Re: No internet access after connecting to VPN

If you

rm /etc/resolv.conf

, then there will be no resolv.conf to add those Cloudflare magic wands.

Clearly you have to create a new file.

zandana

Member

Registered: 2020-04-29

Posts: 16

Re: No internet access after connecting to VPN

Then run the following command to make sure NetworkManager doesn't mess with it:

chattr +i /etc/resolv.conf

When I make /etc/resolv.conf immutable with +i, I can't connect to the VPN anymore.
I'm also not sure how exactly I can change the DNS from Gnome settings over the VPN.
Why this does not happen on Windows?

Last edited by zandana (2020-06-17 15:36:54)

pk.gmp

Member

Registered: 2020-06-15

Posts: 44

Re: No internet access after connecting to VPN

I personally... don't let anything to mess up with my resolv.conf (I also make resolv.conf immutable by chattr +i command mentioned in this topic earlier). I also use dnscrypt-proxy accompanied by pdnsd (for dns caching). Archwiki has great documentation about this combination. This is usual or normal connection. Now when in VPN mode... I just restart my dnscrypt-proxy and clear pdnsd caches.

My resolv.conf is a one liner... contents as "nameserver 127.0.0.1"  (meaning all DNS queries will go to port 53 which is default port for this activity). On my port 53 as you may guess.. pdnsd is listening.. which forwards to dnscrypt on other higher port (say 50000) which is configurable in dnscrypt-proxy's config file (the one with extension .toml).

When I transition from normal connectivity to VPN, I always notice my DNS doesn't work (perhaps due to changed routes and/or things beyond my technical abilities). So I always just restart dnscrypt-proxy and let pdnsd take benefit of dnscrypt-proxy's hard work.

If and when I use VPN, I use different VPN software than zandana mentioned earlier. Interestingly, when I try to connect to VPN (via Gnome's NetworkManager), I do have a way to tell where my DNS is in the VPN dialog... and I point it to 127.0.0.1

I felt if your VPN software is doing its job... above procedure might help you, zandana. I did notice that your "usual" network is 192.168.1.x (per your resolv.conf) and somehow your "VPN" is on 192.168.4.x (also 192.168.5.x). Not sure about this from VPN providers I know. They usually are from 10.x.x.x series. I don't know whether my observation makes any difference in your case (because 192... and 10... both series are supposed to be for this purpose). If I am wrong, I will learn something now when someone responds to this aspect.

loqs

Member

Registered: 2014-03-06

Posts: 19,061

Re: No internet access after connecting to VPN

Is all traffic intended to be routed through the VPN?  Can you query the DNS servers the VPN server pushed?

If you do not wish NetworkManager to manage resolve .conf see NetworkManager#/etc/resolv.conf

finoderi

Member

Registered: 2020-06-12

Posts: 76

Re: No internet access after connecting to VPN

Why this does not happen on Windows?

Probably VPN client for Windows has its own DNS settings with DNS servers already set somewhere.

The site of those pulsesecure guys contains too much corporate bullshit to trust them imo. I would suggest to stop routing all your traffic through some shady company and make your own VPN with OpenVPN or Wireguard protocol, using VPS. VPS rent is cheaper than commercial VPN anyway. And somewhere on the fly you will learn how DNS works.

loqs

Member

Registered: 2014-03-06

Posts: 19,061

Re: No internet access after connecting to VPN

finoderi what if zandana is connecting to a private corporate network rather than a commercial VPN?

finoderi

Member

Registered: 2020-06-12

Posts: 76

Re: No internet access after connecting to VPN

Then they indeed doesn't have a choice.

zandana

Member

Registered: 2020-04-29

Posts: 16

Re: No internet access after connecting to VPN

Thanks everybody for the answers, just a quick update:

I'm connecting to private corporate network and I contacted the admins for help.

They told me that split tunneling was enabled, so only traffic related to corporation resources are going though.
They also mentioned that the problem is Arch took over dns from the corp resources and this is not necessary, Arch should use it's own secondary dns (i'm not sure if this make sense and if I understand it, any suggestions?)

They allowed traffic for dns requests and now everything works like expected without any changes on my side.

Last edited by zandana (2020-06-21 10:38:08)

finoderi

Member

Registered: 2020-06-12

Posts: 76

Re: No internet access after connecting to VPN

Arch does what you told it to do. I guess they meant you should've done this - https://wiki.archlinux.org/index.php/Ne … connection