Network Manager, Dnssec and VPN

[lhirlimannii (Ludovic Hirlimann)]

I want dnssec resolution on my desktop fedora.
sudo dnf install unbound dnssec-trigger
sudo systemctl enable unbund
sudo systemctl start unbound dnssec-trigger

sudo vi /etc/NetworkManager/Networkmanager.conf
add dns=unbound
sudo systemctl restart NetworkManager

/etc/resolv.conf contains 127.0.0.1 so unbound is used to resolve cool !!!

Before that I would get resol.conf populated by dhcp.

I’m using opnevpn and it pushes somethinlike :
domaine.xxxx domain.yyyy
10.X.X.X
10.Y.X.X

When dnssec-trigger manages resolv.conf, I can’t resolve internal names anymore. Is there a way to configure unbound+networkmanager+dsnsec-trigger so that when the vpn is up I can resolve namees using the 10.X 10.Y dns entries ?

[vgaetera (Vladislav Grigoryev)]

You can either ignore DNS from the VPN connection:

nmcli connection modify VPN_CON ipv4.ignore-auto-dns yes ipv6.ignore-auto-dns yes

Or use split-DNS and DNSSEC via systemd-resolved:

sudo systemctl --now enable systemd-resolved.service
sudo ln -r -s -f /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf
sudo systemctl restart NetworkManager.service
resolvectl status

https://developer.gnome.org/NetworkManager/stable/nm-settings.html
dns-priority […] When using a DNS resolver that supports split-DNS as dns=dnsmasq or dns=systemd-resolved, each connection is used to query domains in its search list. Queries for domains not present in any search list are routed through connections having the ‘~.’ special wildcard domain, which is added automatically to connections with the default route (or can be added manually). When multiple connections specify the same domain, the one with the highest priority (lowest numerical value) wins. If a connection specifies a domain which is subdomain of another domain with a negative DNS priority value, the subdomain is ignored.