Configd overwrites DNS and routing from OpenVPN

Apologies if this is covered elsewhere. I've looked and found no definitive answers.
Problem:
OpenVPN creates a tunnel on a virtual network interface tap0 which is configured via DHCP. Once up a script is called to update the routing tables and set DNS. On linux and windows this works and is very stable because static routing configurations are employed. On Mac OS X v10.6 routing configurations are dynamic and managed by configd. Once the virtual interface comes up the routing tables and DNS can be changed, but after a short while, configd will come along and change the routing and DNS configurations and break the VPN.
This is covered in some detail in this article.
http://www.afp548.com/article.php?story=20041015131913324
Question: How to write the DNS and routing entries into preferences at the time OpenVPN comes up so that they will persist when configd updates the system?
Details:
1. Commands used by OpenVPN script to update the routing table and DNS
/usr/sbin/ipconfig set "$dev" DHCP
/usr/sbin/scutil <<EOF
d.init
get State:/Network/Service/DHCP-$dev/DNS
d.add SupplementalMatchDomains * $domain_name
set State:/Network/Service/DHCP-$dev/DNS
EOF
Feb 7 11:19:36 MacBook-Pro org.openvpn[44]: Sun Feb 7 11:19:36 2010 /sbin/route add -net 192.168.120.1 192.168.1.1 255.255.255.255
Feb 7 11:19:36 MacBook-Pro org.openvpn[44]: add net 192.168.120.1: gateway 192.168.1.1
Feb 7 11:19:36 MacBook-Pro org.openvpn[44]: Sun Feb 7 11:19:36 2010 /sbin/route delete -net 0.0.0.0 192.168.1.1 0.0.0.0
Feb 7 11:19:36 MacBook-Pro org.openvpn[44]: delete net 0.0.0.0: gateway 192.168.1.1
Feb 7 11:19:36 MacBook-Pro org.openvpn[44]: Sun Feb 7 11:19:36 2010 /sbin/route add -net 0.0.0.0 192.168.110.1 0.0.0.0
Feb 7 11:19:36 MacBook-Pro org.openvpn[44]: add net 0.0.0.0: gateway 192.168.110.1
2. Every looks good for a few minutes
MacBook-Pro:~ user$ netstat -r
Routing tables
Internet:
Destination Gateway Flags Refs Use Netif Expire
default 192.168.110.1 UGSc 0 0 tap0
default 192.168.110.1 UGScI 41 88 tap0
127 localhost UCS 0 0 lo0
localhost localhost UH 0 0 lo0
169.254 link#5 UCS 0 0 en1
192.168.1 link#5 UC 1 0 en1
192.168.1.1 0:1e:e5:86:79:22 UHLWI 1 17 en1 1187
192.168.1.101 localhost UHS 0 0 lo0
192.168.110 link#7 UCS 2 0 tap0
192.168.110.1 0:17:3f:9b:e3:e2 UHLWI 43 8 tap0 1182
192.168.110.3 0:1c:c0:f:90:3b UHLWI 12 137213 tap0 454
192.168.110.29 localhost UHS 0 0 lo0
192.168.120.1/32 192.168.1.1 UGSc 1 0 en1
MacBook-Pro:~ user$ sudo scutil --dnsDNS configuration
resolver #1
domain : celoso.net
search domain[0] : celoso.net
nameserver[0] : 208.67.222.222
nameserver[1] : 208.67.220.220
nameserver[2] : 4.2.2.3
order : 200000
resolver #2
domain : celoso.net
nameserver[0] : 192.168.110.3
nameserver[1] : 192.168.110.3
order : 100400
3. Then something will trigger configd to update the DNS or routing tables, the only evidence of which I have been able to find is the following message in the system.log
Feb 7 11:20:34 MacBook-Pro configd[13]: network configuration changed.
4. And either the DNS or routing tables will be changed e.g.
MacBook-Pro:~ user$ sudo /usr/sbin/scutil --dns
Password:
DNS configuration
resolver #1
domain : celoso.net
search domain[0] : celoso.net
nameserver[0] : 208.67.222.222
nameserver[1] : 208.67.220.220
nameserver[2] : 4.2.2.3
order : 200000
resolver #2
domain : local
options : mdns
timeout : 2
order : 300000
MacBook-Pro:~ user$ netstat -r
Routing tables
Internet:
Destination Gateway Flags Refs Use Netif Expire
default 192.168.1.1 UGSc 0 0 en1
default 192.168.110.1 UGScI 52 81 tap0
127 localhost UCS 0 0 lo0
localhost localhost UH 0 0 lo0
169.254 link#5 UCS 0 0 en1
192.168.1 link#5 UC 1 0 en1
192.168.1.1 0:1e:e5:86:79:22 UHLWI 1 17 en1 1196
192.168.1.101 localhost UHS 0 0 lo0
192.168.110 link#7 UCS 2 0 tap0
192.168.110.1 0:17:3f:9b:e3:e2 UHLWI 54 5 tap0 1199
192.168.110.3 0:1c:c0:f:90:3b UHLWI 0 34 tap0 1161
192.168.110.29 localhost UHS 0 0 lo0
192.168.120.1/32 192.168.1.1 UGSc 1 0 en1

The question is what event is causing configd to change configurations.
In general, this will only occur if an interface goes down or if a DHCP address needs to be renewed.

Similar Messages

Acquired DVR, STB. and Router from Apartment cleanout; Return?

I am trying to do the right thing but poor customer service is not allowing me. I do IT work and received a DVR, STB, and Router from an apartment cleanout from a property owner. I am uncertain if the boxes are paid off or what, but rather than accept stolen property or flip them, I want to contact Verizon and have a return put out on the equipment. Hey maybe I'll get a credit or a few months of movies or something. But I certainly am not spending another minute sitting on hold to do this. I could not get through over 45 minutes yesterday. If I call and specify that I want to buy new service though, I get right through- only to be redirected anyways. Funny how it works. I love my FIOS service, always have, but to call them for anything requires taking a half day off of work. So, with that said- does anyone have contact info for equipment returns? Pittsburgh/Monroeville PA area. Again, if it's going to cost me anything, screw them. I will throw the stuff away as it should have been in the first place. If the equipment was paid for, it would be nice to have it activated to my account and no longer pay rental fees for my STB and DVR.
Message Edited by betteroff on 08-14-2009 06:47 AM

Don't know who to contact, but the video equipment is never considered paid off and remains forever Verizon property (that's how they make money on them). After a year I belive Verizon doesn't require the return of the router. They will not activate any STB without it being in their inventory and charging you a monthly fee.
If a forum member gives an answer you like, give them the Kudos they deserve. If a member gives you the answer to your question, mark the answer as Accepted Solution so others can see the solution to the problem.

Button order and routing from PS menu not working

Ugh, this is driving me crazy.
When authoring a Blu-ray, I've gone through the same steps since I started but all of a sudden the menus I'm creating in PS CS5 for Encore CS5 are not working and for the life of me I can't figure out why.
The problem I'm having is that I set everything up in Photoshop then import the menu into Encore however when using the navigation of a remote, scrolling down skips some buttons and doesn't cycle through them normally.
For example, let's say I have eight buttons defined in a PSD.
1
2
3
4
5
6
7
8
When I preview or do a test burn, the highlight will stop on 1 and 2 but skip 3 and 5 and other random button definitions. And then when it gets to the last, it doesn't cycle back to the first.
I have everything set up correctly as far as I know - group layers prefaced with (+), highlight cursor prefaced with (=1), etc. And the order looks good in Encore.
Extremely frustrated, anyone else having this problem in CS5? I can up the PSD if anyone wants to check it out.
Thanks,
Tom

Can you post a screenshot of the menu with button routing on?
I second Stanley's request, and please Crop into that area, and also Save your JPEG, or PNG, with adequate resolution for people to see the numbers on your Button Routing. Also, if you have any specific desires for the order of your Button Routing, please define that.
Note that En will Automatically Route Buttons, based on their Layer Set Order in PS. If you have done some moving around of the order of Button Layer Sets, or have done some Copy/Duplicate, then what you think the order should be, but it might not be so. En will start at the bottom of the Layers Panel, and assign the identifier, Button 1 (regardless of what name you might have assigned), to the lowest Button, and working up, one Button Layer Set at a time, until it reaches the top. Can you also post a screen-cap of your Button Layer Sets (can be closed for a clear shot of the entire Palette), with the Layers Palette showing clearly, and the image with the Buttons showing near by? That could also be very helpful.
Good luck,
Hunt

Extract attachment from .msg files and route from content organiser rules

Hello All,
I have Enabled Dropoff library to accept email.
E-Mail have attachments .
I need to set some content organiser rule which can extract the attachment and rute to specific folder.
if i am wrong please correct me.
How i can achieve ???
Is it possible ??
please suggest some alternate if not possible.
Mukesh

Hi,
In the Oracle Manual "TEXT REFERENCE" there is in the addendum B a list of supported formats, I looked in 10.2 manual, there is no note of Outlook, if I look in 11.1 I see that Outlook is supported, see http://download-west.oracle.com/docs/cd/B28359_01/text.111/b28304/afilsupt.htm. Also ZIP,DOC, XLS are mentioned with all the versions Oracle Text supports.
Herald ten Dam
Superconsult.nl

Have a 1st generation Apple TV, which is not showing as a device in iTunes. Had no problems with Apple TV until I changed from a Windows PC to an iMac. I have changed my IP address, sub mask address and router address in the Apple TV, Can anyone help?

I have a 1st generation apple TV, which was working perfectly until I changed from a Windows PC to a Imac. The Apple TV will not show in Itunes. I have changed the IP address, sub mask and Router IP address. Since changing I have switched everything of and on again. Can anyone help?

I have a new router and computer. I have just remembered that just before my old PC died on me, I transferred my iTunes library to a hard drive. I can't remember exactly just how I got my library back, but there are definately things in my library now that were in my library on my old PC! Hope this makes sense. What do you mean by same location? Do you mean in the same place in the house?
Another difference I have just thought of was my old router was connected directly to the computer bu I have not been able to do this with Sky as my PC is not near a phone socket! Will this make a difference?

I am upgrading wi-fi router from Airport Express to Airport Extreme. I followed set up instructions yet I am still getting the flashing amber light and cannot setup (using manual setup or the continue button). What should I do??

Hello,
I am upgrading my wireless router from an Airport Express to an Airport Extreme. After disconnecting the Express and plugging the Extreme via ethernet cable to the modem, I am receiving a flashing amber light after connecting the power source. I also reset the modem while the Extreme was still powered and plugged into the modem, but no luck. I also tried resetting the modem and the Extreme and still no resolution. Please advise. Thank you!

This error usually occurs when the Windows Firewall and/or anti-virus software blocks the connection attempt from the PC to the AirPort Extreme.
Microsoft Security Essentials can do the same thing.
Things would be much easier if you had a Mac or iPhone or iPad to set up the AirPort Extreme. Otherwise try turning off the Windows Firewall and Anti-Virus programs, etc on the PC.
Restart the PC, then see if the PC can contact the AiPort Extreme. It will likely help to connect an Ethernet cable from the PC to one of the LAN <-> ports on the AirPort Extreme. You can disconnect the Ethernet cable once the AirPort Extreme has been configured.
Re-enable the Windows Firewall, Anti-Virus, etc and restart the PC.

I can't print using airprint from my iPhone 4. Everything with the phone and the printer and router are up to date. I can print from my iPad 2 with no problems. What's wrong with the iPhone 4?

I can't print using airprint from my iPhone 4. Everything with the phone and the printer and router are up to date. I can print from my iPad 2 with no problems. What's wrong with the iPhone 4?

I just wanted to leave a note that it's working now. I'm not sure if it was the latest iTunes update that got it working or that i decided to start a new library instead of using the one i had backed up on Windows 8 (it didn't occur to me to check using the old library when i re-installed iTunes). But if anyone is having this problem, it might be worth trying again with a new installation of iTunes to see if the latest update works for you, and if not, try using a fresh library instead of a backup (by fresh library i mean discard your old library completely and start a new library, not just restore as new iPhone, a whole new library).

My Router ip is appearing in the advanced window in dns and cannot connect to dns

right i am having problems with dns servers i have tryed everything when i select my network and go into advanced settings in dns my router ip address appears and it wont connect to the correct dns because it trys to look up the router i cant delete it and every time i manage to get rid of it, it reappears adding the correct dns servers makes no change. when i go into teminal and check my dns my router ip appears but no very able in terminal.
any help would be greatly helpful it is runninh 10.5.8
Have tried making airport inactive and manually entering all the ip address and subnet etc but as soon as i click apply it adds the same address again.

Hi..
Try using OpenDNS.
Click +
Enter these addresses exactly as you see them here.
208.67.222.222
Click +
208.67.220.220
Then click OK.
More about OpenDNS here > Topic : Manually provided DNS server addresses are higher priority than DHCP's
OpenDNS offers better speed, more security, includes anti phishing filters, prevents browser redirects, and it's free.

OSB - Service to receive message from JMS and route to different queues

Hi,
I am completely new to SOA suite, so please bear my question :)
I have a requirement to send XML messages to the different queues(external client facing queue) based on their contents. These XML messages are generated inside the application based of various business scenarios.
We have adapted following approach to do it
1. Application Service will construct the message and send it to the internal JMS queue (We are intending to use JAXB objects to construct message)
2. On the OSB, we need to define a service, which will keep polling messages from this intermediate jms queue
and somehow based on some routing information, it will post those messages to the respective external facing queue.
For the first part I am using spring's JmsTemplate to send message to queue
For second part - I am not sure what should be the approach?
we are using Oracle 10g Fusion Middleware
Please guide
Cheers

Thank you guys for all your help. Very soon I will try and see how it works. Meantime just an additional question
Do I need to define a canonical xsd for all different types of xml messages? so that proxy can extract the routing info and route the actual message to different queues?
And re-directing to different queue in OSB means I need to define business service for each queue or I can put message directly into the destination queue by referring its jndi name in the proxy service configuration?
Regards,
Y

Gave up on Leopard DNS and installed BIND 9.5 from source

I have been migrating an older Linux router/server running on a 2-way Dell server to a Mac mini running Leopard Server. I have been generally very happy, although I finally cut over the last piece this past week and shut off the Linux server, and all **** broke loose. The last piece was DNS, and try as I might, I could not get my properly-delegated subnet to answer reverse DNS lookups. This ended up causing our email to start bouncing to Comcast, Yahoo, and others (who rightfully demand MTAs answer with a proper reverse DNS lookup).
So, after screwing around with this problem all day, and getting nowhere (it's DNS, for goodness' sake...it's been basically the same since the dawn of time!!!), I simply gave up.
I downloaded the BIND 9.50 distro (source code), typed "configure", "make" and "make install". I then adjusted the OS X bind directories to go somewhere else, copied my Linux BIND config files onto the Mini, typed "named", and lo and behold, it works.
I have no idea why Apple made the Leopard Server DNS stuff so painfully automatic...and wrong. If they're selling a $1000 server OS, they should not assume they're dealing with newbies. Sigh.

I am curious why you would want to have a forward but not a reverse lookup?
Quite simple. Here's one example.
You run your own mail server, mail.domain.com, on your own IP address 12.34.56.78 but you leave web handled by some upstream provider (e.g your ISP's or hosting provider's server at 23.45.67.89).
You add mail.domain.com/12.34.56.78 and get a reverse zone for 12.34.56.0/24
You add a record for www.domain.com at 23.45.67.89 (your ISP's server) and get a reverse zone for 23.45.67.0/24 even though it's not your IP block. Now you can't reverse lookup anything else in 23.45.67.0/24 unless you populate the rest of that /24 network with your provider's records.
There's also no support for networks other than /24, something I forgot on my original post.
I still know some ISP's that dont support SPF.
Many ISPs don't use SPF for some reason, but that doesn't mean there's no need to add it - it's one more string in anti-spam bow. If any particular ISP doesn't use SPF they won't bother looking for the TXT record, but if they do use SPF and you don't have a record you're at a loss.

I installed a new router from my ISP provider and now I can't find my Time Capsule or "Guest" network. What do I need to do to correct this problem?

I installed a new (and supposedly better & stronger) router from my ISP provider (Verizon) and now I can't find my Time Capsule or "Guest" network.
My Mac is not backing up because it can't find my Time Capsule network & my "Guest" network has also disappeared.
What do I need to do to correct this problem?

You must reset the TC to factory and start over. The TC simply remembers too much from the previous setup to work in the new one.
If your new router is going to take the router role, then the TC will have to be bridged and you will lose your Guest wireless.. the way around this is to use the Verizon router as your guest wireless and the TC as your main wireless.
The Factory Reset Gen1-4.
Unplug your TC. Hold in reset. and power the TC back on.. without releasing reset for about 10sec. When the status light flashes rapidly; release it.
Be Gentle! Feel the switch click on. It has a positive feel.. add no more pressure after that.
TC will reboot after a couple of minutes with default factory settings and will wipe out previous configurations.
No files are deleted on the hard disk.. No reset of the TC deletes files.. to do that you use erase from the airport utility.
Factory reset Gen 5
Hold in reset for about 5sec until the status light flashes quickly.
If your AirPort Time Capsule still doesn’t respond, do a similar reset to the Gen1-4.
Unplug your AirPort Time Capsule .. hold in reset and power the TC back on.. without releasing the reset.. wait until status led flashes rapidly.

On my home wireless network, the iphone 5 won't let me enter the IP address, subnet mask and router info. I was able to enter the DNS and Search Domains. How do I open up those fields?

On my home wireless network, the iphone 5 won't let me enter the IP address, subnet mask and router info. I was able to enter the DNS and Search Domains. How do I open up those fields?

Apparently the router is not sending the info to the iphone. How can I make that happen?

PIX515 version 7.0 and router 2811 ver 12.3r8 not able to receive emails from gmail files larger than 2M

PIX515 version 7.0 and router 2811 ver 12.3r8 not able to receive emails from gmail files larger than 2M

MatejLach wrote:
clamd is running, user and group clamav all have the relevant permissions as far as I can tell, however upon scanning my mail, I always end up with the following error:
Scanning error:
/home/username/.claws-mail/mimetmp/0000000e.mimetmp: lstat() failed: Permission denied. ERROR
Seems like a permissions error to me... maybe check the actual file it is attempting to scan... I know it is in your home folder, but just to be sure, you might want to check that everything is sane.

No route to openvpn server when using networkmanager and wireless

Since some weeks I can not connect to openvpn networks via WIFI when using the networkmanager. Connecting manually there is no problem.
When I connect my laptop via LAN (enp0s25) and establish an openvpn connection everything works as expected:
[me@laptop ~]$ ip route show
default via 10.101.2.173 dev tun0 proto static metric 1024
10.101.2.173 dev tun0 proto kernel scope link src 10.101.2.174
172.17.2.0/24 dev enp0s25 proto kernel scope link src 172.17.2.25
172.17.2.0/24 dev enp0s25 proto kernel scope link src 172.17.2.25 metric 203
xxx.xx.xx.xxx via 172.17.2.1 dev enp0s25 proto static metric 1
When connecting to the internet via WIFI (wlp3s0) the VPN connection is established but there is no route to the VPN server:
[me@laptop~]$ ip route show
default via 10.101.2.173 dev tun0 proto static metric 1024
10.101.2.173 dev tun0 proto kernel scope link src 10.101.2.174
172.17.2.0/24 dev wlp3s0 proto kernel scope link src 172.17.2.38
When I add the route manually everything works fine:
ip route add xxx.xx.xx.xxx via 172.17.2.1 dev wlp3s0 proto static metric 1
Any ideas?

There are two problems here. The first is a firewall problem. Although the Open MQ port mapper running on port 7676 wasn't being blocked, the port that mq tcp port was. I was able to solve this by creating an ssh tunnel and specifying a mqtcp connection.
"Table 182 Message Broker Addressing Schemes"
http://docs.sun.com/app/docs/doc/820-4916/6ngbm6hp4?a=view#gbnnt
f.setProperty(ConnectionConfiguration.imqAddressList,"mqtcp://" + host + ":32782/jms");This solution is less than ideal, since the mq tcp port can change. In fact, if you reference the original post, you can see it has already changed on me. I could write code to determine what the port is and create my own tunnel, but that doesn't seem worth the effort just yet.
The second problem is the lack of helpful error message. It's the sort of problem where you can't really blame any one party too much. Open MQ and Java are both just reporting the error message that they are given by the operating system. They should do a bit more than that.

SMTP Routes, DNS and Failover

Hi !
I'm configuring an outgoing server (i.e. only a private listener) on ESA C370 with AsyncOS 8.0.1.
I use the Internet's Root DNS Servers, and my default SMTP route is empty. My ESA is connected to 3 networks : production (default gateway), administration and failover (1 interface/network).
I would like to deploy a failover solution with an extra ESA on the failover network : if I lose my internet connection (impossible to join DNS and remote MX), my ESA would redirect all its mails to the extra ESA.
How can I do that ?
Thank you for your help.
Best Regards
Quentin

The ESA has no way to automatically fallback to a static IP if DNS in unreachable. The best on-box solution I can suggest is manually changing the 'All Other Domains' SMTP Routes entry when such an event occurs.
I hope this helps!
- Jackie

Configd overwrites DNS and routing from OpenVPN

Similar Messages

Maybe you are looking for