Ubuntu – Resolv.conf: presence of ‘search localdomain’ fails correct DNS lookup

It's probably better to have your DNS server be able to resolve 'puppet' to the right address, and either to have your DHCP server hand out the DNS nameserver address and search list or else (if you have static IP addresses) to have something like the following in /etc/network/interfaces.

iface eth0 inet static
    address 192.168.3.3
    netmask 255.255.255.0
    gateway 192.168.3.1
    dns-search example.com
    dns-nameservers 192.168.3.45 192.168.8.10

But if you do want to do it via the resolvconf configuration files you will want to edit /etc/resolvconf/resolv.conf.d/base. In that file, put in your info as you would in resolv.conf.

nameserver 192.168.1.XXX

Then tell resolvconf to regenerate resolv.conf.

sudo resolvconf -u

Check if there is a mismatch between the host you are trying to resolve via the VPN and the "DNS Domain" that the Cisco VPN server is sending.

To check for this, open a terminal and run:

tail -f /var/log/syslog

Then start openconnect via network manager. You'll see a whole bunch of output come through, including some lines like this:

Dec 5 12:54:31 canoe NetworkManager[1266]: Internal DNS: 10.0.20.21

Dec 5 12:54:31 canoe NetworkManager[1266]: Internal DNS: 10.10.3.32

Dec 5 12:54:31 canoe NetworkManager[1266]: DNS Domain: 'internal.example.com'

And further down you'll see

Dec 5 12:54:31 canoe dnsmasq[1871]: using nameserver 10.0.20.21#53 for domain internal.example.com

This means that the VPN server is instructing the client that the DNS servers should be used to resolve hosts within internal.example.com, such as server.internal.example.com.

In my case, I need to resolve server.example.com (and was not getting any result).

The solution for me was to go into the VPN settings and add example.com as an additional search domain:

Don't forget to disconnect VPN and then re-connect for the setting to take effect.