Mac OSX can dig or nslookup but cannot ping host

Question

I am facing a problem with my mac on a Sophos Remote IpSec VPN. The VPN IpSec is set to be the Default Gateway. I can connect to the VPN, and I can join every IP on my remote network. I can dig and nslookup fqdn too, but cannot ping them:

ping: cannot resolve domain.local: Unknown host

I have make searches on Internet but cannot find a solution. I think it comes from my mac, because the "ping fqdn" did work, and then stop. No modifications has been made on the distant firewall (I am the only one that has access).

In brief, when I am connected to the VPN, I can join every machines and services with their IP address, but not with the local DNS. I can browse Internet through the VPN with no problem (I am actually connected to post this question).

I don't know very weel how OSX handle network configuration, it seems more complicated than a simple Debian server or a windows workstation (though).

I tried things like scutil --dns networksetup -listallnetworkservices that i didn't know, and get interesting information to help me, but didn't manage to resolve my problem.

From now I think I need other brains to help me, then I will learn a bit more to use my Mac, and I think it's not a bad thing. It's like the NIC know which DNS to ask to resolve name when using dig, but don't send them the request when ask (like ping in this case).

My ears, or my eyes are wide opened, thank you.

Answer 1

Ok, found a way to make it works. I found two resources that help me to resolve my problem: rakhesh.com MacOS VPN doesn’t use the VPN DNS
vNinja.net macOS: Using Custom DNS Resolvers

So from these two resources here are the steps too join my local fqdn when I am connected to my vpn (Sophos Remote IpSec with Sophos vpn client). In this example, my local domain will be local.foo.bar. The local DNS ip address that is the authority of this local domain is 10.10.10.10/24

1. Create folder /etc/resolver

2. Create and edit the file named with the local domain I want to resolve sudo vim /etc/resolver/lab.ecinf.ch

3. File content

    ```
    domain local.foo.bar
    search local.foo.bar
    nameserver 10.10.10.10
    search_order 1
    timeout 5
    ```
   

I put this resolver in higher priority, because I want it to be used first when I am connected to the VPN. When I am disconnected, this domain is not joinable, so I don't care. The timeout 5 is taken from the rakhesh.com's blog, and it's "timeout of 5 seconds so it doens’t spend too much time trying to contact the name server if the VPN is not connected".

4. Save the file
5. Flush cache DNS sudo killall -HUP mDNSResponder
6. Verification scutil --dns

Hope it will help other that meets the issue. Hope that it isn't something bad to do this. If someone is a network guru over there, please tell me if I have make something wrong or if it's not best practice at all.