Many corporate environments have internal DNS servers that are required to resolve internal resources. However, you might prefer a different DNS server for external resources, for example
18.104.22.168. This allows you to use more secure DNS features like DNS over TLS (DoT). The solution is to set up
systemd-resolved as your DNS resolver, and configure it for split DNS resolving.
Starting with systemd 251, Debian ships
systemd-resolved as a separate package. If it isn’t installed, go ahead and install it.
$ sudo apt install systemd-resolved
$ sudo systemctl enable --now systemd-resolved.service
Create the following configuration file under
DNS=22.214.171.124#cloudflare-dns.com 126.96.36.199#cloudflare-dns.com 2606:4700:4700::1111#cloudflare-dns.com 2606:4700:4700::1001#cloudflare-dns.com
Domains=~. gives priority to the global DNS (188.8.131.52 in our case) over the link-local DNS configurations which are pushed through DHCP (like internal DNS servers).
DNSOverTLS=opportunistic defaults to DNS over TLS but allows fallback to regular DNS. This is useful when corporate DNS doesn’t support DNS over TLS and you still want to resolve corporate internal domains.
systemd-resolved to reload the configuration:
$ sudo systemctl restart systemd-resolved
The final step is to redirect programs relying on
/etc/resolv.conf (possibly through the
glibc API) to the
systemd-resolved resolver. The recommended way according to the
systemd-resolved man page is to symlink it to
$ sudo ln -rsf /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf
F5 VPN doesn’t play well with the above configuration. First, F5 VPN tries to overwrite the DNS configuration in
/etc/resolv.conf, by removing the existing file and replacing it with its own (pushing corporate DNS server configuration through it). The solution is to prevent F5 VPN from deleting the
/etc/resolv.conf, by setting it to immutable. However, we cannot
chattr +i a symlink. We have to resort to copying the configuration statically, and then protect it.
$ sudo cp /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf
$ sudo chattr +i /etc/resolv.conf
Finally, because now F5 VPN can’t update the DNS configuration, we would have to manually configure the corporate DNS servers and the search domains.
$ sudo resolvectl dns tun0 192.168.100.20 192.168.100.22
$ sudo resolvectl domain tun0 ~example.corp ~example.local
Update: See Automating DNS Configurations for F5 VPN Tunnel using Systemd-resolved and NetworkManager-dispatcher for a script that automates the configuration.