Host resolution issue with Vpn

anuragagarwal561994 commented 10 months ago

Description

I was facing issues fetching images from organisation registry on VPN, I did a little dig up and figured out somewhat what may be the cause of the issue.

https://github.com/lima-vm/lima/pull/1626

As per this MR, the hostResolver should be false for user-v2 network driver.

However from this line: https://github.com/abiosoft/colima/blob/af03f48882bfb2ae09eb84dc7167db339d88393b/environment/vm/lima/yaml.go#L77

this will only be false if network.dnsHost will have at least one entry.

By default there is no entry and hence this was not working, while I was able to do nslookup, I was not able to make connections with the server.

So I tried to add a dummy entry like:

network:
  dnsHosts:
      host.docker.internal: host.lima.internal

and the resolution started working fine. Sorry I am able to not provide much details of what I did here, since I just hacked my way out 😄 but I think this should be fixed and made default behaviors and would close most of the VPN related issues.

Version

colima version 0.6.6 git commit: 9ed7f4337861931b4d0192ca5409683a4b7d1cdc

runtime: docker arch: aarch64 client: v24.0.7 server: v24.0.7

Operating System

[ ] macOS Intel <= 13 (Ventura)
[ ] macOS Intel >= 14 (Sonoma)
[ ] Apple Silicon <= 13 (Ventura)
[X] Apple Silicon >= 14 (Sonoma)
[ ] Linux

Output of `colima status`

INFO[0000] colima is running using macOS Virtualization.Framework INFO[0000] arch: aarch64
INFO[0000] runtime: docker
INFO[0000] mountType: virtiofs
INFO[0000] address: 192.168.107.2
INFO[0000] socket: unix:///Users/anurag.ag/.colima/default/docker.sock

Reproduction Steps

Use openvpn to connect to your organisation vpn on your host machine
Try to do curl on any of the internal company url inside the machine and it should not work
Add dummy host mapping in the colima.yaml, restart the machine and try again and this time it should work

Expected behaviour

VM should have VPN accessible even without needing the dummy host entry

Additional context

No response

abiosoft commented 10 months ago

This is quite strange.

According the that code snippet, hostResolver should default to true, and by adding dummy host entries, you are actually setting it to false.

Can you kindly share the contents of ~/.colima/_lima/colima/lima.yaml for both before and after you added the dummy host entry?

Thanks.

anuragagarwal561994 commented 10 months ago

I tried by creating 2 separate VMs, I am not sure but in-spite of disabling these configs they are still coming up in my colima.yaml

Like they are cached somewhere or if it taking form my default config, is there something I need to check.

So what I am trying to say is that when I am trying to create a new VM, I am still getting the above dnsHost entry even when I haven't specified it myself.

anuragagarwal561994 commented 10 months ago

@abiosoft sorry for the above confusions ignore them, when I tried the above approach with a fresh VM it didn't work.

So I was investigating further on how I fixed the issue and actually

sudo apt update && sudo apt upgrade

Fixed it for me, I am not sure how and why it did again:

Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
Calculating upgrade... Done
The following NEW packages will be installed:
  busybox-initramfs cpio dhcpcd-base dracut-install initramfs-tools initramfs-tools-bin initramfs-tools-core klibc-utils libklibc linux-image-6.5.0-14-generic linux-modules-6.5.0-14-generic ubuntu-pro-client-l10n zstd
The following packages will be upgraded:
  cloud-init containerd.io libgnutls30 libnetplan0 libnghttp2-14 libpam-systemd libsystemd-shared libsystemd0 libudev1 linux-image-virtual netplan-generator netplan.io python3-cryptography python3-distupgrade python3-netplan systemd
  systemd-dev systemd-resolved systemd-sysv systemd-timesyncd tar ubuntu-advantage-tools ubuntu-release-upgrader-core udev
24 upgraded, 13 newly installed, 0 to remove and 0 not upgraded.
5 standard LTS security updates
Need to get 127 MB of archives.
After this operation, 102 MB of additional disk space will be used.
Do you want to continue? [Y/n]

These were the packages that installed and now it is working everytime with a new VM as well. Before doing this vpn connections are not established from within VM and after this it is established.

abiosoft commented 10 months ago

Thanks for the feedback.

chadselph commented 6 months ago

sudo systemctl restart systemd-networkd.service

seems to fix it for me

or from the host:

colima ssh sudo systemctl restart systemd-networkd.service

abiosoft / colima