pfSense

Hi.
Also tried Revision fc06d8ea with no effect on clients from Mountain Lion through Yosemite.

Hi all,

Not sure if this helps, but some findings:

First, it appears that the strongswan config is generated using a comma separated list of domains, but per the strongswan docs , it should be space separated. Updating the config manually to be 28675 = wanteddomain.com fake.com at least provides a workaround at the moment, as the extra characters are only appended to the last domain in the list.

Second, perhaps this one's my fault, but it seems as though charon isn't being fully restarted upon saving and applying the configuration from the web configurator. Update/Save/Apply from vpn_ipsec_mobile.php updates the generated config file, but doesn't result in charon being restarted or the new configuration being applied.

Thank you for finding the separator issue.

I pushed fixes for separating dns names with spaces.
The characters at the end are some garbage of stack on how strongswan shuffles data around.

Running todays snapshot (Thu Mar 05 23:16:42 CST 2015 ) upon entering split dns domains it won't allow me to enter more than one with spaces or commas and with only one gives this error:
Warning: Invalid argument supplied for foreach() in /etc/inc/vpn.inc on line 384

Applied in changeset b47f7d65d376e3c401cbda05c4d0ad60abb87d41.

One thing I would add is that this behavior is particular to the Unity plug-in. With the Unity plug-in disabled, the problem does not occur.

In researching various issues I faced in getting IPSEC to work with OS X and iOS, I frequently came across recommendations in the strongSwan boards to disable the Unity plug-in as it frequently causes problems, particularly with non Cisco gear. It may be preferable to have Unity disabled by default in the pfSense config.

I thought this was due that now unity plugin is not anymore loaded by default.

Running pfSense 2.2.4 and attempting to connect with iOS 8.4. This problem still apparently exists in some form or another.

1. Supplied a default domain name with the split DNS field blank (this used to work). DNS queries on the iPhone are still sent out to the internet and not to the supplied remote internal DNS server.
2. Filled in the split DNS field with [mydomain].com and the problem still existed.
3. Filled in the split DNS field with [mydomain].com immediately followed by a space, but this appears to be stripped off once the settings are saved.
4. Filled in the split DNS field with [mydomain].com[space][mydomain] (ex. "domain.com domain") and suddenly internal DNS queries started working properly. Weird.

Should I post this to the StrongSwan issue as well?

Quick testing report with pfSense 2.2.6 / i386 on Soekris net5501 (just upgraded from pfSense 2.1.5), iOS 9.2 on iPhone 6S: I tried test cases 1, 2, and 4 in comment 19 of this bug with identical results. I have DNS working as expected with #4. Thanks to Travis Gomillion for the hint!

(I did not try disabling the Unity plug-in as suggested up-thread...first priority was to get IPSec working in some way.)

For the records, I've tried it with Unity plugin enabled and disabled with same results

I have just setup a new pfSense install and I am seeing this bug again on version 2.3.1-RELEASE-p1. Happens regardless of unity being on or off. As someone in the comments says if you put in a dummy domain after your legit domain it works as expected because only the dummy domain is getting the weird appended character.

here is a example from my internal dns logs. as you see its appending to the domain name.
02-Jun-2016 15:43:52.785 client 192.168.10.1#57278 (bigfoot.peedy.homep\001): query: bigfoot.peedy.homep\001 IN A + (192.168.0.10)

this is on iOS 9.3.2

Ok, I am using pfSense 2.3.2 (latest) and I get the silly p appended to the default domain. Can someone look into this and leave this issue as open as opposed to resolved.

The impact is huge because it is not possible to get a IPsec VPN with DNS to work.

The strongswan related bug is https://wiki.strongswan.org/issues/921 which also shows as closed.

As a workaround I had to remove the default DNS domain and entered it twice separated by a space in the split DNS field.

See the following post for how I discovered this: https://forum.pfsense.org/index.php?topic=118571.0

Also I am having the same problem in versãoo 2.3.2-RELEASE-p1. For some in the forum saw what worked the Place hum false address, unfortunately for Me Not.
Also checked que Routes table is not being propagated there atrvés Windows to control route. EVEN with an option to provide a list of networks accessible to customers,
To Take Command route UNABLE list as networks, however IT Send Traffic POIs a VPN and the default gateway.
If you uncheck the option to Inside Windows gateway using standard paragraph NOT a VPN, NOT WORK DOES NOT EXIST POIs Table route

This still happens in 2.3.2-RELEASE-p1. Had to add a dummy second domain to fix it like the others.

resolver #3
domain : fooboo200.com*p*
nameserver⁰ : 192.168.1.212

This Problem still exists as I ran into it since the last week.

v2.5.2-RELEASE

No difference if the unity plugin is enabled or disabled. Had to add a dummy second domain as suggested in the last post.