VPN affects DNS resolution on MacOS - macos

Question

I setup minikube on MacOS and as result there is a virtual intf created on the host machine as the following:
bridge100: flags=8a63<UP,BROADCAST,SMART,RUNNING,ALLMULTI,SIMPLEX,MULTICAST> mtu 1500
options=3<RXCSUM,TXCSUM>
ether f2:18:98:52:ec:64
inet 192.168.64.1 netmask 0xffffff00 broadcast 192.168.64.255
inet6 fe80::f018:98ff:fe52:ec64%bridge100 prefixlen 64 scopeid 0x13
inet6 fdd5:e29:6049:e016:475:5258:18a3:3700 prefixlen 64 autoconf secured
Configuration:
id 0:0:0:0:0:0 priority 0 hellotime 0 fwddelay 0
maxage 0 holdcnt 0 proto stp maxaddr 100 timeout 1200
root id 0:0:0:0:0:0 priority 0 ifcost 0 port 0
ipfilter disabled flags 0x0
member: vmenet0 flags=3<LEARNING,DISCOVER>
ifmaxaddr 0 port 18 priority 0 path cost 0
member: vmenet1 flags=3<LEARNING,DISCOVER>
ifmaxaddr 0 port 20 priority 0 path cost 0
nd6 options=201<PERFORMNUD,DAD>
media: autoselect
status: active
On a minikube VM, I got an error when trying to pull a image when I run a VPN on the host machine:
$ docker run -it --net=container:$ID --pid=container:$ID --volumes-from=$ID alpine sh
Unable to find image 'alpine:latest' locally
docker: Error response from daemon: Get "https://registry-1.docker.io/v2/": dial tcp: lookup registry-1.docker.io on 192.168.64.1:53: read udp 192.168.64.19:59651->192.168.64.1:53: i/o timeout.
If I do a dig on host when the VPN is running, I got the following outputs showing dns with 192.168.64.1 fails.
(base) /etc $ dig registry-1.docker.io
; <<>> DiG 9.10.6 <<>> registry-1.docker.io
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 45428
;; flags: qr rd ra; QUERY: 1, ANSWER: 8, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;registry-1.docker.io. IN A
;; ANSWER SECTION:
registry-1.docker.io. 3591 IN A 52.205.127.201
registry-1.docker.io. 3591 IN A 34.237.244.67
registry-1.docker.io. 3591 IN A 52.55.124.246
registry-1.docker.io. 3591 IN A 52.72.252.48
registry-1.docker.io. 3591 IN A 34.203.135.183
registry-1.docker.io. 3591 IN A 52.202.132.224
registry-1.docker.io. 3591 IN A 54.86.228.181
registry-1.docker.io. 3591 IN A 54.197.112.205
;; Query time: 347 msec
;; SERVER: 10.44.0.1#53(10.44.0.1)
;; WHEN: Wed Mar 02 17:25:26 CST 2022
;; MSG SIZE rcvd: 177
(base) /etc $ dig registry-1.docker.io #192.168.64.1
; <<>> DiG 9.10.6 <<>> registry-1.docker.io #192.168.64.1
;; global options: +cmd
;; connection timed out; no servers could be reached
(base) /etc $
If I stop the VPN and do a dig on the host, I got the following outputs showing dns with 192.168.64.1 success.
(base) /etc $ dig registry-1.docker.io
; <<>> DiG 9.10.6 <<>> registry-1.docker.io
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 39523
;; flags: qr rd ra; QUERY: 1, ANSWER: 8, AUTHORITY: 4, ADDITIONAL: 7
;; QUESTION SECTION:
;registry-1.docker.io. IN A
;; ANSWER SECTION:
registry-1.docker.io. 600 IN A 54.86.228.181
registry-1.docker.io. 600 IN A 52.72.252.48
registry-1.docker.io. 600 IN A 174.129.220.74
registry-1.docker.io. 600 IN A 34.237.244.67
registry-1.docker.io. 600 IN A 52.205.127.201
registry-1.docker.io. 600 IN A 52.202.132.224
registry-1.docker.io. 600 IN A 52.200.37.142
registry-1.docker.io. 600 IN A 52.203.238.92
;; AUTHORITY SECTION:
docker.io. 2920 IN NS ns-1168.awsdns-18.org.
docker.io. 2920 IN NS ns-513.awsdns-00.net.
docker.io. 2920 IN NS ns-1827.awsdns-36.co.uk.
docker.io. 2920 IN NS ns-421.awsdns-52.com.
;; ADDITIONAL SECTION:
ns-1168.awsdns-18.org. 143919 IN A 205.251.196.144
ns-421.awsdns-52.com. 170410 IN A 205.251.193.165
ns-513.awsdns-00.net. 132154 IN A 205.251.194.1
ns-1168.awsdns-18.org. 143919 IN AAAA 2600:9000:5304:9000::1
ns-1827.awsdns-36.co.uk. 171777 IN AAAA 2600:9000:5307:2300::1
ns-421.awsdns-52.com. 172051 IN AAAA 2600:9000:5301:a500::1
ns-513.awsdns-00.net. 132154 IN AAAA 2600:9000:5302:100::1
;; Query time: 6 msec
;; SERVER: 202.96.134.133#53(202.96.134.133)
;; WHEN: Wed Mar 02 17:25:56 CST 2022
;; MSG SIZE rcvd: 466
(base) /etc $ dig registry-1.docker.io #192.168.64.1
; <<>> DiG 9.10.6 <<>> registry-1.docker.io #192.168.64.1
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 21844
;; flags: qr rd ra; QUERY: 1, ANSWER: 8, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;registry-1.docker.io. IN A
;; ANSWER SECTION:
registry-1.docker.io. 752 IN A 52.72.252.48
registry-1.docker.io. 752 IN A 174.129.220.74
registry-1.docker.io. 752 IN A 34.237.244.67
registry-1.docker.io. 752 IN A 52.205.127.201
registry-1.docker.io. 752 IN A 52.202.132.224
registry-1.docker.io. 752 IN A 52.200.37.142
registry-1.docker.io. 752 IN A 52.203.238.92
registry-1.docker.io. 752 IN A 54.86.228.181
;; Query time: 3 msec
;; SERVER: 192.168.64.1#53(192.168.64.1)
;; WHEN: Wed Mar 02 17:25:59 CST 2022
;; MSG SIZE rcvd: 177
Why such behavior of DNS resolution with respect to VPN? How to make the DNS work when VPN is running?

Answer 1

When you connect to a VPN all your traffic is routed via VPN tunnel and it can't reach 192.168.64.1 since the router in at the other VPN end doesn't know where this address is:
; <<>> DiG 9.10.6 <<>> registry-1.docker.io #192.168.64.1
;; connection timed out; no servers could be reached
This is an expected behavior so you need to set up a route to 192.168.64.0 so it doesn't end up in a VPN tunnel.
You can read how to do this here and here.
Most simple one will look like: route add -host 192.168.64.1 my.local.gateway.ip which adds a route to 54.81.143.201 via specific gateway my.local.gateway.ip.