When using FortiClient VPN with split-tunnel configuration on OSX El Capitan, we encounter a critical networking issue where DNS queries are incorrectly routed through the primary interface instead of the VPN tunnel. This breaks the fundamental security premise of VPN connections by potentially leaking internal domain queries to public DNS servers.

OSX's network stack handles DNS resolution differently than other operating systems. The scutil --dns command reveals that El Capitan maintains a global resolver configuration that doesn't properly respect interface-specific DNS settings when using VPNs.

# Current DNS configuration example
$ scutil --dns
DNS Configuration

resolver #1
  search domain[0] : example.com
  nameserver[0] : 192.168.1.1  # Local network DNS
  if_index : 4 (en0)
  flags    : Request A records

We need to modify the system's DNS resolution behavior to ensure all queries for internal domains go through the VPN interface. Here's a comprehensive solution:

#!/bin/bash
# Script to fix DNS routing for FortiClient VPN

# 1. Identify your VPN interface (usually utunX)
VPN_IF=$(ifconfig | grep 'utun' | cut -d: -f1)

# 2. Get VPN DNS servers from scutil
VPN_DNS=$(scutil --dns | grep -A 3 "resolver #8" | grep nameserver | awk '{print $3}')

# 3. Create custom resolver for VPN domains
sudo mkdir -p /etc/resolver
sudo tee /etc/resolver/internal.example.com <<EOF
nameserver ${VPN_DNS}
EOF

# 4. Flush DNS cache
sudo dscacheutil -flushcache
sudo killall -HUP mDNSResponder

For more complex scenarios, we can implement dnsmasq as a local DNS forwarder:

# Install dnsmasq
brew install dnsmasq

# Configuration file
cat <<EOF > /usr/local/etc/dnsmasq.conf
# Listen only on VPN interface
listen-address=127.0.0.1,${VPN_IP}
# Forward internal domains to VPN DNS
server=/internal.example.com/${VPN_DNS}
EOF

# Start service
sudo brew services start dnsmasq

After implementing these changes, verify proper DNS routing with:

dig +short internal.example.com @${VPN_DNS}
tcpdump -i ${VPN_IF} -n port 53

For persistent monitoring, consider adding these checks to your network troubleshooting toolkit.

# Typical incorrect DNS resolution path
User Process → mDNSResponder → Primary Interface DNS → Internet
# Expected path
User Process → mDNSResponder → VPN Interface DNS → Corporate Network

sudo scutil
> get State:/Network/Service/com.fortinet.forticlient.vpn/DNS
> d.add ServerAddresses * 10.10.10.1 10.10.10.2
> set State:/Network/Service/com.fortinet.forticlient.vpn/DNS
> quit

echo "
block drop quick in proto udp from any to any port = 53
pass out quick proto udp from any to 192.168.1.1 port = 53
" | sudo pfctl -ef -

# Check active DNS servers
scutil --dns

# Monitor DNS queries
tcpdump -i ppp0 -n port 53

# Verify routing table
netstat -rn

<dict>
    <key>DNS</key>
    <dict>
        <key>ServerAddresses</key>
        <array>
            <string>10.10.10.1</string>
        </array>
    </dict>
</dict>