<html><body><div style="color:#000; background-color:#fff; font-family:times new roman, new york, times, serif;font-size:12pt">Tobias, <br><br>About the DNS problem, They are all queries for the same name. The first quey is IPv6(AAAA) then the next 3-4, sometimes more are for A record. It does this for every site, also it does not appear to be cached as going to the same page will go through this process again. The DNS request goes out to a Verizon DNS server so I think I will try rooting my phone and using a DNS app to change the DNS and see if that fixes it.<br><div><span><br></span></div><div><br></div> <div style="font-family: times new roman, new york, times, serif; font-size: 12pt;"> <div style="font-family: times new roman, new york, times, serif; font-size: 12pt;"> <div dir="ltr"> <font face="Arial" size="2"> <hr size="1"> <b><span style="font-weight:bold;">From:</span></b> Tobias Brunner <tobias@strongswan.org><br> <b><span
style="font-weight: bold;">To:</span></b> Mark M <mark076h@yahoo.com> <br><b><span style="font-weight: bold;">Cc:</span></b> "users@lists.strongswan.org" <users@lists.strongswan.org> <br> <b><span style="font-weight: bold;">Sent:</span></b> Monday, September 24, 2012 5:07 AM<br> <b><span style="font-weight: bold;">Subject:</span></b> Re: [strongSwan] Android client problems - possible bugs found<br> </font> </div> <br>
Hi Mark,<br><br>> Now I have noticed some strange behavior. When i go to a website it<br>> takes a very long time to even start loading. I setup Wireshark for my<br>> gateway and noticed that my client sends many DNS requests for the site,<br>> these are multiple IPv6(AAAA) requests, sometimes 5-10 before the site<br>> starts to load. I think this is the problem. Now I am not sure if this<br>> is a problem with my phone and Verizon network or something wrong with<br>> the strongSwan android client, any ideas?<br><br>Not really. Are all queries for the same name? Do you see the response<br>before the client sends another query? Perhaps the resolver has a very<br>low timeout, or it is really the browser that does DNS prefetching or<br>something.<br><br>> Also, is there a way to have the client auto connect when a network<br>> connection is present. Is that possible with any android vpn client?<br><br>No
currently not. On the todo list are support for roaming (e.g. from<br>3G to Wifi) and also a reconnect feature (e.g. if the connectivity is<br>gone for a longer period). Not sure if an auto-connect feature is<br>possible. Implementing auto-connect is harder as the app has to be<br>started at least once (perhaps a widget could help here, which is<br>another item on the todo list). Also, Android will show that<br>confirmation dialog to allow the app to setup the VPN initially.<br><br>> Also a strange thing is that it sends to the gateway requests for every<br>> CA cert stored on the Android phone. My Galaxy S3 comes with about 120<br>> trusted CA certs and during the IKE it sends requests to the gateway for<br>> each one. On my gateway log file it reads "received 119 cert requests<br>> for an unkown CA" after that it uses the correct one. Is that some kind<br>> of bug with the android client?<br><br>That's the
normal behavior if "Select automatically" is enabled under<br>"CA certificate" for the VPN profile. As the app does not known which<br>CA signed the gateway's certificate it loads all available CA<br>certificates and also sends a certificate request for them. To avoid<br>this you can disable that option and select the proper CA certificate<br>manually.<br><br>Regards,<br>Tobias<br><br><br> </div> </div> </div></body></html>