<html><body><div style="color:#000; background-color:#fff; font-family:times new roman, new york, times, serif;font-size:12pt">Tobias,<br><br>I was reading that you can send a DNS server to use with the attr plugin. Would the android client be able to use that DNS attribute and override the one set on the phone?<br><br>Mark<br><div><span><br></span></div><div><br></div> <div style="font-family: times new roman, new york, times, serif; font-size: 12pt;"> <div style="font-family: times new roman, new york, times, serif; font-size: 12pt;"> <div dir="ltr"> <font face="Arial" size="2"> <hr size="1"> <b><span style="font-weight:bold;">From:</span></b> Tobias Brunner <tobias@strongswan.org><br> <b><span style="font-weight: bold;">To:</span></b> Mark M <mark076h@yahoo.com> <br><b><span style="font-weight: bold;">Cc:</span></b> "users@lists.strongswan.org" <users@lists.strongswan.org> <br> <b><span style="font-weight: bold;">Sent:</span></b>
Monday, September 24, 2012 5:07 AM<br> <b><span style="font-weight: bold;">Subject:</span></b> Re: [strongSwan] Android client problems - possible bugs found<br> </font> </div> <br>
Hi Mark,<br><br>> Now I have noticed some strange behavior. When i go to a website it<br>> takes a very long time to even start loading. I setup Wireshark for my<br>> gateway and noticed that my client sends many DNS requests for the site,<br>> these are multiple IPv6(AAAA) requests, sometimes 5-10 before the site<br>> starts to load. I think this is the problem. Now I am not sure if this<br>> is a problem with my phone and Verizon network or something wrong with<br>> the strongSwan android client, any ideas?<br><br>Not really. Are all queries for the same name? Do you see the response<br>before the client sends another query? Perhaps the resolver has a very<br>low timeout, or it is really the browser that does DNS prefetching or<br>something.<br><br>> Also, is there a way to have the client auto connect when a network<br>> connection is present. Is that possible with any android vpn client?<br><br>No
currently not. On the todo list are support for roaming (e.g. from<br>3G to Wifi) and also a reconnect feature (e.g. if the connectivity is<br>gone for a longer period). Not sure if an auto-connect feature is<br>possible. Implementing auto-connect is harder as the app has to be<br>started at least once (perhaps a widget could help here, which is<br>another item on the todo list). Also, Android will show that<br>confirmation dialog to allow the app to setup the VPN initially.<br><br>> Also a strange thing is that it sends to the gateway requests for every<br>> CA cert stored on the Android phone. My Galaxy S3 comes with about 120<br>> trusted CA certs and during the IKE it sends requests to the gateway for<br>> each one. On my gateway log file it reads "received 119 cert requests<br>> for an unkown CA" after that it uses the correct one. Is that some kind<br>> of bug with the android client?<br><br>That's the
normal behavior if "Select automatically" is enabled under<br>"CA certificate" for the VPN profile. As the app does not known which<br>CA signed the gateway's certificate it loads all available CA<br>certificates and also sends a certificate request for them. To avoid<br>this you can disable that option and select the proper CA certificate<br>manually.<br><br>Regards,<br>Tobias<br><br><br> </div> </div> </div></body></html>