2 files changed, 27 insertions, 9 deletions

diff --git a/src/dns/nm-dns-manager.c b/src/dns/nm-dns-manager.c
index 87187d69..635e94f6 100644
--- a/src/dns/nm-dns-manager.c
+++ b/src/dns/nm-dns-manager.c
@@ -1326,19 +1326,37 @@ static void
 rebuild_domain_lists(NMDnsManager *self)
 {
     NMDnsIPConfigData *ip_data;
-    gs_unref_hashtable GHashTable *ht                  = NULL;
-    gboolean                       default_route_found = FALSE;
+    gs_unref_hashtable GHashTable *ht               = NULL;
+    gs_unref_hashtable GHashTable *wildcard_entries = NULL;
     CList *                        head;
 
     head = _ip_config_lst_head(self);
     c_list_for_each_entry (ip_data, head, ip_config_lst) {
-        NMIPConfig *ip_config = ip_data->ip_config;
+        NMIPConfig *ip_config    = ip_data->ip_config;
+        gboolean    add_wildcard = FALSE;
 
         if (!nm_ip_config_get_num_nameservers(ip_config))
             continue;
-        if (nm_ip_config_best_default_route_get(ip_config)) {
-            default_route_found = TRUE;
-            break;
+        if (nm_ip_config_best_default_route_get(ip_config))
+            add_wildcard = TRUE;
+        else {
+            /* If a VPN has never-default=no but doesn't get a default
+             * route (this can happen for example when the server
+             * pushes routes with openconnect), and there are no
+             * search or routing domains, then the name servers pushed
+             * by the server would be unused. It is preferable in this
+             * case to use the VPN DNS server for all queries. */
+            if (ip_data->ip_config_type == NM_DNS_IP_CONFIG_TYPE_VPN
+                && !nm_ip_config_get_never_default(ip_data->ip_config)
+                && nm_ip_config_get_num_searches(ip_data->ip_config) == 0
+                && nm_ip_config_get_num_domains(ip_data->ip_config) == 0)
+                add_wildcard = TRUE;
+        }
+
+        if (add_wildcard) {
+            if (!wildcard_entries)
+                wildcard_entries = g_hash_table_new(nm_direct_hash, NULL);
+            g_hash_table_add(wildcard_entries, ip_data);
         }
     }
 
@@ -1373,13 +1391,13 @@ rebuild_domain_lists(NMDnsManager *self)
         /* Add wildcard lookup domain to connections with the default route.
          * If there is no default route, add the wildcard domain to all non-VPN
          * connections */
-        if (default_route_found) {
+        if (wildcard_entries) {
             /* FIXME: this heuristic of which device has a default route does
              * not work with policy routing (as used by default with WireGuard).
              * We should have a more stable mechanism where an NMIPConfig indicates
              * whether it is suitable for certain operations (like having an automatically
              * added "~" domain). */
-            if (nm_ip_config_best_default_route_get(ip_config))
+            if (g_hash_table_contains(wildcard_entries, ip_data))
                 domains[num_dom1++] = "~";
         } else {
             if (ip_data->ip_config_type != NM_DNS_IP_CONFIG_TYPE_VPN)
diff --git a/src/dns/nm-dns-manager.h b/src/dns/nm-dns-manager.h
index 3f90dc87..f91d1556 100644
--- a/src/dns/nm-dns-manager.h
+++ b/src/dns/nm-dns-manager.h
@@ -22,7 +22,7 @@ typedef enum {
 
 enum {
     NM_DNS_PRIORITY_DEFAULT_NORMAL = 100,
-    NM_DNS_PRIORITY_DEFAULT_VPN    = 50,
+    NM_DNS_PRIORITY_DEFAULT_VPN    = -50,
 };
 
 struct _NMDnsConfigData;