dns hostname registration

TheShanMan

I currently have my vpn set up as a bridge, although I plan to experiment with tunneling since the smartphone clients don't support tap interfaces so I might ultimately switch. My network is working great with the one minor issue that vpn client hostnames don't register in my lan's dns server (windows dns). As a result, if I try to do an nslookup on a vpn's hostname, I get nothing. There are 2 ways I've imagined that I could solve this, but no amount of googling of either approach has helped.

I can imagine letting my lan's dhcp server serve ip addresses to vpn clients, in which case registering of hostnames should be automatic. However, even if that is possible, I believe that isn't going to help me if I go to a tunnel vpn since the vpn clients would be on a different subnet.

I can also imagine openvpn somehow registering the hostnames with my dns server, or some sort of directive that would tell the clients to register their hostnames. I don't believe 'push "dhcp option DNS x.x.x.x"' handles that aspect of dns, or if it does then something must be blocking that.

So how would I accomplish this, whether I ultimately stick with a bridge or go with a tunnel? Bear in mind that while I have spent quite a bit of time dabbling, I am by no means an expert on any of this.

server config:
dh /tmp/openvpn/dh.pem
ca /tmp/openvpn/ca.crt
cert /tmp/openvpn/cert.pem
key /tmp/openvpn/key.pem
keepalive 10 120
verb 4
mute 5
log-append /var/log/openvpn
writepid /var/run/openvpnd.pid
management 127.0.0.1 5002
management-log-cache 50
client-config-dir /tmp/openvpn/ccd
script-security 2
port <myport>
proto tcp-server
dev tap
server-bridge 192.168.217.2 255.255.255.0 192.168.217.200 192.168.217.224
push "dhcp-option DNS 192.168.217.3"
push "dhcp-option DNS 192.168.217.99"
push "dhcp-option DOMAIN <mydomain.com>"
push "dhcp-option WINS 192.168.217.3"
push "route 0.0.0.0 255.255.255.255 net_gateway"
comp-lzo
max-clients 5
persist-key
persist-tun
status /var/log/openvpn-status

client config:
client
dev tap
proto tcp
remote <myserver.com> <myport>
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert <myclient>.crt
key <myclient>.key
ns-cert-type server
comp-lzo
verb 3

TheShanMan

Bump. Is what I want to do possible? Worst case scenario I could live with static assignments for each client since I could then put static entries in my dns server. I found some info on how to configure that, but I'm hoping it doesn't come to that.

janjust

you *might* get lucky by adding

register-dns

to the client config - this will run 'ipconfig /registerdns' after the connection has come up. If the client knows which DNS server to register with (using "push dhcp-option DNS x.x.x.x") then then Windows DNS server should know the name of each VPN client. I've never tested this myself so I'm not sure this will work...

TheShanMan

I just tried it from the server side (push "register-dns") and I see in the client log that it acts on it by performing an ipconfig /registerdns. That didn't help. And looking at the help of ipconfig /registerdns, it doesn't seem like it should. It says it "re-registers" which I interpret as meaning if it can't register in the first place, it probably won't be able to "re" register. Thanks for the suggestion though.

I'm kind of surprised that this seems like uncharted territory. I would think it would be almost standard procedure, but what do I know?

Any other ideas? Maybe I'll have to start toying with static ip address leases and static dns records.

janjust

are you sure you're talking about Windows DNS and not WINS?
Normally, DNS is centrally managed, thus a DNS server simply resolves names to IP addresses and vice versa; I am not sure how registering a Windows (netbios) name with a Windows DNS server works - I thought it was normal to use WINS for this. You can push a WINS setting as well, and with "--register-dns" on the client side this should cause the Windows client to register itself with the specified WINS server - is that an alternative?

TheShanMan

I apologize. I should have thought to mention that WINS is working fine. VPN clients use WINS to talk to systems on the LAN and vice versa. But DNS is a different story - VPN clients can use DNS to talk to systems on the LAN but not the other way around.

janjust

so which DNS names should the VPN clients register with? and what should happen if 2 Windows PCs named 'WINDOWS' try to register with the Windows DNS server?

Windows DNS registration most likely requires some form of SSDP or multicast forwarding - try to find out how a PC on a different subnet (not VPN per se) can register with a Windows DNS server.