[Solved] DNS on restrictive university network

thedukeoffail

Hi there.

I have an OpenVPN setup that, as best I can tell, is working just fine. However, I have a problem with DNS.

When I connect without trying to use DNS on the server, the uni DNS gives me a 'query refused' error. However, if I attempt to use DNS via OpenVPN it simply times out.

I am not entirely sure how DNS forwarding works with OpenVPN. If it goes though port 1194 then I must have screwed something up in my configs. However, if DNS still tries to go through port 53 then that's the uni network blocking it. They block any use of that port that doesn't go through their servers. If this is the case, is there some way to change it so that I can use something else? (on Windows 7 and Ubuntu 12.04)

If not, then what have I done wrong in my config?

I followed this except for the part where it chooses DNS servers; I am not on Linode so I used google DNS instead.

Thanks.

thedukeoffail

Sorry, I really shouldn't make posts so late.

The server OS is Ubuntu 12.04.
The client OS is Windows 7 (and I have an Ubuntu 12.04 laptop as well though that isn't really the priority).

The config I posted is for the server. And here is the client config too, just in case.

thedukeoffail

debbie10t wrote
thedukeoffail wroteSorry, I really shouldn't make posts so late.
To be brutally honest, your second post was no better.

welp

Well, I have added the following lines to my server config:

push "route 10.66.0.0 255.255.255.0" # the example in the HOWTO
push "dhcp-option DNS 10.8.0.1"

Although I had the DNS there before, it had just ended up commented out because I was playing around with things (which I swore I had uncommented but I guess not).

That said, I am not sure I see the purpose of the route push. I am not attempting to access any other machines on any LAN. I only have the single VPS which is running dnsmasq (following the setup here) which I'd assume is supposed to then forward it onto the DNS servers I told it about (in this case 8.8.8.8). Of course I may be a mistaken fool.

IP forwarding is turned on.

This is what ipconfig /all returns on my Windows 7 client when connected to the VPN:

Windows IP Configuration

   Host Name . . . . . . . . . . . . : Virtue
   Primary Dns Suffix  . . . . . . . :
   Node Type . . . . . . . . . . . . : Hybrid
   IP Routing Enabled. . . . . . . . : No
   WINS Proxy Enabled. . . . . . . . : No
   DNS Suffix Search List. . . . . . : aber.ac.uk

Ethernet adapter Local Area Connection 2:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : TAP-Windows Adapter V9
   Physical Address. . . . . . . . . : 00-FF-07-DE-56-A1
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   Link-local IPv6 Address . . . . . : fe80::a8a1:3323:fc89:dfda%25(Preferred)
   IPv4 Address. . . . . . . . . . . : 10.8.0.10(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.252
   Lease Obtained. . . . . . . . . . : 23 October 2013 17:44:52
   Lease Expires . . . . . . . . . . : 23 October 2014 17:44:51
   Default Gateway . . . . . . . . . :
   DHCP Server . . . . . . . . . . . : 10.8.0.9
   DHCPv6 IAID . . . . . . . . . . . : 251723527
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-18-38-73-CC-00-1D-60-57-CD-C8
   DNS Servers . . . . . . . . . . . : 10.8.0.1
   NetBIOS over Tcpip. . . . . . . . : Enabled

And this is the response I get when using nslookup with the DNS push:

> nslookup www.google.co.uk
DNS request timed out.
    timeout was 2 seconds.
Server:  UnKnown
Address:  10.8.0.1

and without that:

> nslookup www.google.co.uk
Server:  dns2.aber.ac.uk
Address:  144.124.16.12

*** dns2.aber.ac.uk can't find www.google.co.uk: Query refused

Although there was over a year's gap in between now and the last time I had this working, previously the DNS wasn't an issue and I could apparently just use the university supplied one.

I don't know how DNS works in the context of OpenVPN but if it is a case of the client attempting to contact a different nameserver through port 53 it's going to fail. Port 53 is blocked on the network for anything other than the university supplied nameservers, which, as we see, refuse to answer DNS queries while I am tunnelling through my VPN. This may be completely irrelevant and I have done something wrong but I figure it's worth stating again in a clearer manner than I attempted before, just in case.

Also, apologies, but I don't understand what this means:

You will probably have to add a static route to your lan router for the return path to your VPN !

Thanks.

thedukeoffail

debbie10t wroteIs your ubuntu server also your home LAN router or do you have an ISP supplied router ?

My Ubuntu server is a VPS hosted by DigitalOcean. My client is on the university network so I have no control over any part of it (which is exactly why I want to be able to tunnel out of it).

thedukeoffail

debbie10t wrote
thedukeoffail wroteWell, I have added the following lines to my server config:
push "dhcp-option DNS 10.8.0.1"
change this to 8.8.8.8 (google) provided your VPS server has access to it. The address you have currently set is your VPS server which is not a DNS server.

Oh. I really should have thought of this. The guide I was following used dnsmasq to forward DNS through the server. It never occurred to me to ignore that step and just set it to Google's directly. I feel a bit daft now.

That was the only problem and now the VPN works exactly as it should!

Thanks a lot and apologies for probably coming across as a bit dense.