Intranet DNS problems with windows client

Shadow128

Hello together,

I've a little problem with my OpenVPN Windows client and DNS.
I can ping to the Intranet-IP-Addresses without any problems, but I cannot ping/use the DNS-Names.
On my linux clients (Ubuntu and Android) with the same config it is working.

Attached the Server- and Client-Configs:

Server

port 1194
proto udp
dev tun
ca /etc/openvpn/ca.crt
cert /etc/openvpn/server.crt
key /etc/openvpn/server.key  # This file should be kept secret
dh /etc/openvpn/dh1024.pem

server 10.0.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 192.168.99.0 255.255.255.0"

client-config-dir clients_config
route 10.0.0.0 255.255.255.0
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 192.168.99.1"
client-to-client
keepalive 10 120
tls-auth static.key 0 # This file is secret
topology subnet

cipher AES-128-CBC   # AES
comp-lzo
max-clients 5
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
;log         openvpn.log
;log-append  openvpn.log
verb 4
;mute 20

Client

xxx.no-ip.biz

proto udp

dev tun

pull

tls-client
tls-auth static.key 1
ca home-ca.crt
cert home.crt
key home.key
ns-cert-type server
cipher AES-128-CBC

verb 3
mute 50
mssfix
tun-mtu 1500
comp-lzo
register-dns

Is there a parameter on my windows client missing?
Or is this a problem in the Windows OS?

Thanks for your help,
Shadow128

maikcat

please post client logs with verb 4,

are you running the client with admin rights?

which windows are you using?
which version of openvpn client?

Michael.

Shadow128

Sorry for the missing infos.

I use OpenVPN GUI v1.0.3 (OpenVPN 2.2.2) on a Windows 7 Ultimate 64bit (with admin rights).
The log with verb 4 is:

Mon Dec 23 14:26:39 2013 us=338000 Current Parameter Settings:
Mon Dec 23 14:26:39 2013 us=338000   config = 'home.ovpn'
Mon Dec 23 14:26:39 2013 us=338000   mode = 0
Mon Dec 23 14:26:39 2013 us=338000   show_ciphers = DISABLED
Mon Dec 23 14:26:39 2013 us=338000   show_digests = DISABLED
Mon Dec 23 14:26:39 2013 us=338000   show_engines = DISABLED
Mon Dec 23 14:26:39 2013 us=338000   genkey = DISABLED
Mon Dec 23 14:26:39 2013 us=338000   key_pass_file = '[UNDEF]'
Mon Dec 23 14:26:39 2013 us=338000   show_tls_ciphers = DISABLED
Mon Dec 23 14:26:39 2013 us=338000 Connection profiles [default]:
Mon Dec 23 14:26:39 2013 us=338000   proto = udp
Mon Dec 23 14:26:39 2013 us=338000   local = '[UNDEF]'
Mon Dec 23 14:26:39 2013 us=338000   local_port = 1194
Mon Dec 23 14:26:39 2013 us=338000   remote = 'xxx.no-ip.biz'
Mon Dec 23 14:26:39 2013 us=338000   remote_port = 1194
Mon Dec 23 14:26:39 2013 us=338000   remote_float = DISABLED
Mon Dec 23 14:26:39 2013 us=338000   bind_defined = DISABLED
Mon Dec 23 14:26:39 2013 us=338000   bind_local = ENABLED
Mon Dec 23 14:26:39 2013 us=338000   connect_retry_seconds = 5
Mon Dec 23 14:26:39 2013 us=338000   connect_timeout = 10
Mon Dec 23 14:26:39 2013 us=338000   connect_retry_max = 0
Mon Dec 23 14:26:39 2013 us=338000   socks_proxy_server = '[UNDEF]'
Mon Dec 23 14:26:39 2013 us=338000   socks_proxy_port = 0
Mon Dec 23 14:26:39 2013 us=338000   socks_proxy_retry = DISABLED
Mon Dec 23 14:26:39 2013 us=338000 Connection profiles END
Mon Dec 23 14:26:39 2013 us=338000   remote_random = DISABLED
Mon Dec 23 14:26:39 2013 us=338000   ipchange = '[UNDEF]'
Mon Dec 23 14:26:39 2013 us=338000   dev = 'tun'
Mon Dec 23 14:26:39 2013 us=338000   dev_type = '[UNDEF]'
Mon Dec 23 14:26:39 2013 us=338000   dev_node = '[UNDEF]'
Mon Dec 23 14:26:39 2013 us=338000   lladdr = '[UNDEF]'
Mon Dec 23 14:26:39 2013 us=338000   topology = 1
Mon Dec 23 14:26:39 2013 us=338000   tun_ipv6 = DISABLED
Mon Dec 23 14:26:39 2013 us=338000   ifconfig_local = '[UNDEF]'
Mon Dec 23 14:26:39 2013 us=338000   ifconfig_remote_netmask = '[UNDEF]'
Mon Dec 23 14:26:39 2013 us=338000   ifconfig_noexec = DISABLED
Mon Dec 23 14:26:39 2013 us=338000   ifconfig_nowarn = DISABLED
Mon Dec 23 14:26:39 2013 us=338000   shaper = 0
Mon Dec 23 14:26:39 2013 us=338000   tun_mtu = 1500
Mon Dec 23 14:26:39 2013 us=338000   tun_mtu_defined = ENABLED
Mon Dec 23 14:26:39 2013 us=338000   link_mtu = 1500
Mon Dec 23 14:26:39 2013 us=338000   link_mtu_defined = DISABLED
Mon Dec 23 14:26:39 2013 us=338000   tun_mtu_extra = 0
Mon Dec 23 14:26:39 2013 us=338000   tun_mtu_extra_defined = DISABLED
Mon Dec 23 14:26:39 2013 us=338000   fragment = 0
Mon Dec 23 14:26:39 2013 us=338000   mtu_discover_type = -1
Mon Dec 23 14:26:39 2013 us=338000   mtu_test = 0
Mon Dec 23 14:26:39 2013 us=338000   mlock = DISABLED
Mon Dec 23 14:26:39 2013 us=338000   keepalive_ping = 0
Mon Dec 23 14:26:39 2013 us=338000   keepalive_timeout = 0
Mon Dec 23 14:26:39 2013 us=338000 NOTE: --mute triggered...
Mon Dec 23 14:26:39 2013 us=338000 223 variation(s) on previous 50 message(s) suppressed by --mute
Mon Dec 23 14:26:39 2013 us=338000 OpenVPN 2.2.2 Win32-MSVC++ [SSL] [LZO2] [PKCS11] built on Dec 15 2011
Mon Dec 23 14:26:39 2013 us=338000 IMPORTANT: OpenVPN's default port number is now 1194, based on an official port number assignment by IANA.  OpenVPN 2.0-beta16 and earlier used 5000 as the default port.
Mon Dec 23 14:26:39 2013 us=338000 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Mon Dec 23 14:26:39 2013 us=494000 Control Channel Authentication: using 'static.key' as a OpenVPN static key file
Mon Dec 23 14:26:39 2013 us=494000 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Dec 23 14:26:39 2013 us=494000 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Dec 23 14:26:39 2013 us=494000 LZO compression initialized
Mon Dec 23 14:26:39 2013 us=494000 Control Channel MTU parms [ L:1558 D:166 EF:66 EB:0 ET:0 EL:0 ]
Mon Dec 23 14:26:39 2013 us=650000 Socket Buffers: R=[8192->8192] S=[8192->8192]
Mon Dec 23 14:26:42 2013 us=474000 Data Channel MTU parms [ L:1558 D:1450 EF:58 EB:135 ET:0 EL:0 AF:3/1 ]
Mon Dec 23 14:26:42 2013 us=474000 Local Options String: 'V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 1,cipher AES-128-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-client'
Mon Dec 23 14:26:42 2013 us=474000 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 0,cipher AES-128-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-server'
Mon Dec 23 14:26:42 2013 us=474000 Local Options hash (VER=V4): '272f1b58'
Mon Dec 23 14:26:42 2013 us=474000 Expected Remote Options hash (VER=V4): 'a2e63101'
Mon Dec 23 14:26:42 2013 us=474000 UDPv4 link local (bound): [undef]:1194
Mon Dec 23 14:26:42 2013 us=474000 UDPv4 link remote: xxx:1194
Mon Dec 23 14:26:42 2013 us=567000 TLS: Initial packet from xxx:1194, sid=646652e3 9faedcd8
Mon Dec 23 14:26:43 2013 us=160000 VERIFY OK: depth=1, /C=DE/ST=xxx/L=xxx/O=xxx/OU=changeme/CN=xxx-CA/name=changeme/emailAddress=xxx
Mon Dec 23 14:26:43 2013 us=160000 VERIFY OK: nsCertType=SERVER
Mon Dec 23 14:26:43 2013 us=160000 VERIFY OK: depth=0, /C=DE/ST=xxx/L=xxx/O=xxx/OU=changeme/CN=xxx/name=changeme/emailAddress=xxx
Mon Dec 23 14:26:44 2013 us=205000 Data Channel Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Mon Dec 23 14:26:44 2013 us=205000 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Dec 23 14:26:44 2013 us=205000 Data Channel Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Mon Dec 23 14:26:44 2013 us=205000 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Dec 23 14:26:44 2013 us=205000 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Mon Dec 23 14:26:44 2013 us=205000 [VPN-Server] Peer Connection Initiated with xxx:1194
Mon Dec 23 14:26:46 2013 us=717000 SENT CONTROL [VPN-Server]: 'PUSH_REQUEST' (status=1)
Mon Dec 23 14:26:46 2013 us=982000 PUSH: Received control message: 'PUSH_REPLY,route 192.168.99.0 255.255.255.0,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 192.168.99.1,route-gateway 10.0.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.0.0.6 255.255.255.0'
Mon Dec 23 14:26:46 2013 us=982000 OPTIONS IMPORT: timers and/or timeouts modified
Mon Dec 23 14:26:46 2013 us=982000 OPTIONS IMPORT: --ifconfig/up options modified
Mon Dec 23 14:26:46 2013 us=982000 OPTIONS IMPORT: route options modified
Mon Dec 23 14:26:46 2013 us=982000 OPTIONS IMPORT: route-related options modified
Mon Dec 23 14:26:46 2013 us=982000 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Mon Dec 23 14:26:47 2013 us=13000 ROUTE default_gateway=192.168.43.1
Mon Dec 23 14:26:47 2013 us=29000 TAP-WIN32 device [OpenVPN] opened: \\.\Global\{36AFF527-AC4F-4BA2-B880-319E2F7204A8}.tap
Mon Dec 23 14:26:47 2013 us=29000 TAP-Win32 Driver Version 9.9 
Mon Dec 23 14:26:47 2013 us=29000 TAP-Win32 MTU=1500
Mon Dec 23 14:26:47 2013 us=29000 Set TAP-Win32 TUN subnet mode network/local/netmask = 10.0.0.0/10.0.0.6/255.255.255.0 [SUCCEEDED]
Mon Dec 23 14:26:47 2013 us=29000 Notified TAP-Win32 driver to set a DHCP IP/netmask of 10.0.0.6/255.255.255.0 on interface {36AFF527-AC4F-4BA2-B880-319E2F7204A8} [DHCP-serv: 10.0.0.254, lease-time: 31536000]
Mon Dec 23 14:26:47 2013 us=29000 DHCP option string: 0604c0a8 6301
Mon Dec 23 14:26:47 2013 us=29000 Successful ARP Flush on interface [13] {36AFF527-AC4F-4BA2-B880-319E2F7204A8}
Mon Dec 23 14:26:52 2013 us=146000 TEST ROUTES: 2/2 succeeded len=1 ret=1 a=0 u/d=up
Mon Dec 23 14:26:52 2013 us=146000 C:\WINDOWS\system32\route.exe ADD xxx MASK 255.255.255.255 192.168.43.1
Mon Dec 23 14:26:52 2013 us=146000 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=9 and dwForwardType=4
Mon Dec 23 14:26:52 2013 us=146000 Route addition via IPAPI succeeded [adaptive]
Mon Dec 23 14:26:52 2013 us=146000 C:\WINDOWS\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.0.0.1
Mon Dec 23 14:26:52 2013 us=162000 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Mon Dec 23 14:26:52 2013 us=162000 Route addition via IPAPI succeeded [adaptive]
Mon Dec 23 14:26:52 2013 us=162000 C:\WINDOWS\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 10.0.0.1
Mon Dec 23 14:26:52 2013 us=162000 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Mon Dec 23 14:26:52 2013 us=162000 Route addition via IPAPI succeeded [adaptive]
Mon Dec 23 14:26:52 2013 us=177000 C:\WINDOWS\system32\route.exe ADD 192.168.99.0 MASK 255.255.255.0 10.0.0.1
Mon Dec 23 14:26:52 2013 us=177000 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Mon Dec 23 14:26:52 2013 us=177000 Route addition via IPAPI succeeded [adaptive]
Mon Dec 23 14:26:52 2013 us=177000 Initialization Sequence Completed
Mon Dec 23 14:26:51 2013 Start net commands...
Mon Dec 23 14:26:51 2013 C:\WINDOWS\system32\net.exe stop dnscache
DNS-Client wird beendet.
DNS-Client wurde erfolgreich beendet.
Mon Dec 23 14:26:53 2013 C:\WINDOWS\system32\net.exe start dnscache
DNS-Client wird gestartet.
DNS-Client wurde erfolgreich gestartet.
Mon Dec 23 14:26:55 2013 C:\WINDOWS\system32\ipconfig.exe /flushdns
Windows-IP-Konfiguration
Der DNS-Aufl”sungscache wurde geleert.
Mon Dec 23 14:26:55 2013 C:\WINDOWS\system32\ipconfig.exe /registerdns
Windows-IP-Konfiguration
Die Registrierung der DNS-Ressourceneintr„ge fr alle Adapter dieses Computer wurde initialisiert. Fehler werden in der Ereignisanzeige in 15 Minuten aufgefhrt.
Mon Dec 23 14:26:58 2013 End net commands...

maikcat

logs seems ok though... :S

after you connect if you open nslookup what do you see?

Michael.

Shadow128

Thx for your help!

First, I didn't worked with nslookup before, so I hope i did everything alright.

Background from my home-system.
Fritzbox is my Router (192.168.99.1) and dockstar (192.168.99.3) is a linux-server, where openvpn is running.

And here are the steps with nslookup (connected with openvpn to my home-network):

C:\Users\Dominik>nslookup
Standardserver:  FritzBox.metal.lan
Address:  192.168.99.1



C:\Users\Dominik>nslookup dockstar
Server:  FritzBox.metal.lan
Address:  192.168.99.1

Name:    dockstar
Address:  192.168.99.3


C:\Users\Dominik>nslookup 192.168.99.3
Server:  FritzBox.metal.lan
Address:  192.168.99.1

Name:    Dockstar.metal.lan
Address:  192.168.99.3



C:\Users\Dominik>nslookup fritzbox
Server:  FritzBox.metal.lan
Address:  192.168.99.1

Name:    fritzbox
Address:  192.168.99.1


C:\Users\Dominik>nslookup 192.168.99.1
Server:  FritzBox.metal.lan
Address:  192.168.99.1

Name:    FritzBox.metal.lan
Address:  192.168.99.1

What I am wondering. Sometimes the suffix "metal.lan" is missing?
Is there the problem?

maikcat

C:\Users\Dominik>nslookup
Standardserver: FritzBox.metal.lan
Address: 192.168.99.1

this shows that dns entry is passed correctly,

your FQDN used is *.metal.lan so no there is not a problem,

usually the resolver will add dns search options or your domainname used.

Michael.

Shadow128

Thx for your help.

Problem seems to be solved.
I added the option "push "dhcp-option DOMAIN metal.lan"" to my server config, and now it is working on my windows-client :-)