[deleted]
Hi
We have been using OpenVPN for a while and we like it. We are going through a network change and we are having problems using the new DNS server. We see packets go into as0t0 device but they do not leave the ethX device to the network.
Our old DNS is 1.1.1.1
New DNS is 2.2.2.2
This is what the AS0_DNS table shows now:
-A AS0_DNS -d 1.1.1.1/32 -j ACCEPT
-A AS0_DNS -j DROP
I have added the new DNS to the VPN Settings page, so now we have:
1.1.1.1 and 2.2.2.2
But the AS0_DNS table does not change and stays:
-A AS0_DNS -d 1.1.1.1/32 -j ACCEPT
-A AS0_DNS -j DROP
If I manually add the following entry ABOVE the DROP line:
-A AS0_DNS -d 2.2.2.2/32 -j ACCEPT
Then everything works. But anytime I push a new change tot he server (ie. change my group), the table gets reverted to:
-A AS0_DNS -d 1.1.1.1/32 -j ACCEPT
-A AS0_DNS -j DROP
And blocks access to the new DNS server.
So, which option in OpenVPN controls the "AS0_DNS" table? Is it possible OpenVPN just bugged out and lost track of some of the iptable rules causing them not to be added? Why are my VPN changes such as changing groups causing IPTables to revert?
I am starting to think we need to reinstall from scratch.
Also were using OpenVPN Access Server 1.8.4 .. Thanks.
[deleted]
Found my answer.. I believe I have found a bug in OpenVPN access server.
So under VPN Settings -> Routing - Should VPN clients have access to private subnets (non-public networks on the server side)?
We had this set to "Yes, routing (advanced) with the network 192.168.50.0/24
Meaning anyone logged into the VPN could hit that network on any port any protocol.
Our DNS is 192.168.50.25
It seems as though if you try to set a DNS server in "VPN Settings -> DNS" that is in the same zone as "VPN Server -> Routing" it bugs out.
My theory is that since there is already have an ALLOW ALL rule to that entire subnet, it assumes it does not need to add an explicit rule to allow port 53/udp to DNS in that subnet.
But when that DNS request DOES come, it matches the DROP table and get's blocked.
I think OpenVPN _should_ in fact place an entry for allow in AS0_DNS even if the network is already explicitly allowed through VPN Settings -> Routing.
Maybe this will help understand better:
-A AS0_DNS -d 192.168.75.25/32 -j ACCEPT
-A AS0_DNS -j DROP
-A AS0_IN_PRE -p tcp -m state --state NEW -m tcp --dport 53 -j AS0_DNS
-A AS0_IN_PRE -p udp -m state --state NEW -m udp --dport 53 -j AS0_DNS
I send a request to 192.168.50.25 over 53/udp. When arriving at as0t0, the packet get's checked against the AS0_IN_PRE table because it is udp port 53...Which then get's told to check against the AS0_DNS table. Which does not have that IP and therefore dropped.
Damn I am good!
