Nizhpot
Goal: route all traffic from one LAN (192.168.0) machine behind firewall via VPN server far away to Internet
Version 1: push DNS to client:
push "redirect-gateway def1"
push "dhcp-option DNS 8.8.8.8"
client connects through tunnel to server:
tun0:
20:36:32.019564 IP 10.8.0.10.65013 > google-public-dns-a.google.com.domain: 24796+ A? mtalk.google.com. (34)
20:36:32.019868 IP 10.8.0.10.60211 > google-public-dns-a.google.com.domain: 42341+ A? http://www.colorado.edu. (34)
but fails to get a response back and cannot resolve the names.
Route on XP client:
>route print
===========================================================================
Interface List
0x1 ........................... MS TCP Loopback interface
0x2 ...00 17 31 98 61 00 ...... NVIDIA nForce Networking Controller #2 - Packet
Scheduler Miniport
0x3 ...00 ff fc 3b 0b 13 ...... TAP-Windows Adapter V9 - Packet Scheduler Minipo
rt
===========================================================================
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 128.0.0.0 10.8.0.9 10.8.0.10 1
0.0.0.0 0.0.0.0 192.168.0.1 192.168.0.43 10
10.8.0.1 255.255.255.255 10.8.0.9 10.8.0.10 1
10.8.0.8 255.255.255.252 10.8.0.10 10.8.0.10 30
10.8.0.10 255.255.255.255 127.0.0.1 127.0.0.1 30
10.255.255.255 255.255.255.255 10.8.0.10 10.8.0.10 30
50.198.117.180 255.255.255.255 192.168.0.1 192.168.0.43 1
127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1
128.0.0.0 128.0.0.0 10.8.0.9 10.8.0.10 1
192.168.0.0 255.255.255.0 192.168.0.43 192.168.0.43 10
192.168.0.43 255.255.255.255 127.0.0.1 127.0.0.1 10
192.168.0.255 255.255.255.255 192.168.0.43 192.168.0.43 10
224.0.0.0 240.0.0.0 10.8.0.10 10.8.0.10 30
224.0.0.0 240.0.0.0 192.168.0.43 192.168.0.43 10
255.255.255.255 255.255.255.255 10.8.0.10 10.8.0.10 1
255.255.255.255 255.255.255.255 192.168.0.43 192.168.0.43 1
Default Gateway: 10.8.0.9
===========================================================================
Persistent Routes:
None
Route on Linux Server:
# route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
default 50-198-117-182- 0.0.0.0 UG 0 0 0 eth0
10.8.0.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun0
10.8.0.2 * 255.255.255.255 UH 0 0 0 tun0
localnet * 255.255.255.248 U 0 0 0 eth0
192.168.0.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun0
------------------------------------
------------------------------------
Version 2:
push "redirect-gateway def1"
push "dhcp-option DNS 10.8.0.1"
tun0:
22:09:15.498594 IP 10.8.0.10.58421 > 10.8.0.1.domain: 39842+ A? talkx.l.google.com. (36)
22:09:15.498615 IP 10.8.0.1 > 10.8.0.10: ICMP 10.8.0.1 udp port domain unreachable, length 72
Server does not handle the request.
Howto says: "the VPN server will need handle them" - does the server need it's own DNS server?
How is this solved?
Thanks,
K
Server conf:
port 1194
proto udp
dev tun
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/SDL-VPN-001.crt
key /etc/openvpn/keys/SDL-VPN-001.key # This file should be kept secret
dh /etc/openvpn/keys/dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 75.75.76.76"
push "dhcp-option DNS 75.75.75.75"
client-config-dir ccd
route 192.168.0.0 255.255.255.0
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
log openvpn.log
verb 6
Client (WXP) conf:
client
dev tun
proto udp
remote 50.198.117.180 1194
resolv-retry infinite
nobind
persist-key
persist-tun
register-dns
ca ca.crt
cert cl-002-H.crt
key cl-002-H.key
ns-cert-type server
comp-lzo
verb 6
