alexseitsinger
Hi, really stumped so I decided to post for some help. I have a custom dual stack home LAN gateway using FreeBSD 10.0-RELEASE. I have a remote VPS with FreeBSD 10.0-RELEASE as well. I have OpenVPN running on the VPS but I have not been able to successfully route all my traffic through the VPN for all my home LAN. It seems that I can ping the IP of a location, but I cannot receive any DNS.
I have tried numerous variations of the configs, redone the keys certificates, and triple ensured that all forwarding was enabled on both systems, but, to no avail. I was able to use Tunnelblick in the past on my Macbook Pro to a remote VPN but now I want it for the whole network, instead of a single client.
DNS queries receive "Refused" when observing traffic via TCPDUMP on Tun0 on the VPS.
I managed to resolve this by adding iroute for my ISP's DNS for my router, which eliminated the Refusal, however, nothing is being received on my end.
I would prefer to make this work without having to set up a local DNS resolver /server because theres no reason I should not be able to route DNS traffic properly without it.
I am using PF on both ends with NAT on the external nic as follows:
nat on $_wan_nic inet from $_localnet -> $_self
I also have extra filters put in place that pass quick for each public ip endpoint as well as DNS and localnet
pass quick inet from $_peer
pass quick inet from $_dns
pass quick inet from $_localnet
localnet includes both my real lan 1.0.0.0/24 and 100.0.0.0/24 for the vpn subnet.
self is the public ip for each end respectively.
Any help/guidance to get this working is greatly appreciated.
**NOTE: I did manage to make this work at one point by changing a route settings on the server with vpn_gateway and some variation in the PF conf, but I changed it by accident and now I have been unable to get it working.**
Server
local x.x.x.x
port 1194
proto udp
dev tun
ca keys/ca.crt
cert keys/server.crt
key keys/server.key
dh keys/dh1024.pem
keepalive 10 120
comp-lzo
persist-key
persist-tun
log /var/log/openvpn_server.log
status /var/log/openvpn_server_status.log
verb 5
server 100.0.0.0 255.255.255.0
topology subnet
mode server
float
push "redirect-gateway" # using bypass-dhcp and bypass-dns do not help
;route-gateway 100.0.0.1
;push "route-gateway 100.0.0.1"
client-to-client
client-config-dir ccd/
route 1.0.0.0 255.255.255.0 vpn_gateway
push "route 1.0.0.0 255.255.255.0"
Client
client
remote x.x.x.x
port 1194
dev tun
proto udp
comp-lzo
keepalive 10 60
persist-tun
persist-key
nobind
ca keys/ca.crt
cert keys/client.crt
key keys/client.key
redirect-gateway #adding this to client config fixes the default gateway priority issue when only using push from server config
ccd "client"
ifconfig-push 100.0.0.2 255.255.255.0
iroute 1.0.0.0 255.255.255.0
iroute 75.75.75.75
iroute 75.75.75.76
alexseitsinger
I managed to figure the networking out after an excruciating amount of research and trial and error.
The solution was to add routes in the CLIENT conf which redirect the client's DNS servers thru the "net_gateway" combined with the "redirect-gateway def1 bypass-dhcp bypass-dns" on the server conf.
# tell our client to use our regular gateway for dns
route 75.75.75.75 255.255.255.255 net_gateway
route 75.75.75.76 255.255.255.255 net_gateway
