OpenVPN 2.2.0 push DNS

Dees7

Hello!
I have a router with OpenVPN 2.2.0 server installed (old, i know).
Now I'm trying to cennect to it with android and iOS (the last versions are used).
All ok in general, but client doesn't resive DNS. As a result it doesn't work well.
I can ping anything, via IP but WEB doesn't work.

So i have following troubles:
1. Why is DNS not recived? Both Android and iOS have this trouble.
2. In case I dont use "ifconfig-pool" option - mobile client have no IP.
But if I use "ifconfig-pool 172.16.2.3 172.16.3.20" both Android and iOS have the same IP. Shell I use single server instance of each client?

Linux rt-n16 2.6.22.19 #3 Sun Dec 23 20:09:37 MSK 2012 mips GNU/Linux

OpenVPN 2.2.0 mipsel-linux [SSL] [LZO2] [EPOLL] [eurephia] built on Feb 18 2012
Originally developed by James Yonan
Copyright (C) 2002-2010 OpenVPN Technologies, Inc. <sales@openvpn.net>
  $ ./configure --build=i386-pc-linux-gnu --host=mipsel-linux --target=mipsel-linux --prefix=/opt --disable-nls --enable-password-save
Compile time defines:  ENABLE_CLIENT_SERVER ENABLE_DEBUG ENABLE_EUREPHIA ENABLE_FRAGMENT ENABLE_HTTP_PROXY ENABLE_MANAGEMENT ENABLE_MULTIHOME ENABLE_PASSWORD_SAVE ENABLE_PORT_SHARE ENABLE_SOCKS USE_CRYPTO USE_LIBDL USE_LZO USE_SSL

server.conf

mode server
port 1195
proto udp
dev tun0
ifconfig 172.16.3.1 172.16.3.2
ifconfig-pool 172.16.3.2 172.16.3.2
push "dhcp-option DNS 172.16.2.1"
keepalive 10 60
cipher AES-128-CBC
comp-lzo
persist-key
persist-tun
ca ca.crt
cert server.crt
key server.key
dh dh1024.pem
tls-server

client.conf

client
tls-client
dev tun
proto udp
keepalive 10 60
remote server 1195
resolv-retry infinite
key-direction 1
cipher AES-128-CBC
persist-tun
persist-key
comp-lzo
verb 3
redirect-gateway
<ca>
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
</ca>

Android.log

$ ip addr show
39: tun0: <POINTOPOINT,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 500
    link/none
    inet 172.16.3.2/30 scope global tun0

$ ip route
default via 192.168.0.1 dev wlan0
172.16.3.0/30 dev tun0  proto kernel  scope link  src 172.16.3.2
192.168.0.0/24 dev wlan0  scope link
192.168.0.0/24 dev wlan0  proto kernel  scope link  src 192.168.0.100
192.168.0.1 dev wlan0  scope link
(All traffic goes through OpenVPN, i'm sure.)

$ ping -c 4 172.16.2.1
PING 172.16.2.1 (172.16.2.1) 56(84) bytes of data.
64 bytes from 172.16.2.1: icmp_seq=1 ttl=64 time=30.5 ms
64 bytes from 172.16.2.1: icmp_seq=2 ttl=64 time=31.8 ms
64 bytes from 172.16.2.1: icmp_seq=3 ttl=64 time=31.8 ms
64 bytes from 172.16.2.1: icmp_seq=4 ttl=64 time=31.4 ms
--- 172.16.2.1 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3004ms
rtt min/avg/max/mdev = 30.537/31.429/31.874/0.555 ms

$ ping -c 4 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_seq=1 ttl=48 time=76.9 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=48 time=76.2 ms
64 bytes from 8.8.8.8: icmp_seq=3 ttl=48 time=76.3 ms
64 bytes from 8.8.8.8: icmp_seq=4 ttl=48 time=77.2 ms
--- 8.8.8.8 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3004ms
rtt min/avg/max/mdev = 76.291/76.711/77.290/0.411 ms

iOS.log

2014-11-09 16:31:23 ----- OpenVPN Start -----
OpenVPN core 3.0 ios armv7a thumb2 32-bit
2014-11-09 16:31:23 Keychain Cert Extraction: 1 certificate(s) found
2014-11-09 16:31:23 UNUSED OPTIONS
1 [tls-client]
4 [keepalive] [10] [60]
6 [resolv-retry] [infinite]
9 [persist-tun]
10 [persist-key]
12 [verb] [3]

2014-11-09 16:31:23 LZO-ASYM init swap=0 asym=0
2014-11-09 16:31:23 EVENT: RESOLVE
2014-11-09 16:31:24 Contacting3.2.2.1:1195 via UDP
2014-11-09 16:31:24 EVENT: WAIT
2014-11-09 16:31:24 SetTunnelSocket returned 0
2014-11-09 16:31:24 Connecting toserver:1195 (3.2.2.1) via UDPv4
2014-11-09 16:31:24 EVENT: CONNECTING
2014-11-09 16:31:24 Tunnel Options:V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 1,cipher AES-128-CBC,auth SHA1,keysize 128,key-method 2,tls-client
2014-11-09 16:31:24 Peer Info:
IV_GUI_VER=net.openvpn.connect.ios 1.0.5-177
IV_VER=3.0
IV_PLAT=ios
IV_NCP=1
IV_LZO=1

2014-11-09 16:31:24 VERIFY OK: depth=1
cert. version    : 3
serial number    : B0:72:16:79:85:AF:5A:F8
issuer name      : C=RU, ST=74, L=Chelyabinsk, O=server, OU=server, CN=server CA, emailAddress=dis@server.me
subject name      : C=RU, ST=74, L=Chelyabinsk, O=server, OU=server, CN=server CA, emailAddress=dis@server.me
issued  on        : 2014-03-08 06:30:17
expires on        : 2024-03-05 06:30:17
signed using      : RSA with SHA1
RSA key size      : 1024 bits
basic constraints : CA=true

2014-11-09 16:31:24 VERIFY OK: depth=0
cert. version    : 3
serial number    : 01
issuer name      : C=RU, ST=74, L=Chelyabinsk, O=server, OU=server, CN=server CA, emailAddress=dis@server.me
subject name      : C=RU, ST=74, L=Chelyabinsk, O=server, OU=server, CN=server, emailAddress=dis@server.me
issued  on        : 2014-03-08 06:31:15
expires on        : 2024-03-05 06:31:15
signed using      : RSA with SHA1
RSA key size      : 1024 bits
basic constraints : CA=false
subject alt name  : server
cert. type        : SSL Server
key usage        : Digital Signature, Key Encipherment
ext key usage    : TLS Web Server Authentication

2014-11-09 16:31:24 SSL Handshake: TLSv1.0/TLS-DHE-RSA-WITH-AES-256-CBC-SHA
2014-11-09 16:31:24 Session is ACTIVE
2014-11-09 16:31:24 EVENT: GET_CONFIG
2014-11-09 16:31:24 Sending PUSH_REQUEST to server...
2014-11-09 16:31:24 OPTIONS:
0 [redirect-gateway]
1 [dhcp-option] [DNS] [172.16.2.1]
2 [ping] [10]
3 [ping-restart] [60]
4 [ifconfig] [172.16.3.2] [172.16.3.1]

2014-11-09 16:31:24 LZO-ASYM init swap=0 asym=0
2014-11-09 16:31:24 EVENT: ASSIGN_IP
2014-11-09 16:31:24 Connected via tun
2014-11-09 16:31:24 EVENT: CONNECTED @server:1195 (3.2.2.1) via /UDPv4 on tun/172.16.3.2/
2014-11-09 16:31:24 SetStatus Connected
2014-11-09 16:31:24 NET Internet:NotReachable/-R tc---l-
2014-11-09 16:31:25 NET Internet:ReachableViaWiFi/-R t----l-

Traffic

Dees7 wroteserver.conf
Code:
<etc>

Your server config is not a server.

See --server in The Manual v23x

Dees7 wrote1. Why is DNS not recived? Both Android and iOS have this trouble.

Can you ping this device

Dees7 wrotepush "dhcp-option DNS 172.16.2.1"

when connected to your VPN from the client ?

Dees7

Traffic wroteYour server config is not a server.
See --server in The Manual v23x

Ok. I'll check. But i have v220 )

Traffic wroteCan you ping this device
Dees7 wrotepush "dhcp-option DNS 172.16.2.1"
when connected to your VPN from the client ?

Yes,I do. See log in the first message.
I've tryed push 8.8.8.8 - it works. It means DNS request goes not via tunnel =(

Traffic

Dees7 wroteOk. I'll check. But i have v220

V220 supports --server .. Also, you need to update this.

Dees7 wroteIt means DNS request goes not via tunnel

You need to use Server:

push "redirect gateway def1"

Dees7

Traffic wroteV220 supports --server .. Also, you need to update this.

unfortunatly I cant update the server.
But if i got it right (through this Openvpn22ManPage), my new config is:

mode server
tls-server
port 1195
proto udp
dev tun0
push "topology subnet"
ifconfig 172.16.3.1 255.255.255.0
ifconfig-pool 172.16.3.2 172.16.3.20 255.255.255.0
push "route-gateway 172.16.3.1"
push "dhcp-option DNS 172.16.2.1"
push "dhcp-option DOMAIN home.loc"
keepalive 10 60
cipher AES-128-CBC
comp-lzo
persist-key
persist-tun
ca ca.crt
cert server.crt
key server.key
dh dh1024.pem

There is in logs: "Options error: The third parameter to --ifconfig-pool (netmask) is only valid in --dev tap mode"
Why? it's from help:

if dev tap OR (dev tun AND topology == subnet):
  ifconfig 10.8.0.1 255.255.255.0
  if !nopool:
    ifconfig-pool 10.8.0.2 10.8.0.254 255.255.255.0
  push "route-gateway 10.8.0.1"

What wrong?

Traffic

Traffic wroteOk. I'll check. But i have v220
V220 supports --server

Use --server and --topology subnet in your server config.

Dees7

Oh. I undestand:

mode server
tls-server
port 1195
proto udp
dev tun0
topology subnet
push "topology subnet"
ifconfig 172.16.3.1 255.255.255.0
ifconfig-pool 172.16.3.2 172.16.3.20 255.255.255.0
push "route-gateway 172.16.3.1"
push "redirect-gateway def1"
push "dhcp-option DNS 172.16.2.1"
..

But DNS still goes via main WAN

Dees7

Traffic wroteV220 supports --server Use --server and --topology subnet in your server config.

Yes. Thank you. I've realized it by myself too =))
But my problems still here.
1. DNS doesn't go via OpenVPN
2. If i connect 2 clients, both Android and ios have the same IP (172.16.3.2) =(

Traffic

Please post full server and client logs at verb 4

Dees7

Traffic wrotePlease post full server and client logs at verb 4

https://dl.dropboxusercontent.com/u/4650425/OpenServer.txt
https://dl.dropboxusercontent.com/u/4650425/OpenClientIOS.txt

Traffic

Ypur logs look like they are doing the right thing:

Server:

Nov 9 22:52:01 rt-n16 openvpn[2921]: 3.2.2.2:36585 [client] Peer Connection Initiated with 3.2.2.2:36585
Nov 9 22:52:01 rt-n16 openvpn[2921]: client/3.2.2.2:36585 MULTI: Learn: 172.16.3.2 -> client/3.2.2.2:36585
Nov 9 22:52:01 rt-n16 openvpn[2921]: client/3.2.2.2:36585 MULTI: primary virtual IP for client/3.2.2.2:36585: 172.16.3.2
Nov 9 22:52:01 rt-n16 openvpn[2921]: client/3.2.2.2:36585 PUSH: Received control message: 'PUSH_REQUEST'
Nov 9 22:52:01 rt-n16 openvpn[2921]: client/3.2.2.2:36585 SENT CONTROL [client]: 'PUSH_REPLY,topology subnet,route-gateway 172.16.3.1,redirect-gateway def1,dhcp-option DNS 172.16.2.1,dhcp-option DOMAIN nemo.loc,ping 10,ping-restart 60,ifconfig 172.16.3.2 255.255.255.0' (status=1)

Client:

014-11-09 21:52:02 Session is ACTIVE
2014-11-09 21:52:02 EVENT: GET_CONFIG
2014-11-09 21:52:02 Sending PUSH_REQUEST to server...
2014-11-09 21:52:02 OPTIONS:
0 [redirect-gateway] [def1]
1 [topology] [subnet]
2 [route-gateway] [172.16.3.1]
3 [redirect-gateway] [def1] <- maybe you need to check something ... ?
4 [dhcp-option] [DNS] [172.16.2.1]
5 [dhcp-option] [DOMAIN] [nemo.loc]
6 [ping] [10]
7 [ping-restart] [60]
8 [ifconfig] [172.16.3.2] [255.255.255.0]

so .. can you ping 8.8.8.8 (google dns) by IP address over the VPN ?

If not:

Have you enabled IP Forwarding on your server ?
Have you enabled NAT on your server ?

Dees7

Traffic wroteso .. can you ping 8.8.8.8 (google dns) by IP address over the VPN ?

Yes I can. trace shows that all go via vpn. All but DNS.

1. 172.16.3.1; 41.732,  42.725,  42.697
2. [hide]
3. *
4. *
5. [hide]
6. *
7. 72.14.219.177; 50.502,  49.338,  49.205; AS15169
8. 66.249.94.94; 54.814, *; AS15169
8. 66.249.94.100; 49.501; AS15169
9. 209.85.240.116; 66.729,  61.681; AS15169
9. 64.233.174.85; 61.431; AS15169
10. 216.239.46.9; 63.811; AS15169
10. 216.239.48.234; 66.860; AS15169
10. 216.239.48.236; 60.856; AS15169
11. *
12. 8.8.8.8; 72.141,  69.038,  67.429; AS15169

Dees7

Traffic wrote 0 [redirect-gateway] [def1]
3 [redirect-gateway] [def1] <- maybe you need to check something ... ?

0 - fron client.ovpn
2 - from server.ovpn (push "...")
It's no matter if I delete the string from server config.

Traffic

Dees7 wroteTraffic wrote:
so .. can you ping 8.8.8.8 (google dns) by IP address over the VPN ?

Yes I can. trace shows that all go via vpn. All but DNS

It is possible that you need to update your resolver .. On linux that is done like so:

script-security 2
up /etc/openvpn/update-resolv-conf
down /etc/openvpn/update-resolv-conf

But I don't know what that will be for your clients . . . check for openvpn shared/example files.