Hello,
This is my scenario:
I have an openvpn server on a debian box,
cat /etc/debian_version
7.6
uname -a
Linux vpnserver 3.2.0-4-amd64 #1 SMP Debian 3.2.60-1+deb7u3 x86_64 GNU/Linux
this is it's configuration :
port XXXX
proto udp
dev tun
# server ip
local XXXXXXXXX
management 127.0.0.1 25000
#certificates
ca /etc/openvpn/client-keys/ca.crt
cert /etc/openvpn/server-keys/serv.crt
key /etc/openvpn/server-keys/serv.key
dh /etc/openvpn/server-keys/dh1024.pem
server 10.8.0.0 255.255.0.0
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
push "explicit-exit-notify 3"
# client auth
auth-user-pass-verify /etc/openvpn/clientscripts/login.sh via-env
# dpd
keepalive 15 60
ping-timer-rem
inactive 21600
tls-auth /etc/openvpn/ta.key 0
cipher AES-256-CBC
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
# client connect-disconnect
script-security 3 system
client-connect /etc/openvpn/clientscripts/connect.sh
client-disconnect /etc/openvpn/clientscripts/disconnect.sh
# log status
status /etc/openvpn/log/serv.log
log-append /etc/openvpn/log/openvpn.log
verb 3
server version:
openvpn --version
OpenVPN 2.2.1 x86_64-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Jun 18 2013
Originally developed by James Yonan
Copyright (C) 2002-2010 OpenVPN Technologies, Inc. <
sales@openvpn.net>
$ ./configure --build=x86_64-linux-gnu --prefix=/usr --includedir=${prefix}/include --mandir=${prefix}/share/man --infodir=${prefix}/share/info --sysconfdir=/etc --localstatedir=/var --libexecdir=${prefix}/lib/openvpn --disable-maintainer-mode --disable-dependency-tracking CFLAGS=-g -O2 -fPIE -fstack-protector --param=ssp-buffer-size=4 -Wformat -Werror=format-security CPPFLAGS=-D_FORTIFY_SOURCE=2 CXXFLAGS=-g -O2 -fPIE -fstack-protector --param=ssp-buffer-size=4 -Wformat -Werror=format-security FFLAGS=-g -O2 LDFLAGS=-fPIE -pie -Wl,-z,relro -Wl,-z,now --enable-password-save --host=x86_64-linux-gnu --build=x86_64-linux-gnu --prefix=/usr --mandir=${prefix}/share/man --with-ifconfig-path=/sbin/ifconfig --with-route-path=/sbin/route
Compile time defines: ENABLE_CLIENT_SERVER ENABLE_DEBUG ENABLE_EUREPHIA ENABLE_FRAGMENT ENABLE_HTTP_PROXY ENABLE_MANAGEMENT ENABLE_MULTIHOME ENABLE_PASSWORD_SAVE ENABLE_PORT_SHARE ENABLE_SOCKS USE_CRYPTO USE_LIBDL USE_LZO USE_PF_INET6 USE_PKCS11 USE_SSL
this is the clientside config on windows 8 1 64 bit
client
dev tun
proto udp
remote XXXXXX XXXX
resolv-retry infinite
nobind
explicit-exit-notify 3
persist-key
persist-tun
<ca>
XXXXXXXXX
</ca>
<cert>
XXXXXXXXX
</cert>
<key>
XXXXXXXX
</key>
remote-cert-tls server
auth-user-pass
tls-auth ta.key 1
<tls-auth>
XXXXXXXXXXX
</tls-auth>
cipher AES-256-CBC
comp-lzo
verb 3
using openvpn gui v5
the problem is, if i run a tcpdump on the client's router, filtering traffic like this :
tcpdump -i <ETH_TO_CLIENT> ip src <CLIENT_LAN_IP> and ip dst not <OPENVPN_IP> -nn and tcp port not <ROUTER'S_SSH>
i see stuff like
14:17:45.839252 IP CLIENT.64213 > ROUTER_IP.53: 5186+ A? forums.openvpn.net. (36)
14:18:00.157993 IP CLIENT.56616 > ROUTER_IP.53: 12014+ A? pr.comet.yahoo.com. (36)
14:20:12.874678 IP CLIENT.53480 > ROUTER_IP.53: 46800+ A? pr.comet.yahoo.com. (36)
14:20:47.824962 IP CLIENT.49543 > ROUTER_IP.53: 27533+ A? notepad-plus-plus.org. (39)
14:22:26.675582 IP CLIENT.55638 > ROUTER_IP.53: 37513+ A? pr.comet.yahoo.com. (36)
14:23:43.076700 IP CLIENT.64431 > ROUTER_IP.53: 42578+ A? csi.gstatic.com. (33)
the router runs a caching bind.
also, some p2p traffic also bypasses vpn but it would be a pointless and pretty huge paste.
now, if i do a nslookup from the client this is what i get _it behaves correctly_
C:\Users\client>nslookup google.com
Server: google-public-dns-a.google.com
Address: 8.8.8.8
Non-authoritative answer:
Name: google.com
Addresses: 2a00:1450:4001:809::1005
173.194.113.34
[...]
So it's using openvpn pushed DNS settings, that is the first DNS address 8.8.8.8
Of course, when i do nslookup from the client, tcpdump shows nothing.
If i start a torrent client, a chrome/firefox/internet explorer browser, i start seeing dns queries bypassing the vpn.
How can i solve this problem, as i want absolutely everything non-local to go through openvpn ?
Also, i'm thinking that because my local router and client are on the same network and because i have my router also running a bind caching server it's possible my client queries the local dns server on the router rather than openvpn pushed ones because of priority.
This is how my routing tables look on the client :
IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 ROUTER CLIENT 20
0.0.0.0 128.0.0.0 10.8.0.5 10.8.0.6 30
10.8.0.1 255.255.255.255 10.8.0.5 10.8.0.6 30
10.8.0.4 255.255.255.252 On-link 10.8.0.6 286
10.8.0.6 255.255.255.255 On-link 10.8.0.6 286
10.8.0.7 255.255.255.255 On-link 10.8.0.6 286
OPENVPN 255.255.255.255 ROUTER CLIENT 20
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
128.0.0.0 128.0.0.0 10.8.0.5 10.8.0.6 30
192.168.0.0 255.255.255.0 On-link CLIENT 276
ROUTER 255.255.255.255 ROUTER CLIENT 20
CLIENT 255.255.255.255 On-link CLIENT 276
192.168.0.255 255.255.255.255 On-link CLIENT 276
192.168.56.0 255.255.255.0 On-link 192.168.56.1 276
192.168.56.1 255.255.255.255 On-link 192.168.56.1 276
192.168.56.255 255.255.255.255 On-link 192.168.56.1 276
192.168.205.0 255.255.255.0 On-link 192.168.205.1 276
192.168.205.1 255.255.255.255 On-link 192.168.205.1 276
192.168.205.255 255.255.255.255 On-link 192.168.205.1 276
192.168.226.0 255.255.255.0 On-link 192.168.226.1 276
192.168.226.1 255.255.255.255 On-link 192.168.226.1 276
192.168.226.255 255.255.255.255 On-link 192.168.226.1 276
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 192.168.56.1 276
224.0.0.0 240.0.0.0 On-link 192.168.226.1 276
224.0.0.0 240.0.0.0 On-link 192.168.205.1 276
224.0.0.0 240.0.0.0 On-link CLIENT 276
224.0.0.0 240.0.0.0 On-link 10.8.0.6 286
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 192.168.56.1 276
255.255.255.255 255.255.255.255 On-link 192.168.226.1 276
255.255.255.255 255.255.255.255 On-link 192.168.205.1 276
255.255.255.255 255.255.255.255 On-link CLIENT 276
255.255.255.255 255.255.255.255 On-link 10.8.0.6 286
the *weird* 192.168 entries are virtualbox and vmware related.
