Goal: Share internet through VPN to Android clients without DNS leaking. Information: [list][*]First time OpenVPN setup. [*]Server: Unbuntu Server 14.10 running under VirtualBox in Windows 8.1 [*]All testing being done on Android client using OpenVPN for Android. (Also tried official client.) [*]VPN connects and IP traffic is tunneled through VPN, confirmed by IP test. [*]DNS leaking confirmed with tests at dnsleaktest.com: When on LTE, DNS reports carrier DNS. When on Wifi, DNS reports cable provider DNS. [*]Cannot use push "dhcp-option DNS 10.8.0.1" option because Android does not support it. When enabled, all DNS lookups fail on Android. [*]Installed Bind and configured caching server hoping to resolve it. Bind confirms lookup when run on server @10.8.0.1. [*]When OpenVPN for Android configured to override DNS Settings by Server with DNS server set to: 10.8.0.1, all DNS lookups fail. IP access continues to work (ping test).[/list] Notes: Everything is working apart from the DNS leaking. I can't find any good information that shows how one is supposed to get DNS queries to be resolved by the server. Any help in concept or code would be very much appreciated! [code]/etc/openvpn/server.conf mode server tls-server port 443 proto tcp dev tun ca ca.crt cert server.crt key server.key dh dh2048.pem server 10.8.0.0 255.255.255.0 ifconfig-pool-persist ipp.txt push "redirect-gateway def1 bypass-dhcp" keepalive 10 120 tls-auth ta.key 0 cipher BF-CBC comp-lzo max-clients 5 user nobody group nogroup persist-key persist-tun status openvpn-status.log log openvpn.log verb 5[/code] /etc/network/interfaces: [code]auto lo iface lo inet loopback auto eth0 iface eth0 inet dhcp[/code] iptables: [code]# Generated by iptables-save v1.4.21 on Mon Feb 2 06:50:49 2015 *nat :PREROUTING ACCEPT [4658:265385] :INPUT ACCEPT [375:24085] :OUTPUT ACCEPT [139:8815] :POSTROUTING ACCEPT [231:14747] -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE COMMIT # Completed on Mon Feb 2 06:50:49 2015 # Generated by iptables-save v1.4.21 on Mon Feb 2 06:50:49 2015 *filter :INPUT ACCEPT [47637:14640806] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [44012:24834904] -A INPUT -i tun+ -j ACCEPT -A INPUT -i tap+ -j ACCEPT -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT -A FORWARD -s 10.8.0.0/24 -j ACCEPT -A FORWARD -j REJECT --reject-with icmp-port-unreachable -A FORWARD -i tun+ -j ACCEPT -A FORWARD -i tap+ -j ACCEPT COMMIT[/code] IP forwarding enabled: [code]net.ipv4.ip_forward = 1[/code] /etc/bind/named.conf.options: [code]options { directory "/var/cache/bind"; forwarders { 8.8.8.8; 8.8.4.4; }; dnssec-validation auto; auth-nxdomain no; # conform to RFC1035 listen-on-v6 { any; }; };[/code] Running the command "nslookup google.com 10.8.0.1" on the server: [code]Server: 10.8.0.1 Address: 10.8.0.1#53 Non-authoritative answer: Name: google.com Address: 74.125.239.34 Name: google.com Address: 74.125.239.36 Name: google.com Address: 74.125.239.33 Name: google.com Address: 74.125.239.37 Name: google.com Address: 74.125.239.39 Name: google.com Address: 74.125.239.40 Name: google.com Address: 74.125.239.35 Name: google.com Address: 74.125.239.41 Name: google.com Address: 74.125.239.38 Name: google.com Address: 74.125.239.46 Name: google.com Address: 74.125.239.32[/code]

[quote="Guavaman"]Sorry I can't edit my post because my account is too new to mark it solved.[/quote]Sorry that edits are banned .. thank the spam monkeys. [quote="Guavaman"]Anway, I solved it![/quote]thanks very much for returning your solution .. you fixed it before we had a chance to help :D Just to let you know: [list]NOTE: your local LAN uses the extremely common subnet address [b]192.168.0.x or 192.168.1.x[/b]. Be aware that this might create [b]routing conflicts[/b] if you connect to the VPN server from public locations such as internet cafes [b]that use the same subnet[/b].[/list]

Configuring server to eliminate DNS leak for Android client

Guavaman

Goal: Share internet through VPN to Android clients without DNS leaking.

Information:

First time OpenVPN setup.
Server: Unbuntu Server 14.10 running under VirtualBox in Windows 8.1
All testing being done on Android client using OpenVPN for Android. (Also tried official client.)
VPN connects and IP traffic is tunneled through VPN, confirmed by IP test.
DNS leaking confirmed with tests at dnsleaktest.com: When on LTE, DNS reports carrier DNS. When on Wifi, DNS reports cable provider DNS.
Cannot use push "dhcp-option DNS 10.8.0.1" option because Android does not support it. When enabled, all DNS lookups fail on Android.
Installed Bind and configured caching server hoping to resolve it. Bind confirms lookup when run on server @10.8.0.1.
When OpenVPN for Android configured to override DNS Settings by Server with DNS server set to: 10.8.0.1, all DNS lookups fail. IP access continues to work (ping test).

Notes:
Everything is working apart from the DNS leaking. I can't find any good information that shows how one is supposed to get DNS queries to be resolved by the server. Any help in concept or code would be very much appreciated!

/etc/openvpn/server.conf
mode server
tls-server
port 443
proto tcp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
keepalive 10 120
tls-auth ta.key 0
cipher BF-CBC
comp-lzo
max-clients 5
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
log openvpn.log
verb 5

/etc/network/interfaces:

auto lo
iface lo inet loopback
auto eth0
iface eth0 inet dhcp

iptables:

# Generated by iptables-save v1.4.21 on Mon Feb  2 06:50:49 2015
*nat
:PREROUTING ACCEPT [4658:265385]
:INPUT ACCEPT [375:24085]
:OUTPUT ACCEPT [139:8815]
:POSTROUTING ACCEPT [231:14747]
-A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
COMMIT
# Completed on Mon Feb  2 06:50:49 2015
# Generated by iptables-save v1.4.21 on Mon Feb  2 06:50:49 2015
*filter
:INPUT ACCEPT [47637:14640806]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [44012:24834904]
-A INPUT -i tun+ -j ACCEPT
-A INPUT -i tap+ -j ACCEPT
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s 10.8.0.0/24 -j ACCEPT
-A FORWARD -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -i tun+ -j ACCEPT
-A FORWARD -i tap+ -j ACCEPT
COMMIT

IP forwarding enabled:

net.ipv4.ip_forward = 1

/etc/bind/named.conf.options:

options {
	directory "/var/cache/bind";
	forwarders {
		8.8.8.8;
		8.8.4.4;
	};
	dnssec-validation auto;
	auth-nxdomain no;    # conform to RFC1035
	listen-on-v6 { any; };
};

Running the command "nslookup google.com 10.8.0.1" on the server:

Server:		10.8.0.1
Address:	10.8.0.1#53

Non-authoritative answer:
Name:	google.com
Address: 74.125.239.34
Name:	google.com
Address: 74.125.239.36
Name:	google.com
Address: 74.125.239.33
Name:	google.com
Address: 74.125.239.37
Name:	google.com
Address: 74.125.239.39
Name:	google.com
Address: 74.125.239.40
Name:	google.com
Address: 74.125.239.35
Name:	google.com
Address: 74.125.239.41
Name:	google.com
Address: 74.125.239.38
Name:	google.com
Address: 74.125.239.46
Name:	google.com
Address: 74.125.239.32

Guavaman

Sorry I can't edit my post because my account is too new to mark it solved. Anway, I solved it!

The answer is to add this to the server.conf:

push "route 192.168.0.1 255.255.255.0"
push "dhcp-option DNS 192.168.0.1"

"192.168.0.1" being the IP address of the physical router.

I can't say why it wouldn't be able to get the DNS info from Bind at 10.8.0.1.

dnsleaktest.com shows no leaks on 4G or WiFi. Excellent! Now on to figuring out STunnel...

Also, I guess all the discussion I read about push "dhcp-option DNS x.x.x.x" not working on Android on Tun doesn't apply to the OpenVPN for Android app.

Traffic

Guavaman wroteSorry I can't edit my post because my account is too new to mark it solved.

Sorry that edits are banned .. thank the spam monkeys.

Guavaman wroteAnway, I solved it!

thanks very much for returning your solution ..

you fixed it before we had a chance to help 😃

Just to let you know:

NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.

Guavaman

Traffic wroteyou fixed it before we had a chance to help 😃

Just to let you know:
NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.

That's good advice. I had seen that mentioned but in the flood of data you have to sift through to get this set up for the first time some things just get lost in the mix. I'll be sure change my router's ip to something less common. Thanks!

It's not really relevant to this thread, but since I mentioned it above, I got OpenVPN working through sTunnel on Windows. Android is giving me a lot of problems though.

Guavaman

Just a followup to my previous post, I did end up finding the solution for OpenVPN over sTunnel Android. I posted the details here: https://forums.openvpn.net/topic18110.html

Hope it helps someone.

Thanks everyone in the community for this great tool and for all the invaluable information on this forum!