[Solved]DNS lookup issue from client

kmizole

Hi,

Before posting this, i searched a long time and tried many solutions. But none worked. Maybe I'm missing or not understanding something.

Here is my server.conf :

# Serveur TCP/9999
mode server
proto tcp
port 9999
dev tun
# Cles et certificats
ca ca.crt
cert server.crt
key server.key
dh dh1024.pem
tls-auth ta.key 1
key-direction 0
cipher AES-256-CBC
# Reseau
server 10.8.0.0 255.255.255.0
push "redirect-gateway def1"
push "dhcp-option DNS 10.8.0.1"
#push "route 10.8.0.0 255.255.255.0"
keepalive 10 120
# Securite
user nobody
group nogroup
chroot /etc/openvpn/jail
persist-key
persist-tun
comp-lzo
# Log
verb 3
mute 20
status openvpn-status.log
log-append /var/log/openvpn.log

Here is my client config :

# Client
client
dev tun
proto tcp-client
remote x.x.x.x 9999
resolv-retry infinite
cipher AES-256-CBC
; client-config-dir ccd
# Cles
ca ca.crt
cert laptopwork.crt
key laptopwork.key
tls-auth ta.key 1
key-direction 1
# Securite
nobind
persist-key
persist-tun
comp-lzo
verb 3

The tunnel mount up successfully, but nothing works because of DNS resolution.

I tried to capture some DNS events :

root@srv:/etc/openvpn# tcpdump -vvv -i tun0 -n port 53
tcpdump: listening on tun0, link-type RAW (Raw IP), capture size 65535 bytes
09:42:34.424559 IP (tos 0x0, ttl 128, id 7881, offset 0, flags [none], proto UDP (17), length 61)
10.8.0.6.65060 > 10.8.0.1.53: [udp sum ok] 56687+ A? http://www.windguru.cz. (33)

as you can see the request arrives in good shape. but i can't see any reply... But i still get no page on my browser.
(the same tcpdump on localhost shows no incoming request. but i make a local dig, the request shows up in tcpdump).

my network config on client :

Carte Ethernet Connexion au réseau local 3 :

Suffixe DNS propre à la connexion. . . : mydomain.fr (i changed it).
Description. . . . . . . . . . . . . . : TAP-Windows Adapter V9
Adresse physique . . . . . . . . . . . : 00-FF-9C-04-B6-A5
DHCP activé. . . . . . . . . . . . . . : Oui
Configuration automatique activée. . . : Oui
Adresse IPv4. . . . . . . . . . . . . .: 10.8.0.6(préféré)
Masque de sous-réseau. . . . . . . . . : 255.255.255.252
Bail obtenu. . . . . . . . . . . . . . : jeudi 19 mars 2015 09:43:32
Bail expirant. . . . . . . . . . . . . : vendredi 18 mars 2016 09:43:32
Passerelle par défaut. . . . . . . . . :
Serveur DHCP . . . . . . . . . . . . . : 10.8.0.5
Serveurs DNS. . . . . . . . . . . . . : 10.8.0.1
NetBIOS sur Tcpip. . . . . . . . . . . : Activé

To conclude, my bind service is up and running, resolving succesfully on localhost.
I have the forwarders configured in bind config matching the resolv.conf file.
I have ip_forward enabled for ipv4.

I have absolutely no clue on what's going wrong.

Thanks in advance for help (and sorry if my english is not so good 😉).

maikcat

step by step approach..

1)if you use nslookup from your client to query your dns , does it responds? if yes does resolves addresses correctly?
2)post your NAT rules used on your server
3)a traceroute 8.8.8.8 from your client what it shows?
4)can you ping 10.8.0.1 from your client?

Michael.

kmizole

Hi Michael,

1] nslookup :

C:\Users\user>nslookup
DNS request timed out.
timeout was 2 seconds.
Serveur par dÚfaut : UnKnown
Address: 10.8.0.1

> www.google.fr
Serveur : UnKnown
Address: 10.8.0.1

DNS request timed out.
timeout was 2 seconds.
*** UnKnown ne parvient pas à trouver www.google.fr : No response from server
>

2] iptables is disabled :

root@srv:~# iptables -L -v -n -t nat
Chain PREROUTING (policy ACCEPT 3128K packets, 128M bytes)
pkts bytes target prot opt in out source destination

Chain INPUT (policy ACCEPT 3123K packets, 127M bytes)
pkts bytes target prot opt in out source destination

Chain OUTPUT (policy ACCEPT 1587K packets, 287M bytes)
pkts bytes target prot opt in out source destination

Chain POSTROUTING (policy ACCEPT 1592K packets, 288M bytes)
pkts bytes target prot opt in out source destination

3] traceroute :

C:\Users\user>tracert 8.8.8.8

Détermination de l'itinéraire vers 8.8.8.8 avec un maximum de 30 sauts.

1 18 ms * 18 ms 10.8.0.1
2 * * * Délai d'attente de la demande dépassé.
3 * * * Délai d'attente de la demande dépassé.
4 * * * Délai d'attente de la demande dépassé.
5 * * * Délai d'attente de la demande dépassé.
6 * * * Délai d'attente de la demande dépassé.
7 * * * Délai d'attente de la demande dépassé.
8 * * * Délai d'attente de la demande dépassé.
9 * * * Délai d'attente de la demande dépassé.
10 * * * Délai d'attente de la demande dépassé.
11 * * * Délai d'attente de la demande dépassé.
12 * * * Délai d'attente de la demande dépassé.
13 * * * Délai d'attente de la demande dépassé.
14 * * * Délai d'attente de la demande dépassé.
15 * * * Délai d'attente de la demande dépassé.
16 * * ^C

4] ping succesful.

C:\Users\user>ping 10.8.0.1

Envoi d'une requête 'Ping' 10.8.0.1 avec 32 octets de données :
Réponse de 10.8.0.1 : octets=32 temps=18 ms TTL=64
Réponse de 10.8.0.1 : octets=32 temps=17 ms TTL=64
Réponse de 10.8.0.1 : octets=32 temps=17 ms TTL=64
Réponse de 10.8.0.1 : octets=32 temps=18 ms TTL=64

Statistiques Ping pour 10.8.0.1:
Paquets : envoyés = 4, reçus = 4, perdus = 0 (perte 0%),
Durée approximative des boucles en millisecondes :
Minimum = 17ms, Maximum = 18ms, Moyenne = 17ms

maikcat

sum up,

your bind does NOT responding...

To conclude, my bind service is up and running, resolving succesfully on localhost.

did you configure bind to listen to 0.0.0.0?

redirecting traffic via your vpn servers means that you have to perform NAT on vpn clients,
because of this you have to choices:
1)perform NAT on openvpn server itself to packets coming from your clients or
2)perform NAT on both networks on your openvpn servers internet router.

Michael.

kmizole

Indeed, i missed that obvious listen point...
I corrected it and listening now on 0.0.0.0.

Regarding the NAT stuff, i'm not very comfortable with that.
I have only 1 server with eth0 which is my eternal interface. It's also the interface to which i connect.

If I'm correct i should set these rules (that's what i did) :
iptables -I FORWARD -i tun0 -j ACCEPT
iptables -I FORWARD -o tun0 -j ACCEPT
iptables -I OUTPUT -o tun0 -j ACCEPT
iptables -A FORWARD -i tun0 -o eth0 -j ACCEPT
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

now everything is working ok. (in fact, almost, i can't connect to my local bind but i can connect to google or other public dns, so it's acceptable).

Thank you very much for helping.

maikcat

please remove this:

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

now everything is working ok.

thats good to know 🙂

in fact, almost, i can't connect to my local bind but i can connect to google or other public dns, so it's acceptable

we could troubleshoot this if want 😉 but if you are ok i will mark as solved this thread and close it.

Michael.

kmizole

Thanks Michael,

You've been great help. You can close it.