DNS Tunneling in Windows 8.1

przemek.wawa

PUSH: Received control message: 'PUSH_REPLY,route X.X.X.X 255.255.255.0,dhcp-option DNS Y.Y.Y.Y,redirect-gateway def1,route Z.Z.Z.Z 255.255.255.0,topology net30,ping 15,ping-restart 60,ifconfig A.A.A.A B.B.B.B'

On Windows 7 it works fine with the same configuration: DNS requests are tunneled over VPN.
On Mac OS I don't know yeat, but for some time I have an message, that Internet is not accessible after connection (but it is)

Traffic

What DNS servers does W81 client have while connected ?

przemek.wawa

Local DNS is used:)

przemek.wawa

local DNS, from local network.

Traffic

Please connect to your VPN and post details of ipconfig /all
(Open a command prompt (as administrator) type ipconfig /all)

przemek.wawa

Sorry for such delay, I was at home and had no access to my second computer with windows 8.1.
My ipconfig

Windows IP Configuration

   Host Name . . . . . . . . . . . . : hostname
   Primary Dns Suffix  . . . . . . . : 
   Node Type . . . . . . . . . . . . : Hybrid
   IP Routing Enabled. . . . . . . . : No
   WINS Proxy Enabled. . . . . . . . : No
   DNS Suffix Search List. . . . . . : company.name

Ethernet adapter TAP:

   Connection-specific DNS Suffix  . : 
   Description . . . . . . . . . . . : TAP-Windows Adapter V9
   Physical Address. . . . . . . . . : 00-FF-07-EE-38-07
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   Link-local IPv6 Address . . . . . : fe80::ec84:d045:818a:8037%10(Preferred) 
   IPv4 Address. . . . . . . . . . . : 10.8.0.10(Preferred) 
   Subnet Mask . . . . . . . . . . . : 255.255.255.252
   Lease Obtained. . . . . . . . . . : 30 marca 2015 11:50:27
   Lease Expires . . . . . . . . . . : 29 marca 2016 11:50:27
   Default Gateway . . . . . . . . . : 
   DHCP Server . . . . . . . . . . . : 10.8.0.9
   DHCPv6 IAID . . . . . . . . . . . : 167837447
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-1B-35-B6-DD-5C-26-0A-32-AF-A4
   DNS Servers . . . . . . . . . . . : 10.83.68.1
   NetBIOS over Tcpip. . . . . . . . : Enabled

Mobile Broadband adapter Mobile broadband:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . : 
   Description . . . . . . . . . . . : Dell Wireless 5540 HSPA Mini-Card Network Adapter
   Physical Address. . . . . . . . . : 02-80-37-EC-02-00
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes

Wireless LAN adapter Local Area Connection* 3:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . : 
   Description . . . . . . . . . . . : Microsoft Wi-Fi Direct Virtual Adapter
   Physical Address. . . . . . . . . : 00-24-D7-7F-5D-95
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes

Wireless LAN adapter Wi-Fi:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . : guest.company.name
   Description . . . . . . . . . . . : Intel(R) Centrino(R) Ultimate-N 6300 AGN
   Physical Address. . . . . . . . . : 00-24-D7-7F-5D-94
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes

Ethernet adapter Ethernet:

   Connection-specific DNS Suffix  . : company.name
   Description . . . . . . . . . . . : Intel(R) 82577LM Gigabit Network Connection
   Physical Address. . . . . . . . . : 5C-26-0A-32-AF-A4
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   Link-local IPv6 Address . . . . . : fe80::59a:95ff:cc28:6b3%3(Preferred) 
   IPv4 Address. . . . . . . . . . . : 10.255.0.143(Preferred) 
   Subnet Mask . . . . . . . . . . . : 255.0.0.0
   Lease Obtained. . . . . . . . . . : 23 marca 2015 17:13:17
   Lease Expires . . . . . . . . . . : 7 kwietnia 2015 11:50:13
   Default Gateway . . . . . . . . . : 10.0.0.1
   DHCP Server . . . . . . . . . . . : 10.0.0.199
   DHCPv6 IAID . . . . . . . . . . . : 56370698
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-1B-35-B6-DD-5C-26-0A-32-AF-A4
   DNS Servers . . . . . . . . . . . : 10.0.0.200
                                       10.0.0.199
   NetBIOS over Tcpip. . . . . . . . : Enabled

Ethernet adapter VMware Network Adapter VMnet1:

   Connection-specific DNS Suffix  . : 
   Description . . . . . . . . . . . : VMware Virtual Ethernet Adapter for VMnet1
   Physical Address. . . . . . . . . : 00-50-56-C0-00-01
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
   Link-local IPv6 Address . . . . . : fe80::c951:e2e:1055:dc05%24(Preferred) 
   IPv4 Address. . . . . . . . . . . : 192.168.126.1(Preferred) 
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 
   DHCPv6 IAID . . . . . . . . . . . : 419450966
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-1B-35-B6-DD-5C-26-0A-32-AF-A4
   DNS Servers . . . . . . . . . . . : fec0:0:0:ffff::1%1
                                       fec0:0:0:ffff::2%1
                                       fec0:0:0:ffff::3%1
   NetBIOS over Tcpip. . . . . . . . : Enabled

Ethernet adapter VMware Network Adapter VMnet8:

   Connection-specific DNS Suffix  . : 
   Description . . . . . . . . . . . : VMware Virtual Ethernet Adapter for VMnet8
   Physical Address. . . . . . . . . : 00-50-56-C0-00-08
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
   Link-local IPv6 Address . . . . . : fe80::b0db:bc97:9a07:6185%25(Preferred) 
   IPv4 Address. . . . . . . . . . . : 192.168.110.1(Preferred) 
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 
   DHCPv6 IAID . . . . . . . . . . . : 436228182
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-1B-35-B6-DD-5C-26-0A-32-AF-A4
   DNS Servers . . . . . . . . . . . : fec0:0:0:ffff::1%1
                                       fec0:0:0:ffff::2%1
                                       fec0:0:0:ffff::3%1
   NetBIOS over Tcpip. . . . . . . . : Enabled

Tunnel adapter isatap.{068E578B-49B2-4901-B1B0-3E181962875C}:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . : 
   Description . . . . . . . . . . . : Microsoft ISATAP Adapter #2
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes

Tunnel adapter isatap.company.name:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . : company.name
   Description . . . . . . . . . . . : Microsoft ISATAP Adapter #4
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes

Tunnel adapter isatap.{07EE3807-24EE-4EFC-81CA-5BD759381BDF}:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . : 
   Description . . . . . . . . . . . : Microsoft ISATAP Adapter #3
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Teredo Tunneling Pseudo-Interface:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . : 
   Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes

Tunnel adapter isatap.{95C0AD8C-7C6E-4002-8403-5859B1928EA8}:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . : 
   Description . . . . . . . . . . . : Microsoft ISATAP Adapter #6
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes

When I run wireshark, I see, that 10.0.0.200 DNS is used during VPN connection.
I tried to use on client side configuration to modify dns, but it does not help.
Second test: I modified also my configuration on server side to use UDP instead of TCP - it works fine then. So this problem exists only with TCP.
I know, I should use UDP from beginning, but I have OpenVPN on port 80 - I use it also in hotels etc. to hide my communication.

My openvpn client config:

client
dev tun
proto tcp
remote XXXXX 80

resolv-retry infinite
nobind
persist-key
persist-tun

ca ca.crt
cert hostname.crt
key hostname.key
tls-auth ta.key 1
cipher AES-256-CBC
keysize 256
auth SHA256
ns-cert-type server

comp-lzo
verb 4

Traffic

Connect to the VPN and post details of "route print" (as above)

przemek.wawa

===========================================================================
Interface List
 10...00 ff 07 ee 38 07 ......TAP-Windows Adapter V9
 21...02 80 37 ec 02 00 ......Dell Wireless 5540 HSPA Mini-Card Network Adapter
  7...00 24 d7 7f 5d 95 ......Microsoft Wi-Fi Direct Virtual Adapter
  4...00 24 d7 7f 5d 94 ......Intel(R) Centrino(R) Ultimate-N 6300 AGN
  3...5c 26 0a 32 af a4 ......Intel(R) 82577LM Gigabit Network Connection
 24...00 50 56 c0 00 01 ......VMware Virtual Ethernet Adapter for VMnet1
 25...00 50 56 c0 00 08 ......VMware Virtual Ethernet Adapter for VMnet8
  1...........................Software Loopback Interface 1
  9...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2
 11...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #4
 43...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #3
 22...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
 57...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #6
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0         10.0.0.1     10.255.0.143     10
          0.0.0.0        128.0.0.0         10.8.0.9        10.8.0.10     20
         10.0.0.0        255.0.0.0         On-link      10.255.0.143    266
         10.8.0.0    255.255.255.0         10.8.0.9        10.8.0.10     20
         10.8.0.8  255.255.255.252         On-link         10.8.0.10    276
        10.8.0.10  255.255.255.255         On-link         10.8.0.10    276
        10.8.0.11  255.255.255.255         On-link         10.8.0.10    276
       10.83.68.0    255.255.255.0         10.8.0.9        10.8.0.10     20
     10.255.0.143  255.255.255.255         On-link      10.255.0.143    266
   10.255.255.255  255.255.255.255         On-link      10.255.0.143    266
  OpenVPNServerIP  255.255.255.255         10.0.0.1     10.255.0.143     10
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
        128.0.0.0        128.0.0.0         10.8.0.9        10.8.0.10     20
    192.168.110.0    255.255.255.0         On-link     192.168.110.1    276
    192.168.110.1  255.255.255.255         On-link     192.168.110.1    276
  192.168.110.255  255.255.255.255         On-link     192.168.110.1    276
    192.168.126.0    255.255.255.0         On-link     192.168.126.1    276
    192.168.126.1  255.255.255.255         On-link     192.168.126.1    276
  192.168.126.255  255.255.255.255         On-link     192.168.126.1    276
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link      10.255.0.143    266
        224.0.0.0        240.0.0.0         On-link     192.168.110.1    276
        224.0.0.0        240.0.0.0         On-link     192.168.126.1    276
        224.0.0.0        240.0.0.0         On-link         10.8.0.10    276
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link      10.255.0.143    266
  255.255.255.255  255.255.255.255         On-link     192.168.110.1    276
  255.255.255.255  255.255.255.255         On-link     192.168.126.1    276
  255.255.255.255  255.255.255.255         On-link         10.8.0.10    276
===========================================================================
Persistent Routes:
  None

IPv6 Route Table
===========================================================================
Active Routes:
 If Metric Network Destination      Gateway
  1    306 ::1/128                  On-link
  3    266 fe80::/64                On-link
 25    276 fe80::/64                On-link
 24    276 fe80::/64                On-link
 10    276 fe80::/64                On-link
  3    266 fe80::59a:95ff:cc28:6b3/128
                                    On-link
 25    276 fe80::b0db:bc97:9a07:6185/128
                                    On-link
 24    276 fe80::c951:e2e:1055:dc05/128
                                    On-link
 10    276 fe80::ec84:d045:818a:8037/128
                                    On-link
  1    306 ff00::/8                 On-link
  3    266 ff00::/8                 On-link
 25    276 ff00::/8                 On-link
 24    276 ff00::/8                 On-link
 10    276 ff00::/8                 On-link
===========================================================================
Persistent Routes:
  None

przemek.wawa

Small update: I've made some additional tests - it also does not work with UDP. The problem is, that it does not work on this network card. On my wifi everything goes fine using both UDP and TCP. On ethernet does not (but it worked for sure on windows 7 on the same laptop. I am not pretty sure if it worked fine on 8.1 but on older OpenVPN).

Traffic

przemek.wawa wroteWindows IP Configuration

Ethernet adapter TAP:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : TAP-Windows Adapter V9
   IPv4 Address. . . . . . . . . . . : 10.8.0.10(Preferred)
   DNS Servers . . . . . . . . . . . : 10.83.68.1

Can you ping the DNS server over the VPN from the problem client ?

przemek.wawa

Yes:

ping 10.83.68.1
Pinging 10.83.68.1 with 32 bytes of data:
Reply from 10.83.68.1: bytes=32 time=15ms TTL=64
Reply from 10.83.68.1: bytes=32 time=14ms TTL=64

Ping statistics for 10.83.68.1:
    Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 14ms, Maximum = 15ms, Average = 14ms
Control-C

Traffic

Good old windows .. I do not have access to W81 so I can not help much.

This is what I would try:

Windows-Network-Connections> Interface(LAN or WLAN)> Properties> TCP/IP> Advanced> DNS:
- DNS Servers Address, in order of use:
  - 10.83.68.1
    10.0.0.200
    10.0.0.199

That is only a suggestion ..

przemek.wawa

That helped, I tried similar before: I have changed whole DNS settings.
But I wrote here, because for me it is some bug in software. I don't know OpenVPN code so difficult to say for me if it is some new "feauture" of Win8.1 or maybe something in OpenVPN.
Some other disadventage is that when I am not connected to VPN, first connection to DNS server takes longer.
Anyway, thank you for workaround.
Is there any official way to submit the bug in OpenVPN?

andyloev

There is a problem with DNS tunneling on Windows 8.1 - it doesnt work:)
DNS requests are send over local network.
I worked fine for some time, and with new version it stopped (I don't know when exactly, I made tests again few days ago.
My have not changed configuration. In logs it seems fine:
Code:
PUSH: Received control message: 'PUSH_REPLY,route X.X.X.X 255.255.255.0,dhcp-option DNS Y.Y.Y.Y,redirect-gateway def1,route Z.Z.Z.Z 255.255.255.0,topology net30,ping 15,ping-restart 60,ifconfig A.A.A.A B.B.B.B'

On Windows 7 it works fine with the same configuration: DNS requests are tunneled over VPN.
On Mac OS I don't know yeat, but for some time I have an message, that Internet is not accessible after connection (but it is)