help assigning DNS names to the VPN clients on local network

John_Candy_1588

Greetings. I have a OpenVPN server set up on my router (in "road warrior" mode) and it's been working great. However, I cannot reach VPN clients on my local LAN by their hostname.

Scenario:
local client: localClient1 is connected to router as 192.168.1.5
vpn client: vpnClient1 is connected to VPN server as 192.168.11.3

from vpnClient1, I can do

ping localClient1.mylocaldomain

and it works fine. Awesome, but from localClient1, if I try:

ping vpnClient1.mylocaldomain

I get nothing. I want to get it to find it at its IP address and communicate. If I ping 192.168.11.3, that works.

Thoughts? My router/server is running a light DNS server (dnsmasq) and I thought that should be able to handle this kind of thing. Thoughts? Suggestions? Thanks in advance!

I'm using OpenVPN server version 2.3.4.

server config:

dh dh.pem
ca ca.crt
cert cert.pem
key key.pem
writepid /var/run/openvpnd.pid
topology subnet
port 1194
proto udp
cipher aes-256-cbc
auth sha512
client-config-dir /ccd
comp-lzo adaptive
tls-server
ifconfig-pool-persist /etc/openvpn/ip-pool 86400
client-to-client
push "redirect-gateway def1"
fast-io
tun-mtu 1500
mtu-disc yes
server 192.168.11.0 255.255.255.0
dev tun2
tun-ipv6
tls-auth ta.key 0
push "dhcp-option DNS 192.168.11.1"
keepalive 300 600

client config:

remote server.domain.com port

client 
remote-cert-tls server 
dev tun0 
proto udp 
resolv-retry infinite 
nobind 
persist-key 
persist-tun 
float 
tun-mtu 1500
auth SHA512
cipher AES-256-CBC
keysize 256
comp-lzo

ca ca.crt 
cert os1.crt 
key os1.key 
tls-auth ta.key 1

Traffic

From localClient1 is connected to router as 192.168.1.5 can you ping 192.168.11.3 (VPN IP) by IP address not hostname ?

John_Candy_1588

Yes. VPN clients are pingable by IP address from the local LAN.

Traffic

Then add the names/ips to your DNS server ..

John_Candy_1588

Is there a way to have the VPN server do this for me when they get assigned? I'm not sure how OpenVPN assigns IP addresses (are they dynamic? do they depend on the order in which my clients connect?). I can add them manually but would rather have OpenVPN add them for me, you know?

John_Candy_1588

I would, but my IP addresses are assigned by some kind of DHCP. Thus, I'd like them to be assigned in the DNS server as they connect. Is this a function of OpenVPN, or should I be looking at a different system in my stack?

Traffic

You can assign static IPs to your VPN clients by using --client-connect-dir

The details are explained here:
HOWTO: Expanding the scope of the VPN to include additional machines

John_Candy_1588 wroteI'd like them to be assigned in the DNS server as they connect. Is this a function of OpenVPN

You can use the --client-connect option to run a script to update your DNS when a client connects ..

fett327

What command is used to update the DNS on the fly? Since the OP is running off his router I assume he is maybe using dnsmasq?

I have been able to do this on my router running dd-wrt by assigning static IPs to my VPN clients (using the client-connect-dir method you recommended below). I use a startup script to create the appropriate file in the ccd directory:

echo "ifconfig-push 192.168.20.11 255.255.255.0" > /tmp/openvpn/ccd/vpnclientname

...where 192.168.20.0 is my VPN subnet and the vpnclientname matches the "Common Name" for that client in its vpn certificate.

After that is done, I can use the "host-record" parameter of dnsmasq to tie the static ip address with a name so my DNS can resolve it.

host-record=vpnclientdnsname.local,192.168.20.11

...where "vpnclientdnsname" is the name which my DNS will resolve.

However none of this is done on the fly. The settings have to be there when I boot up my router. I wish I could make it a bit more dynamic. But I only have a few VPN clients set up, so this method works.