Hi OpenVPN community, I was searching a lot on this topic, but with no luck. My setup consists of an ubuntu 14.04lts server an a win10 client at the momemt. the problem is, that I got a split tunnel situation, my dns requests aren't pushed through the tunnel, although I configured the server like this: [url]http://www.directupload.net/file/d/4078/q2wwtgj5_jpg.htm[/url] My Client config looks like this: [url]http://www.directupload.net/file/d/4078/r237ubwk_jpg.htm[/url] Both interfaces have a dns server and they are both used in parallel: [url]http://www.directupload.net/file/d/4078/c8udpc6x_jpg.htm[/url] As you can see, both dns are used and the local dns response wins the race. Do you have an idea, how to change this behaviour in a way that all dns requests are tunneled? Thanks for you help!

How to tunnel all DNS requests? - Win8, Win10

ABauer

Hi OpenVPN community,

I was searching a lot on this topic, but with no luck.

My setup consists of an ubuntu 14.04lts server an a win10 client at the momemt.

the problem is, that I got a split tunnel situation, my dns requests aren't pushed through the tunnel, although I configured the server like this:

http://www.directupload.net/file/d/4078/q2wwtgj5_jpg.htm

My Client config looks like this:
http://www.directupload.net/file/d/4078/r237ubwk_jpg.htm

Both interfaces have a dns server and they are both used in parallel:

http://www.directupload.net/file/d/4078/c8udpc6x_jpg.htm

As you can see, both dns are used and the local dns response wins the race.

Do you have an idea, how to change this behaviour in a way that all dns requests are tunneled?

Thanks for you help!

rsenio

So you're using routing? But you have set "Should VPN clients have access to private subnets (non-public networks on the server side)?" to NO?

I use routing, but have the option set to "Yes, using routing (advanced)" with split tunnel and have no problems. What version are you using of the access server?

ABauer

Thanks for you answer! 🙂

So you're using routing? -> Yes
But you have set "Should VPN clients have access to private subnets (non-public networks on the server side)?" to NO? -> It is set to NO
What version are you using of the access server? -> 2.0.20

Let me just add, that I want to tunnel all DNS requests through the VPN.
At best the local DNS server is not queried anymore after the tunnel is up.

I want to do this to avoid DNS cache poisoning, which may occur, when using public Wi-Fi or other unsecure networks.

Do you have an idea how to achieve this?

€dit: Set my answers to bold

ABauer

I reviewed my config and did some more testing:

A manual lookup of the domain works and is answered by the DNS-Server behind the tunnel.

C:\Windows\System32>nslookup www.openvpn.net
Server:  UnKnown
Address:  100.113.58.13

Nicht autorisierende Antwort:
Name:    www.openvpn.net
Addresses:  198.41.191.212
          198.41.184.213


C:\Windows\System32>

Next a made a wireshark capture, trying to connect to http://www.debian.org via Firefox.

Here you can see, that both DNS servers are asked. The Client gets a response from both as well.

http://www.directupload.net/file/d/4096/mskyjcih_jpg.htm

As I searched through the capture, the client connected to "128.31.0.62", which is the IP adress the DNS server behind the tunnel replied. No connections to the other hosts.
Concerning this special situation it seems, like it worked as I expect it. :geek:
But this can be also a one-hit. In other scenarios, where both queries return the same IP, I cannot be sure, which request is processed.

I also thought about removing the dns entries on client side on the local interface, after the tunnel is up. But the local adapter gets the ip and dns via dhcp. In this case I cannot delete them (at least I don't know how).

So the questions still exists: How can I make sure, that I only use the DNS server behind the tunnel, to be safe against dns-cache poisoning in public Wireless Lans?

Traffic

You could use Windows Firewall to block all DNS except those of the tunnel.