Disable redirect-gateway but not for DNS queries

bluepr0

Hello!

I've a NAS where I'm running OpenVPN on a Debian 8 VM (192.168.1.10). Everything is setup and working perfectly when connecting with my iPhone. I also have a DNS server installed on a raspberry PI (192.168.1.100) to filter ads. My router configuration has as DNS my raspberry PI so anyone that uses my Wifi gets ads filtering automatically.

So, on my iPhone connected through the VPN, I can access internet or local net IPs without problems... no matter if I'm connected to the Wifi or over 4G. But the thing is that I don't always want all the traffic to go through my VPN, as it makes my mobile phone connection a bit slow. I would like to have the option to also only route DNS queries through my VPN so I can ask my raspberry PI (DNS server) and get ad filtering anywhere.

I've read several tutorials, wikis and how to and I can't find a way to do it. I've tried removing "redirect-gateway" on both server and client, and I can connect well. But when I'm on 4G my iPhone is not asking my DNS server, instead I think it's using the one provided by my ISP. I've also tried forcing the DNS on both client and server configs, but it didn't work either. I'm out of ideas 🙁

Below are my client and server configurations (with redirect-gateway enabled, but as I said... I tried with the line commented too)

Server.conf

port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key  # This file should be kept secret
dh dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "dhcp-option DNS 192.168.1.110"
push "dhcp-option DNS 192.168.1.110"
keepalive 10 120
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3

Client.conf

client
dev tun
proto udp
remote my.host.com 1194
resolv-retry infinite
nobind
user nobody
group nogroup
persist-key
persist-tun
redirect-gateway def1
dhcp-option DNS 192.168.1.110
ns-cert-type server
comp-lzo
verb 3
[BELOW GOES CERT, ETC]

bluepr0

Hello!

I haven't yet found a solution for the first problem I'm talking about on the first post, and I've already realise that I have another one 😃

The thing is, that when I connect to another Wifi that is using the same IP range as I use on my local network (192.168.1.*) it seems that I can't access my local resources (for example my NAS which is 192.168.1.2). Looks like instead my iPhone is trying to go to the IP 192.168.1.2 but in the network I'm connected currently. Not sure if I've explained myself.

I guess that if I use another IP range for my local network, like 172.16.0.* I shouldn't have that problem as most of the routers here in Spain use the 192.168.1.* or 192.168.0.* but it's not really a complete solution, I could stumble upon with a router using 172.16.0.* so the idea won't work.

How is supposed a network manager to handle all this?

Thanks!

Traffic

bluepr0 wrotebut it's not really a complete solution, I could stumble upon with a router using 172.16.0.* so the idea won't work.

That is one of the many limitations of IPv4 .. but your solution is the right answer:

NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.

:arrow: Never use 192.168.0.0/24 or 192.168.1.0/24 (or other common subnets) for your OpenVPN Server LAN :!:

Try something like 10.179.238.0/24 .. or if you only have a small network something even more unique 10.279.238.96/27

Read about private subnets. Wikipedia: RFC1918

Traffic

bluepr0 wroteI would like to have the option to also only route DNS queries through my VPN

Sounds feasible:

Server config:

Obviously, push the DNS server to your client:

push "dhcp-option DNS 192.168.1.110"   ### Change your Server LAN to avoid future conflicts
push "dhcp-option DNS 192.168.1.110"   ### as you now understand

Add push the server side LAN route to your client:

push "192.168.1.110"                   ### This will only push the DNS server route   
                                       ### Change your server LAN as above
push "192.168.1.0 255.255.255.0"       ### This will push the entire subnet
                                       ### Change your server LAN as above

Make sure the DNS servers are applied by the client .. and that should work.

bluepr0

Traffic wrote

bluepr0 wroteI would like to have the option to also only route DNS queries through my VPN

Sounds feasible:

Server config:

Obviously, push the DNS server to your client:

push "dhcp-option DNS 192.168.1.110"   ### Change your Server LAN to avoid future conflicts
push "dhcp-option DNS 192.168.1.110"   ### as you now understand

Add push the server side LAN route to your client:

push "192.168.1.110"                   ### This will only push the DNS server route   
                                       ### Change your server LAN as above
push "192.168.1.0 255.255.255.0"       ### This will push the entire subnet
                                       ### Change your server LAN as above

Make sure the DNS servers are applied by the client .. and that should work.

Thanks a lot!

I've tried what you suggested, but it seems to not be working. On my iPhone both on Wifi and 4G I get the VPN working fine and I can access my local LAN IPs, but all the traffic still goes through the VPN server.

push "192.168.1.110"                   ### This will only push the DNS server route   
                                       ### Change your server LAN as above
push "192.168.1.0 255.255.255.0"       ### This will push the entire subnet
                                       ### Change your server LAN as above

Just in case, I have tried with the redirect-gateway option enabled and disabled (if disabled, I don't get ad-block, ergo it's not using my local LAN DNS server)

Thanks again!