OpenVPN and DNS server on one machine

o0klocek0o

I set up debian OpenVPN server on Raspberry Pi 2 machine. I also set up adblocking dns server using ready script from pi-hole.net.

I have access to my vpn from other networks (like public hotspots), and there's no ads in lan network (with router config using my pi as first and google dns as second).

To be completely satisfied I would need to have adblocking VPN.

I think that I need to make openvpn use local dns server. I tried, in /etc/openvpn/server.conf file, to adjust push "dhcp-option DNS ip" value.

My LAN network is running on 192.168.0.1, server have static ip - 192.168.0.10. I tried options like 127.0.0.1, localhost, 192.168.0.10, 192.168.0.1, 10.8.0.1(openvpn network) or change DNS in my device settings to 192.168.0.10 while in other network and using vpn.

No success so far, and as you can clearly see I have no idea what I'm doing. If you guys could help it would be awesome. If you need any more info just say it.

If you could provide not-ready solution (like, read this "short" article) it would be even better, because I would learn something in the process.

Thanks, Peter.

Traffic

I don't know about the problem of DNSMasq but I would think that you need to install the ad-blocking software on the client PC.

o0klocek0o

This method is using hosts-like file to block ads. Basically I have my own DNS server that is using hosts file to redirect to different websites. If address is found in hosts file, it redirect to localhost http server, which loads blank page. If address is not found it uses google dns.

This way is great because it allows to block ads network-wide (all devices in lan doesn't have ads) and devices like iPhones and iPads too.

in push "dhcp..." I entered my public ip. It does work now. However I'm not sure if it's best way and if it doesn't make larger delays.

Pippin

in push "dhcp..." I entered my public ip

That doesn`t seem right to me...
Since it`s working on your LAN and not for OVPN-clients, something must be wrongly configured.
From a OVPN-client can you see/ping/connect to a machine on your LAN?
For example, can you connect to your router-IP?

On server

push "route 192.168.0.0 255.255.255.0"

is set?

I run a similar setup on a NAS.
For your case

push "dhcp-option DNS 192.168.0.10"

should do the job.

Can you post your server/client config and logs (as per forum rules)?

o0klocek0o

server.conf

dev tun
proto udp
port 1194
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/server.crt # SWAP WITH YOUR CRT NAME
key /etc/openvpn/easy-rsa/keys/server.key # SWAP WITH YOUR KEY NAME
dh /etc/openvpn/easy-rsa/keys/dh1024.pem # If you kept 1024, change it to dh1024.pem
server 10.8.0.0 255.255.255.0
# server and remote endpoints
ifconfig 10.8.0.1 10.8.0.2
# Add route to Client routing table for the OpenVPN Server
push "route 10.8.0.1 255.255.255.255"
# Add route to Client routing table for the OpenVPN Subnet
push "route 10.8.0.0 255.255.255.0"
# your local subnet
push "route 192.168.0.10 255.255.255.0" # Enter PI LAN PI
# Set primary domain name server address to the SOHO Router
# If your router does not do DNS, you can use Google DNS 8.8.8.8

#push "dhcp-option DNS 8.8.8.8" 
push "dhcp-option DNS <my_ip>"

# Override the Client default gateway by using 0.0.0.0/1 and
# 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of
# overriding but not wiping out the original default gateway.
push "redirect-gateway def1"
client-to-client
duplicate-cn
keepalive 10 120
tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0
cipher AES-128-CBC
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn-status.log 20
log /var/log/openvpn.log
verb 1

client.ovpn (is it the right file ?)

client 
dev tun 
proto udp 
remote <my_ip> 1194
resolv-retry infinite 
nobind 
persist-key 
persist-tun 
mute-replay-warnings 
ns-cert-type server
key-direction 1 
cipher AES-128-CBC 
comp-lzo 
verb 1 
mute 20

log from client

Running openvpn --cd /var/mobile/Documents/Configurations/vpn_piotr2 --config "vpn_piotr2.ovpn" --auto-proxy

2016-02-19 10:28:22.747 tools[1918:98035] SIPC: Successfully set up client
CoreFoundation = 1144.170000
Fri Feb 19 10:28:22 2016 OpenVPN 2.3.4 arm-apple-darwin10 [SSL (OpenSSL)] [LZO] [MH] [IPv6] built on Jan 11 2015
Fri Feb 19 10:28:22 2016 library versions: OpenSSL 0.9.8zg 11 Jun 2015, LZO 2.03
Fri Feb 19 10:28:22 2016 Control Channel Authentication: tls-auth using INLINE static key file
Fri Feb 19 10:28:22 2016 UDPv4 link local: [undef]
Fri Feb 19 10:28:22 2016 UDPv4 link remote: [AF_INET]<my_ip>:1194
Fri Feb 19 10:28:23 2016 [server] Peer Connection Initiated with [AF_INET]<my_ip>:1194
Fri Feb 19 10:28:25 2016 Opened utun device utun0
Fri Feb 19 10:28:25 2016 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Fri Feb 19 10:28:25 2016 /sbin/ifconfig utun0 delete
ifconfig: ioctl (SIOCDIFADDR): Can't assign requested address
Fri Feb 19 10:28:25 2016 NOTE: Tried to delete pre-existing tun/tap instance -- No Problem if failure
Fri Feb 19 10:28:25 2016 /sbin/ifconfig utun0 10.8.0.6 10.8.0.5 mtu 1500 netmask 255.255.255.255 up
Setting DNS to /Network/Service/41FCC1AD-2501-4CB5-9681-67DCCD5261F2/DNS (<my_ip> 192.168.0.31 192.168.0.32 192.168.213.35)
add net <my_ip>: gateway 192.168.32.1
add net 0.0.0.0: gateway 10.8.0.5
add net 128.0.0.0: gateway 10.8.0.5
add net 10.8.0.1: gateway 10.8.0.5
add net 10.8.0.0: gateway 10.8.0.5
add net 192.168.0.10: gateway 10.8.0.5
route: writing to routing socket: File exists
add net 10.8.0.0: gateway 10.8.0.5: File exists
Fri Feb 19 10:28:26 2016 Initialization Sequence Completed

If I connect to my vpn from other network I have access to my lan.
(router config, ssh with using 192.168.0.10 ip, remote desktop to my pc are working).

Pippin

Try this server config:

dev tun
proto udp
port 1194
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/server.crt
key /etc/openvpn/easy-rsa/keys/server.key
dh /etc/openvpn/easy-rsa/keys/dh1024.pem
server 10.8.0.0 255.255.255.0
push "route 10.8.0.0 255.255.255.0"
push "route 192.168.0.0 255.255.255.0"
push "dhcp-option DNS 192.168.0.10"
push "redirect-gateway def1"
#client-to-client
duplicate-cn
keepalive 10 120
tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0
cipher AES-128-CBC
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn-status.log 20
log /var/log/openvpn.log
verb 4

o0klocek0o

I tried to figure out what pi-hole script is actually doing. It seems like it's using dnsmasq, but it changes dnsmasq config file location & name.

Right now file which seems to be used by dnsmasq looks like :

# Pi-hole: A black hole for Internet advertisements
# (c) 2015, 2016 by Jacob Salmela
# Network-wide ad blocking via your Raspberry Pi
# http://pi-hole.net
# dnsmasq config for Pi-hole
#
# Pi-hole is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 2 of the License, or
# (at your option) any later version.

# If you want dnsmasq to read another file, as well as /etc/hosts, use
# this.
addn-hosts=/etc/pihole/gravity.list

# The following two options make you a better netizen, since they
# tell dnsmasq to filter out queries which the public DNS cannot
# answer, and which load the servers (especially the root servers)
# unnecessarily. If you have a dial-on-demand link they also stop
# these requests from bringing up the link unnecessarily.

# Never forward plain names (without a dot or domain part)
domain-needed
# Never forward addresses in the non-routed address spaces.
bogus-priv

# If you don't want dnsmasq to read /etc/resolv.conf or any other
# file, getting its servers from this file instead (see below), then
# uncomment this.
no-resolv

# Add other name servers here, with domain specs if they are for
# non-public domains.
server=8.8.8.8
server=8.8.4.4

# If you want dnsmasq to listen for DHCP and DNS requests only on
# specified interfaces (and the loopback) give the name of the
# interface (eg eth0) here.
interface=eth0
# Or which to listen on by address (remember to include 127.0.0.1 if
# you use this.)
listen-address=127.0.0.1
listen-address=192.168.0.10 #added

# Set the cachesize here.
cache-size=10000

# For debugging purposes, log each DNS query as it passes through
# dnsmasq.
#log-queries
#log-facility=/var/log/pihole.log

# Normally responses which come from /etc/hosts and the DHCP lease
# file have Time-To-Live set as zero, which conventionally means
# do not cache further. If you are happy to trade lower load on the
# server for potentially stale date, you can set a time-to-live (in
# seconds) here.
local-ttl=300

# This allows it to continue functioning without being blocked by syslog, and allows syslog to use dnsmasq for DNS queries without risking deadlock
log-async

I added "listen-address=192.168.0.10", and with your config file,my adblocking vpn is working.

But why if it's only 127.0.0.1, it doesn't works? When I'm on server, it's the same, right ?

Pippin

Nice that it works out 🙂
Maybe pi-hole did something to your hosts file?
I don`t know how pi-hole works and i think maybe this question is better asked by who created pi-hole.