Ubuntu Openvpn ignores directive to use 127.0.0.1

dfavor

Setting up OpenVPN first time with server=Ubuntu Wily + client=Mac.

OpenVPN on Mac connect + DNS resolution fails.

Reason seen in tcpdump...

net4-dev# tcpdump -vvv -s 0 -l -n port 53 | grep 10.8.0.6
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
10.8.0.6.55520 > 8.8.8.8.53: [udp sum ok] 49794+ A? 10-courier.sandbox.push.apple.com. (51)
10.8.0.6.62093 > 8.8.8.8.53: [udp sum ok] 23559+ A? root.skype-edf.akadns.net. (43)
10.8.0.6.55370 > 8.8.8.8.53: [udp sum ok] 15404+ AAAA? root.skype-edf.akadns.net. (43)
10.8.0.6.55733 > 8.8.8.8.53: [udp sum ok] 40191+ A? prd.col.aria.mobile.skypedata.akadns.net. (58)
10.8.0.6.63037 > 8.8.8.8.53: [udp sum ok] 10765+ AAAA? prd.col.aria.mobile.skypedata.akadns.net. (58)

DNS traffic is outbound from 10.8.0.6 (local Mac client address) so will never get a response.

DNS traffic should be flowing out 127.0.0.1 (where caching DNS server running), so responses flow out/back through caching DNS server.

I've tried...

push "redirect-gateway def1 bypass-dhcp"

and...

push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 127.0.0.1"

and several other combination of options...

Server startup log seems correct...

Thu Mar 10 14:10:12 2016 us=151901 dfavor-imac/173.174.63.59:37634 SENT CONTROL [dfavor-imac]: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 127.0.0.1,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5' (status=1)

Let me know the how to force OpenVPN to use a local caching server.

Thanks.

Traffic

Linux requires the following client directives to have some options be successfully --push'ed

Client config:

script-security 2
up /etc/openvpn/update-resolv-conf
down /etc/openvpn/update-resolv-conf

dfavor

net4-dev is the Ubuntu OpenVPN server machine.

dfavor

Don't think the client directives will have an expected effect on Mac clients, as Mac's networking is very different than Linux.

DNS packets are flowing correctly from Mac Client -> Ubuntu Server.

Problem seems to be in /etc/openvpn/server.conf on Ubuntu Server.

If you look back at tcpdump (on Ubuntu Server) problem can be seen.

DNS packets are destined for 8.8.8.8 rather than 127.0.0.1 which is Ubuntu DNS cache.

dfavor

Maybe you meant to say Server Config, rather than Client Config.

Added following to Server Config + restarted OpenVPN.

script-security 2
up /etc/openvpn/update-resolv-conf
down /etc/openvpn/update-resolv-conf

Log file shows...

net4-dev# tail -f /var/log/openvpn.log | grep update-resolv-conf
Thu Mar 10 15:31:43 2016 us=910606 /etc/openvpn/update-resolv-conf tun0 1500 1542 10.8.0.1 10.8.0.2 init
Thu Mar 10 15:31:43 2016 us=937155 up_script = '/etc/openvpn/update-resolv-conf'
Thu Mar 10 15:31:43 2016 us=937167 down_script = '/etc/openvpn/update-resolv-conf'
Thu Mar 10 15:31:43 2016 us=941205 /etc/openvpn/update-resolv-conf tun0 1500 1542 10.8.0.1 10.8.0.2 init

Which is what I'd expect.

No effect. DNS packets routing through 8.8.8.8 rather than 127.0.0.1

Traffic

dfavor wroteMaybe you meant to say Server Config

Traffic wroteLinux requires the following client directives

Client ..

dfavor wroteAdded following to Server Config

remove from server config ..

dfavor wroteIf you look back at tcpdump (on Ubuntu Server) problem can be seen.

DNS packets are destined for 8.8.8.8 rather than 127.0.0.1 which is Ubuntu DNS cache

maybe you do not understand how DNS cache works ..