Split DNS resolution issues with AS 2.1.1

mk654321

Running AS 2.1.1 and have been encountering issues resolving internal hosts in a split dns environment.

Only way it seems to work is if I manually enter dns servers and dns suffix in the TAP interface. Unfortunately this is not a solution when there are over 100 users that need to be configured with a mix of Windows, Mac & Linux.

Anyone know how to solve the issues?

mk654321

The logs show that
DNS Servers:
Search Domains:
are blank
is this a known bug?

rsenio

DNS settings changed starting in 2.1.0. and again in 2.1.1.

https://openvpn.net/index.php/access-server/download-openvpn-as-sw/532-release-notes-v200.html

There's a setting for DNS resolution zones as well as Default Domain Suffix. I take you didn't look at the admin interface when you upgraded

mk654321

Yes I did and it still does not resolve the issues.

DNS Settings: Have clients use the same DNS servers as the Access server host
DNS resolution zones: domain.com,domain1.com,domain2.com
Default domain suffix: domain.com

And when you review the logs show that DNS servers are blank, search domains are blank.

Internal DNS resolution fails period, on Windows 7,10 and on Mac and Linux.

The only way to get it working with DNS resolution and multiple zones is to edit the TAP interface and manually add DNS servers and DNS suffixes.

Now this would not be an issue if it was on the same platform and only a handful of systems and I can manually modify, but it's not.

Have you tested it yourself to confirm that it is functional?

mk654321

Support replied and stated to keep the DNS zones field empty, will test and respond with results.

mk654321

Well just as I confirmed, doesn't work, there is serious bugs with this program and if it was the community edition, then I would understand, but as paying customers, the response from support is far and few and very vague.

mk654321

I've given up at this point and will wait to hear from support

mk654321

So support tells me that multiple domain suffixes are not supported, but the VPN Settings states to specify a list of internal domains with comma separation?

mk654321

Where can I download ubuntu x64 version 2.0.24 of AS?
That version worked without any issues.

mk654321

Hey mod, you can close this one, looks like OpenVPN AS does not support multi domain dns suffixes.

This is their support response:
Kindly be informed that multiple DNS suffixes are not support.
Please try setting only one DNS suffix and try again.

Kind regards,
OpenVPN Technologies, Inc.

The Johan

First our apologies to our users that are experiencing this problem. It's one thing to get a report of something not working, but another thing entirely to work out exactly what the cause is. And along the way, certain things have to be tried and tested first, and this takes time.

We believe we have - just now - found the bug. If you look in the 'Advanced VPN' section and you see that the NETBIOS option is enabled in Access Server 2.1.1, then that is almost certainly the cause of the DNS problems you are experiencing. The symptoms are that all the DNS options under VPN Settings simply will not be passed from the server to the client. We will of course fix this bug ASAP and make a new release. And our apologies for needing some time to find the problem. It didn't exactly make much sense that the bug came from here, but in my tests, I have found this to be the case. You have 3 options;

Downgrade AS to 2.1.0.
Wait for new AS 2.1.2 (or whatever the version number will be)
Disable the NETBIOS option temporarily until 2.1.2 is available and then upgrade and re-enable the option.

As for DNS resolution zones and DNS suffixes, there are some caveats.

DNS resolution zones define which DNS zones will be queried through the DNS server pushed by the Access Server. However, for the Windows platform, only Windows 8, 8.1, and Windows 10, can implement this. On Mac OS, iOS, Android, this already works, and it supports multiple zones. While Microsoft's documentation states that multiple DNS resolution zones are supported (if you're interested, read up on NRPT), however we have found that it does not. This is most likely a bug or some limitation that is not explained in the documentation. In fact the documentation clearly suggests that multiple DNS resolution zones are possible to specify, yet it only takes one. So while you can specify multiple DNS resolution zones in the Access Server, and these are pushed to Windows clients, all but the first one are ignored on Windows. This particular problem we cannot solve at this time.

DNS suffixes are a similar story. While operating systems like Mac OS X and Linux support multiple DNS suffixes on a VPN interface just fine, Windows has problems supporting these on a VPN interface. You can have multiple DNS suffixes but you have to add them manually. Pushed from the Access Server, the Windows platform will only accept one DNS suffix for the VPN interface.

akeohan

I also want to chime in and say I'm also having this issue, but under the Advanced VPN under the Windows Networking (optional) setting my selection *Disable NetBIOS over TCP/IP on clients does not work. We can still not resolve to internal hosted websites. Our default selection was *Don't Alter windows networking settings on clients before.

where can I get the previous AS download, not finding it on the website (might be blind).

The Johan

I'm sorry perhaps I was not clear. There are three options for NETBIOS:

Do not change settings (this is what I meant with disable the NETBIOS option).
Actively disable NETBIOS on the client side
Actively enable NETBIOS on the client side

We're absolutely certain that this is the only problem found; if you need more help contact the support ticket system.

If you insist on the old version just replace the .1 in the URL with the .0.

akeohan

NovaFlash,
Thanks for the reply. Ours was set to that already, guess there might be a different problem. Just for reference our issue is that users can't browse to internal websites with split tunneling like before. If we add an entry to the host file the issue is resolved. Everything else works like normal, clients can RDP to servers and reach network shares. Its just a problem with internal websites.

mk654321

novaflash wrote DNS suffixes are a similar story. While operating systems like Mac OS X and Linux support multiple DNS suffixes on a VPN interface just fine, Windows has problems supporting these on a VPN interface. You can have multiple DNS suffixes but you have to add them manually. Pushed from the Access Server, the Windows platform will only accept one DNS suffix for the VPN interface.

This contradicts what AS support responded with specifically stating that multi domains are no supported.

BTW, 2.1.1 is broken in regards to DNS suffixes with any OS, Win, Mac & Linux, did not downgrade to 2.1.0

I tested every conceivable option to get DNS suffixes working and the only way was to manually enter static dns entries and the multiple suffixes in the TAP adapter in Win for Win7 & Win10.

This included disabling NetBIOS, which by default I do

In regards to the Mac, I am not familiar enough with it to know if there is a TAP interface to manually enter DNS and suffixes.

Same with Linux, but the devops engineers tested 2.1.1 with poor results

I ended up downgrading to pre 2.1 for the time being to give me breathing room, while I research our long term solution (stay with AS or find an alternative)

kjacobson

I tested the newly released 2.1.2 and it did not fix the issue for my users. In order to do further troubleshooting, I will need to wait for a maintenance window. It seems that the 2.1.1+ release has negatively impacted our company.

akeohan

Same here, still having issues. What was the last working version for you?

kjacobson

I'm fairly certain the last working version for me was AS 2.1.0 - and if you look at the changelog, that's prior to the DNS changes in 2.1.1.

I get the idea behind the changes, kind of, in the UI and it was a bit confusing before with how it worked - but now it straight up doesn't do as it seems so I definitely prefer the previous (working) behavior over the current release.

Changelog here: https://openvpn.net/index.php/access-server/download-openvpn-as-sw/532-release-notes-v200.html

kjacobson

mk654321 wrote
novaflash wrote DNS suffixes are a similar story. While operating systems like Mac OS X and Linux support multiple DNS suffixes on a VPN interface just fine, Windows has problems supporting these on a VPN interface. You can have multiple DNS suffixes but you have to add them manually. Pushed from the Access Server, the Windows platform will only accept one DNS suffix for the VPN interface.
This contradicts what AS support responded with specifically stating that multi domains are no supported.

BTW, 2.1.1 is broken in regards to DNS suffixes with any OS, Win, Mac & Linux, did not downgrade to 2.1.0

I tested every conceivable option to get DNS suffixes working and the only way was to manually enter static dns entries and the multiple suffixes in the TAP adapter in Win for Win7 & Win10.

This included disabling NetBIOS, which by default I do

In regards to the Mac, I am not familiar enough with it to know if there is a TAP interface to manually enter DNS and suffixes.

Same with Linux, but the devops engineers tested 2.1.1 with poor results

I ended up downgrading to pre 2.1 for the time being to give me breathing room, while I research our long term solution (stay with AS or find an alternative)

mk654321, question for you.

what version did you downgrade to exactly? curious as we are looking to resolve the same issue and wanted to know what you went to as well. thanks!

Flaviamichael

Work around an issue with VPN clients and split DNS:

A couple of years ago I had some good discussions with different people, including a guy from Microsoft Networking Support, about how the name resolution for VPN clients was supposed to work. Everybody seems to agree that when the VPN client connects, we expect that the RRAS adapter will automatically be placed on the top of the adapter list. As you probably know, the adapter order plays an important role in the DNS resolving process because the DNS servers associated with the adapter that has the highest binding order in the adapter list are tried first.

However, in practice we didn't see that behavior consistently, even if we manually placed the RRAS adapter to the top of the connections list in the Advanced Settings dialog box of the Network and Dial-up Connections tool. Because it didn't seem to break anything in the configuration I work with, at most I could see a small slow down in name resolving, I didn't bother to fix that problem.

When I started to publish some internal services and set up a well designed split DNS infrastructure to support it, I immediately got some complaints from some VPN users that some internal services were no longer reachable. It was not difficult to determine that the failing internal services were those defined in the external DNS server too. So, that old VPN name resolving issue was cropping up again and this time it was really breaking things. What was interesting was that only some VPN users were affected although they all use the same configuration, except the type of sharing device connecting their workstation to the cable/dsl modem. Also, take note that a different ISP is used for the VPN clients and the central connection to the ISA server.