I'm hosting some websites inside my network on a Windows server named WSS and I want to be able to access them via my WAN address (using host headers) as well as inside my network. In addition to running a webserver, WSS also runs a DNS service and an OpenVPN server. For example, I have a site called http://lights.foobar.com, and I use my the Google DNS API to update lights, other subdomains, and foobar.com to point to my WAN ip address. My router (172.16.0.1) assigns reserved DHCP addresses based upon MAC address to every machine, and WSS always gets assigned 172.16.0.6. The router also gives clients DNS server addresses of 172.16.0.6 (the WSS box) and 8.8.4.4. I do this because I want clients behind my router to use the DNS server on WSS which has records similar to those set in my external DNS provider, except they all point to 172.16.0.6. I use host headers on IIS so every subdomain can be matched to the correct website. My notebook's ipconfig /all is returning the correct DNS servers in the proper order. When I ping lights.foobar.com from a client, I should always get 172.16.0.6, however, after a machine outside of my network connects to OpenVPN, pinging lights.foobar.com starts shows the WAN address. This problem persists even after the OpenVPN client disconnects. This happens every single time a client connects, and the DNS doesn't start working properly again until I reboot the server. I'll try waiting overnight instead of rebooting, but regardless OpenVPN seems to be the culprit here. A nslookup on the client yields the following: [code] C:\Users\MyClient>nslookup lights.foobar.com 172.16.0.6 DNS request timed out. timeout was 2 seconds. Server: UnKnown Address: 172.16.0.6 DNS request timed out. timeout was 2 seconds. DNS request timed out. timeout was 2 seconds. DNS request timed out. timeout was 2 seconds. DNS request timed out. timeout was 2 seconds. *** Request to UnKnown timed-out C:\Users\MyClient> [/code] Yet the same command on the DNS server shows this: [code]C:\Users\myserver>nslookup lights.foobar.com 172.16.0.6 Server: lights.foobar.com Address: 172.16.0.6 Name: lights.foobar.com Address: 172.16.0.6 C:\Users\myserver>[/code] I don't know if it is relevant, but if I repeat the same command, the "server" value cycles through each of my DNS records and starts over again, so the next call will say "hello.foobar.com" and then "foobar.com" and then start over at "lights.foobar.com" This is my server's OpenVPN config file: [code]port 1194 proto tcp dev tun ca "C:\\Program Files\\OpenVPN\\config\\ca.crt" cert "C:\\Program Files\\OpenVPN\\config\\wss.crt" key "C:\\Program Files\\OpenVPN\\config\\wss.key" dh "C:\\Program Files\\OpenVPN\\config\\dh1024.pem" server 10.8.0.0 255.255.255.0 push "redirect-gateway def1" push "dhcp-option DNS 172.16.0.6" client-to-client duplicate-cn ifconfig-pool-persist ipp.txt status openvpn-status.log keepalive 10 120 cipher BF-CBC comp-lzo max-clients 10 persist-key persist-tun log openvpn.log verb 3[/code] And here is my client's config (Note in the server config I allow the same cert to connect multiple times) [code]client dev tun proto tcp remote foobar.com 1194 resolv-retry infinite nobind persist-key persist-tun remote-cert-tls server comp-lzo verb 3 -----BEGIN CERTIFICATE----- (snip) -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- (snip) -----END CERTIFICATE----- -----BEGIN PRIVATE KEY----- (snip) -----END PRIVATE KEY----- [/code] Here is the ipconfig /all for one of my router clients: [code]Wireless LAN adapter Wi-Fi: Connection-specific DNS Suffix . : Description . . . . . . . . . . . : Dell Wireless 1820A 802.11ac Physical Address. . . . . . . . . : 54-8C-A0-A3-15-63 DHCP Enabled. . . . . . . . . . . : Yes Autoconfiguration Enabled . . . . : Yes Link-local IPv6 Address . . . . . : fe80::4829:6960:76c3:2fbd%5(Preferred) IPv4 Address. . . . . . . . . . . : 172.16.0.32(Preferred) Subnet Mask . . . . . . . . . . . : 255.240.0.0 Lease Obtained. . . . . . . . . . : Tuesday, August 16, 2016 11:12:16 PM Lease Expires . . . . . . . . . . : Wednesday, August 17, 2016 3:12:16 AM Default Gateway . . . . . . . . . : 172.16.0.1 DHCP Server . . . . . . . . . . . : 172.16.0.1 DHCPv6 IAID . . . . . . . . . . . : 39095456 DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-1F-36-08-3C-54-8C-A0-A3-15-63 DNS Servers . . . . . . . . . . . : 172.16.0.6 8.8.4.4 NetBIOS over Tcpip. . . . . . . . : Enabled[/code]

Try setting this up [b]without[/b] --push "redirect-gateway def1"

[quote="TheMightyHank"]The problem is [b]machines that are NOT connected to the VPN[/b] are losing access to the internal DNS. [/quote]So how is openvpn involved in that ? [quote="TheMightyHank"]And removing that command defeats the purpose of this VPN.[/quote]Perhaps this is changing your routing in ways you are not aware of .. I would at least try.

OpenVPN breaks DNS

TheMightyHank

I'm hosting some websites inside my network on a Windows server named WSS and I want to be able to access them via my WAN address (using host headers) as well as inside my network. In addition to running a webserver, WSS also runs a DNS service and an OpenVPN server.

For example, I have a site called http://lights.foobar.com, and I use my the Google DNS API to update lights, other subdomains, and foobar.com to point to my WAN ip address.

My router (172.16.0.1) assigns reserved DHCP addresses based upon MAC address to every machine, and WSS always gets assigned 172.16.0.6. The router also gives clients DNS server addresses of 172.16.0.6 (the WSS box) and 8.8.4.4. I do this because I want clients behind my router to use the DNS server on WSS which has records similar to those set in my external DNS provider, except they all point to 172.16.0.6. I use host headers on IIS so every subdomain can be matched to the correct website.

My notebook's ipconfig /all is returning the correct DNS servers in the proper order.

When I ping lights.foobar.com from a client, I should always get 172.16.0.6, however, after a machine outside of my network connects to OpenVPN, pinging lights.foobar.com starts shows the WAN address. This problem persists even after the OpenVPN client disconnects. This happens every single time a client connects, and the DNS doesn't start working properly again until I reboot the server. I'll try waiting overnight instead of rebooting, but regardless OpenVPN seems to be the culprit here.

A nslookup on the client yields the following:

C:\Users\MyClient>nslookup lights.foobar.com 172.16.0.6
DNS request timed out.
    timeout was 2 seconds.
Server:  UnKnown
Address:  172.16.0.6

DNS request timed out.
    timeout was 2 seconds.
DNS request timed out.
    timeout was 2 seconds.
DNS request timed out.
    timeout was 2 seconds.
DNS request timed out.
    timeout was 2 seconds.
*** Request to UnKnown timed-out

C:\Users\MyClient>

Yet the same command on the DNS server shows this:

C:\Users\myserver>nslookup lights.foobar.com 172.16.0.6
Server:  lights.foobar.com
Address:  172.16.0.6

Name:    lights.foobar.com
Address:  172.16.0.6

C:\Users\myserver>

I don't know if it is relevant, but if I repeat the same command, the "server" value cycles through each of my DNS records and starts over again, so the next call will say "hello.foobar.com" and then "foobar.com" and then start over at "lights.foobar.com"

This is my server's OpenVPN config file:

port 1194
proto tcp
dev tun

ca "C:\\Program Files\\OpenVPN\\config\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\config\\wss.crt"
key "C:\\Program Files\\OpenVPN\\config\\wss.key"
dh "C:\\Program Files\\OpenVPN\\config\\dh1024.pem"

server 10.8.0.0 255.255.255.0
push "redirect-gateway def1"
push "dhcp-option DNS 172.16.0.6"

client-to-client
duplicate-cn
ifconfig-pool-persist ipp.txt
status openvpn-status.log
keepalive 10 120
cipher BF-CBC
comp-lzo
max-clients 10
persist-key
persist-tun
log openvpn.log
verb 3

And here is my client's config (Note in the server config I allow the same cert to connect multiple times)

client
dev tun
proto tcp
remote foobar.com 1194
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
comp-lzo
verb 3

<ca>
-----BEGIN CERTIFICATE-----
(snip)
-----END CERTIFICATE-----
</ca>

<cert>
-----BEGIN CERTIFICATE-----
(snip)
-----END CERTIFICATE-----
</cert>

<key>
-----BEGIN PRIVATE KEY-----
(snip)
-----END PRIVATE KEY-----
</key>

Here is the ipconfig /all for one of my router clients:

Wireless LAN adapter Wi-Fi:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Dell Wireless 1820A 802.11ac
   Physical Address. . . . . . . . . : 54-8C-A0-A3-15-63
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   Link-local IPv6 Address . . . . . : fe80::4829:6960:76c3:2fbd%5(Preferred)
   IPv4 Address. . . . . . . . . . . : 172.16.0.32(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.240.0.0
   Lease Obtained. . . . . . . . . . : Tuesday, August 16, 2016 11:12:16 PM
   Lease Expires . . . . . . . . . . : Wednesday, August 17, 2016 3:12:16 AM
   Default Gateway . . . . . . . . . : 172.16.0.1
   DHCP Server . . . . . . . . . . . : 172.16.0.1
   DHCPv6 IAID . . . . . . . . . . . : 39095456
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-1F-36-08-3C-54-8C-A0-A3-15-63
   DNS Servers . . . . . . . . . . . : 172.16.0.6
                                       8.8.4.4
   NetBIOS over Tcpip. . . . . . . . : Enabled

TinCanTech

Try setting this up without --push "redirect-gateway def1"

TheMightyHank

The problem is machines that are NOT connected to the VPN are losing access to the internal DNS. And removing that command defeats the purpose of this VPN.

TinCanTech

TheMightyHank wroteThe problem is machines that are NOT connected to the VPN are losing access to the internal DNS.

So how is openvpn involved in that ?

TheMightyHank wroteAnd removing that command defeats the purpose of this VPN.

Perhaps this is changing your routing in ways you are not aware of .. I would at least try.

TheMightyHank

I had some catastrophic hardware failure and had to rebuild my server. I was hoping this issue would go away, but I'm still getting the same problem.

And commenting out the redirect gateway makes no difference. The only way to get it working again is to reboot the server

TinCanTech

TheMightyHank wroteThe only way to get it working again is to reboot the server

Common solution :mrgreen: