Hi openvpn community I'm setting a vpn server and meet DNS issues. The server is 2.3.12 running in the latest dd-wrt site main gateway with [b]--default-gateway def1[/b] and [b]--topology subnet[/b] for 2~3 windows7+ clients. The client from which I'd like to remotely manage the server is 2.3.2 from my ubuntu 14.04.5. I didn't need to push site lan route to the client for it to be able to ping IPs in the site lan. Although I had to manually add a firewall rule so that the client get replies when pinging IPs in the wan:[code]iptables -t nat -A POSTROUTING -s `nvram get openvpn_net`/`nvram get openvpn_tunmask` -o `get_wanface` -j SNAT --to nvram get wan_ipaddr[/code] The server OS routes are: [code]Destination Gateway Genmask Flags Metric Ref Use Iface 0.0.0.0 111.222.333.193 0.0.0.0 UG 0 0 0 vlan2 # ISP gateway IP in the wan 10.0.64.80 0.0.0.0 255.255.255.240 U 0 0 0 tun2 # vpn net 127.0.0.0 0.0.0.0 255.0.0.0 U 0 0 0 lo 169.254.0.0 0.0.0.0 255.255.0.0 U 0 0 0 br0 192.168.0.0 0.0.0.0 255.255.255.0 U 0 0 0 br0 # Site lan 111.222.333.192 0.0.0.0 255.255.255.192 U 0 0 0 vlan2 # ISP wan net - my gateway is dhcp allocated 111.222.333.196 plus 2 DNS[/code] The Server is[oconf=Server]dh /path/dh.pem ca /path/ca.crt cert /path/cert.pem key /path/key.pem keepalive 10 120 verb 3 mute 3 syslog writepid /path/openvpnd.pid management 127.0.0.1 port management-log-cache size topology subnet script-security 2 port 1194 proto udp cipher same-as-clients auth same-as-clients client-connect /path/clcon.sh client-disconnect /path/cldiscon.sh client-config-dir /path/ccd comp-lzo adaptive tls-server ifconfig-pool-persist /path/ip-pool 86400 push "redirect-gateway def1" tls-cipher same-as-clients fast-io tun-mtu 1500 mtu-disc yes server 10.0.64.80 255.255.255.240 dev tun2 tun-ipv6 tls-auth /tmp/openvpn/ta.key 0 push "dhcp-option DNS 192.168.0.254" ## dnsmasq in the gateway push "route-delay 5 5" ;push "route 192.168.0.0 255.255.255.0"[/oconf] I see two different behaviour on the client depending on I use: In network-manager-openvpn where I don't get the 0/1 & 128.0.0.0/1 routes, but I get DNS and can ping & browse both lan & wan names since I allowed the dnsmasq server to listen to the vpn interface in the server[code]interface=tun2 no-dhcp-interface=tun2[/code] [oconf=Client n-m-o]... [vpn] service-type=org.freedesktop.NetworkManager.openvpn ta-dir=1 connection-type=tls auth=same-as-server remote=site (ip from my hosts file, same as above) cipher=same-as-server comp-lzo=yes cert-pass-flags=0 port=1194 remote-cert-tls=server cert=/path/me.crt ca=/path/site.crt key=/path/me.key ta=/path/ta-site.key [ipv4] method=auto[/oconf] or [i]sudo openvpn site.conf[/i] where I get the two routes above but no DNS so that I can't ping names in the site lan nor wan [oconf=Client site.conf]client dev tun proto udp remote 111.222.333.196 1194 resolv-retry infinite nobind ;user nobody ;group nogroup persist-key persist-tun mute-replay-warnings ca site.crt cert me.crt key me.key ns-cert-type server tls-auth ta-site.key 1 auth same-as-server cipher same-as-server tls-cipher same-as-server comp-lzo verb 4 mute 20[/oconf] [code]nslookup device_in_server_lan or wan ;; connection timed out; no servers could be reached me@client:~/openvpn$ nslookup device_in_server_lan 192.168.0.254 Server: 192.168.0.254 Address: 192.168.0.254#53 Name: device_in_server_lan Address: 192.168.0.249 #same for name on wan, with additional notif "Non-authoritative answer:" [/code] Please what should I do to have this command line to work ? I read the man and see push dhcp options is not compatible with linux but n-m-o works. Although maybe this a up script case of use but I found no example on this in the man Here is the client log: [code]... Sun Nov 27 22:11:08 2016 us=774252 [Server] Peer Connection Initiated with [AF_INET]111.222.333.196:1194 Sun Nov 27 22:11:11 2016 us=148707 SENT CONTROL [Srveur]: 'PUSH_REQUEST' (status=1) Sun Nov 27 22:11:11 2016 us=213621 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 192.168.0.254,route-delay 5 5,route-gateway 10.0.64.81,topology subnet,ping 10,ping-restart 120,ifconfig 10.0.64.82 255.255.255.240' Sun Nov 27 22:11:11 2016 us=213697 OPTIONS IMPORT: timers and/or timeouts modified Sun Nov 27 22:11:11 2016 us=213705 OPTIONS IMPORT: --ifconfig/up options modified Sun Nov 27 22:11:11 2016 us=213709 OPTIONS IMPORT: route options modified Sun Nov 27 22:11:11 2016 us=213713 OPTIONS IMPORT: route-related options modified Sun Nov 27 22:11:11 2016 us=213717 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified Sun Nov 27 22:11:11 2016 us=213851 ROUTE_GATEWAY home.lan.gw.ipaddr/255.255.255.0 IFACE=wlan0 HWADDR=la:pm:ac:ad:dr:es Sun Nov 27 22:11:11 2016 us=214028 TUN/TAP device tun0 opened Sun Nov 27 22:11:11 2016 us=214057 TUN/TAP TX queue length set to 100 Sun Nov 27 22:11:11 2016 us=214075 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0 Sun Nov 27 22:11:11 2016 us=214100 /sbin/ip link set dev tun0 up mtu 1500 Sun Nov 27 22:11:11 2016 us=216235 /sbin/ip addr add dev tun0 10.0.64.82/28 broadcast 10.0.64.95 Sun Nov 27 22:11:16 2016 us=408754 /sbin/ip route add 111.222.333.196/32 via home.lan.gw.ipaddr Sun Nov 27 22:11:16 2016 us=409992 /sbin/ip route add 0.0.0.0/1 via 10.0.64.81 Sun Nov 27 22:11:16 2016 us=411269 /sbin/ip route add 128.0.0.0/1 via 10.0.64.81 Sun Nov 27 22:11:16 2016 us=413109 Initialization Sequence Completed[/code] Thank you for advises

On the client you should find a file called /etc/openvpn/update-resolv-conf Use it in the client config file like so:[code]up /etc/openvpn/update-resolv-conf down /etc/openvpn/update-resolv-conf[/code]

[quote="vipi"]Commented it works OK, but ... security concern[/quote]See: https://github.com/OpenVPN/openvpn/blob/master/src/plugins/down-root/README.down-root

[quote="BigBrother"]You know it's funny but that's my ip address and personal home network, but i don't remember hiring any work to be done on it. Who exactly are you?[/quote] You do realize that his IP addresses are in private space and only accessible by devices on his local network. Millions of people use private IP spaces not just you. :?

BTW, for dd-wrt users, don't forget this in Services.asp dnsmasq options: interface=tun2 # allows dnsmasq to listen to the tun interface for clients DNS & DHCP queries... no-dhcp-interface=tun2 # ...but drops DHCP queries which seem to be handled by OpenVPN server :)

Client doesn't get DNS

vipi

Hi openvpn community
I'm setting a vpn server and meet DNS issues.
The server is 2.3.12 running in the latest dd-wrt site main gateway with --default-gateway def1 and --topology subnet for 2~3 windows7+ clients.
The client from which I'd like to remotely manage the server is 2.3.2 from my ubuntu 14.04.5.
I didn't need to push site lan route to the client for it to be able to ping IPs in the site lan.
Although I had to manually add a firewall rule so that the client get replies when pinging IPs in the wan:

iptables -t nat -A POSTROUTING -s `nvram get openvpn_net`/`nvram get openvpn_tunmask` -o `get_wanface` -j SNAT --to nvram get wan_ipaddr

The server OS routes are:

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         111.222.333.193 0.0.0.0         UG    0      0        0 vlan2  # ISP gateway IP in the wan
10.0.64.80      0.0.0.0         255.255.255.240 U     0      0        0 tun2  # vpn net
127.0.0.0       0.0.0.0         255.0.0.0       U     0      0        0 lo
169.254.0.0     0.0.0.0         255.255.0.0     U     0      0        0 br0
192.168.0.0     0.0.0.0         255.255.255.0   U     0      0        0 br0  # Site lan
111.222.333.192 0.0.0.0         255.255.255.192 U     0      0        0 vlan2  # ISP wan net - my gateway is dhcp allocated 111.222.333.196 plus 2 DNS

The Server isdh /path/dh.pem
ca /path/ca.crt
cert /path/cert.pem
key /path/key.pem
keepalive 10 120
verb 3
mute 3
syslog
writepid /path/openvpnd.pid
management 127.0.0.1 port
management-log-cache size
topology subnet
script-security 2
port 1194
proto udp
cipher same-as-clients
auth same-as-clients
client-connect /path/clcon.sh
client-disconnect /path/cldiscon.sh
client-config-dir /path/ccd
comp-lzo adaptive
tls-server
ifconfig-pool-persist /path/ip-pool 86400
push "redirect-gateway def1"
tls-cipher same-as-clients
fast-io
tun-mtu 1500
mtu-disc yes
server 10.0.64.80 255.255.255.240
dev tun2
tun-ipv6
tls-auth /tmp/openvpn/ta.key 0
push "dhcp-option DNS 192.168.0.254" ## dnsmasq in the gateway
push "route-delay 5 5"
;push "route 192.168.0.0 255.255.255.0" I see two different behaviour on the client depending on I use:
In network-manager-openvpn where I don't get the 0/1 & 128.0.0.0/1 routes, but I get DNS and can ping & browse both lan & wan names since I allowed the dnsmasq server to listen to the vpn interface in the server

interface=tun2
no-dhcp-interface=tun2

...
[vpn]
service-type=org.freedesktop.NetworkManager.openvpn
ta-dir=1
connection-type=tls
auth=same-as-server
remote=site (ip from my hosts file, same as above)
cipher=same-as-server
comp-lzo=yes
cert-pass-flags=0
port=1194
remote-cert-tls=server
cert=/path/me.crt
ca=/path/site.crt
key=/path/me.key
ta=/path/ta-site.key

[ipv4]
method=auto or sudo openvpn site.conf where I get the two routes above but no DNS so that I can't ping names in the site lan nor wan client
dev tun
proto udp
remote 111.222.333.196 1194
resolv-retry infinite
nobind
;user nobody
;group nogroup
persist-key
persist-tun
mute-replay-warnings
ca site.crt
cert me.crt
key me.key
ns-cert-type server
tls-auth ta-site.key 1
auth same-as-server
cipher same-as-server
tls-cipher same-as-server
comp-lzo
verb 4
mute 20

nslookup device_in_server_lan or wan
;; connection timed out; no servers could be reached

me@client:~/openvpn$ nslookup device_in_server_lan 192.168.0.254
Server:		192.168.0.254
Address:	192.168.0.254#53

Name:	device_in_server_lan
Address: 192.168.0.249

#same for name on wan, with additional notif "Non-authoritative answer:"

Please what should I do to have this command line to work ? I read the man and see push dhcp options is not compatible with linux but n-m-o works. Although maybe this a up script case of use but I found no example on this in the man
Here is the client log:

...
Sun Nov 27 22:11:08 2016 us=774252 [Server] Peer Connection Initiated with [AF_INET]111.222.333.196:1194
Sun Nov 27 22:11:11 2016 us=148707 SENT CONTROL [Srveur]: 'PUSH_REQUEST' (status=1)
Sun Nov 27 22:11:11 2016 us=213621 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 192.168.0.254,route-delay 5 5,route-gateway 10.0.64.81,topology subnet,ping 10,ping-restart 120,ifconfig 10.0.64.82 255.255.255.240'
Sun Nov 27 22:11:11 2016 us=213697 OPTIONS IMPORT: timers and/or timeouts modified
Sun Nov 27 22:11:11 2016 us=213705 OPTIONS IMPORT: --ifconfig/up options modified
Sun Nov 27 22:11:11 2016 us=213709 OPTIONS IMPORT: route options modified
Sun Nov 27 22:11:11 2016 us=213713 OPTIONS IMPORT: route-related options modified
Sun Nov 27 22:11:11 2016 us=213717 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Sun Nov 27 22:11:11 2016 us=213851 ROUTE_GATEWAY home.lan.gw.ipaddr/255.255.255.0 IFACE=wlan0 HWADDR=la:pm:ac:ad:dr:es
Sun Nov 27 22:11:11 2016 us=214028 TUN/TAP device tun0 opened
Sun Nov 27 22:11:11 2016 us=214057 TUN/TAP TX queue length set to 100
Sun Nov 27 22:11:11 2016 us=214075 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Sun Nov 27 22:11:11 2016 us=214100 /sbin/ip link set dev tun0 up mtu 1500
Sun Nov 27 22:11:11 2016 us=216235 /sbin/ip addr add dev tun0 10.0.64.82/28 broadcast 10.0.64.95
Sun Nov 27 22:11:16 2016 us=408754 /sbin/ip route add 111.222.333.196/32 via home.lan.gw.ipaddr
Sun Nov 27 22:11:16 2016 us=409992 /sbin/ip route add 0.0.0.0/1 via 10.0.64.81
Sun Nov 27 22:11:16 2016 us=411269 /sbin/ip route add 128.0.0.0/1 via 10.0.64.81
Sun Nov 27 22:11:16 2016 us=413109 Initialization Sequence Completed

Thank you for advises

TinCanTech

On the client you should find a file called /etc/openvpn/update-resolv-conf

Use it in the client config file like so:

up /etc/openvpn/update-resolv-conf
down /etc/openvpn/update-resolv-conf

vipi

Thanks you man, this works.
I had to lower security by rising script-security to 2 (script-security=2 in my dot conf file).
What should I do then with both

;user nobody
;group nogroup

?
Commented it works OK, but ... security concern?
Uncommented connection is OK, but disconnection (Ctrl+C) gives the following and leaves names resolution poorly responsive (although still working)

^CMon Nov 28 16:00:16 2016 us=54744 event_wait : Interrupted system call (code=4)
Mon Nov 28 16:00:16 2016 us=55253 TCP/UDP: Closing socket
Mon Nov 28 16:00:16 2016 us=55399 /sbin/ip route del 111.222.333.196/32
RTNETLINK answers: Operation not permitted
Mon Nov 28 16:00:16 2016 us=57595 ERROR: Linux route delete command failed: external program exited with error status: 2
Mon Nov 28 16:00:16 2016 us=57704 /sbin/ip route del 0.0.0.0/1
RTNETLINK answers: Operation not permitted
Mon Nov 28 16:00:16 2016 us=59139 ERROR: Linux route delete command failed: external program exited with error status: 2
Mon Nov 28 16:00:16 2016 us=59233 /sbin/ip route del 128.0.0.0/1
RTNETLINK answers: Operation not permitted
Mon Nov 28 16:00:16 2016 us=60912 ERROR: Linux route delete command failed: external program exited with error status: 2
Mon Nov 28 16:00:16 2016 us=60965 Closing TUN/TAP interface
Mon Nov 28 16:00:16 2016 us=61005 /sbin/ip addr del dev tun0 10.0.64.82/28
RTNETLINK answers: Operation not permitted
Mon Nov 28 16:00:16 2016 us=62349 Linux ip addr del failed: external program exited with error status: 2
Mon Nov 28 16:00:16 2016 us=88812 /etc/openvpn/update-resolv-conf tun0 1500 1558 10.0.64.82 255.255.255.240 init
rm: cannot remove 'tun0.openvpn': Permission denied
Mon Nov 28 16:00:16 2016 us=92589 WARNING: Failed running command (--up/--down): external program exited with error status: 1
Mon Nov 28 16:00:16 2016 us=92618 Exiting due to fatal error

I think I found why : it leaves the remote lan DNS server in my /run/resolvconf/resolv.conf on top of list, and as it is no more available, each new search is laggy until the resolver falls back to 127.0.1.1#53.

Whatever, I'll search the web for an elegant solution (maybe a cron, but I don't like that much, too easy to forget, or tweaking the update-resolv-conf so that it asks for credentials to run a personal script that will do the failed commands...) and understanding security concerns, now I know what to search the harder is done, I hope.
And thanks so much for your gentle answer. Openvpn is really a gorgeous piece of soft.

TinCanTech

vipi wroteCommented it works OK, but ... security concern

See:
https://github.com/OpenVPN/openvpn/blob/master/src/plugins/down-root/README.down-root

vipi

Nice
Thaanks again

BigBrother

You know it's funny but that's my ip address and personal home network, but i don't remember hiring any work to be done on it. Who exactly are you?

vipi

BigBrother wroteYou know it's funny but that's my ip address and personal home network, but i don't remember hiring any work to be done on it. Who exactly are you?

Who are you talking to ?

Jlennemann

BigBrother wroteYou know it's funny but that's my ip address and personal home network, but i don't remember hiring any work to be done on it. Who exactly are you?

You do realize that his IP addresses are in private space and only accessible by devices on his local network. Millions of people use private IP spaces not just you. :?

vipi

Which private IP are you talking about ? 127.0.0.1 ? Hoooo, strange, all my network devices have the same :shock:
Or the 192.168.0.0/24 ? Pretty common 🙁 that why the OpenVPN discourages the use of it.
Or the 10.0.64.80 ? I have my own mnemo to choose the last 3 bytes, or sometimes I choose one that can be easily one-hand typed on a laptop keyboard when one hand holds the phone, one other the cigarette, and a third one a beer. Damned the ufcking "1" and "2" are always located on the opposite side :x
Do you have /28 netmask too ?

vipi

Sorry, we encountered an error while displaying this content. If you're a user, please try again later. If you're an administrator, take a look in your Flarum log files for more information.