Raspberry Pi OpenVPN Spamming Reverse DNS Lookup

mobalized

I have a Pi that has been running an OpenVPN server for a couple months now and I have not had any issues with its function. However, today I set up a syslog server for my router and I have noticed that the log file is getting absolutely blasted with reverse DNS lookups. I have three Pi's running and this is the only one doing it on a fresh install of Raspbian with OpenVPN being the only difference. For this reason it makes me believe that it is something going on with the vpn server. Any thoughts on this or if it is likely caused by something else?

Dec  7 19:58:41 2016 SYSLOG[0]: [Host 192.168.0.1] UDP 192.168.0.52,47781 --> 8.8.8.8,53 ALLOW: Outbound access request [DNS query for 1.0.168.192.in-addr.arpa.]
Dec  7 19:58:41 2016 SYSLOG[0]: [Host 192.168.0.1] UDP 192.168.0.52,33291 --> 8.8.8.8,53 ALLOW: Outbound access request [DNS query for 1.0.168.192.in-addr.arpa.]
Dec  7 19:58:41 2016 SYSLOG[0]: [Host 192.168.0.1] UDP 192.168.0.52,60705 --> 8.8.8.8,53 ALLOW: Outbound access request [DNS query for 1.0.168.192.in-addr.arpa.]
Dec  7 19:58:41 2016 SYSLOG[0]: [Host 192.168.0.1] UDP 192.168.0.52,40618 --> 8.8.8.8,53 ALLOW: Outbound access request [DNS query for 1.0.168.192.in-addr.arpa.]
Dec  7 19:58:41 2016 SYSLOG[0]: [Host 192.168.0.1] UDP 192.168.0.52,60656 --> 8.8.8.8,53 ALLOW: Outbound access request [DNS query for 1.0.168.192.in-addr.arpa.]
Dec  7 19:58:41 2016 SYSLOG[0]: [Host 192.168.0.1] UDP 192.168.0.52,52021 --> 8.8.8.8,53 ALLOW: Outbound access request [DNS query for 1.0.168.192.in-addr.arpa.]
Dec  7 19:58:41 2016 SYSLOG[0]: [Host 192.168.0.1] UDP 192.168.0.52,46116 --> 8.8.8.8,53 ALLOW: Outbound access request [DNS query for 1.0.168.192.in-addr.arpa.]
Dec  7 19:58:41 2016 SYSLOG[0]: [Host 192.168.0.1] UDP 192.168.0.52,33589 --> 8.8.8.8,53 ALLOW: Outbound access request [DNS query for 1.0.168.192.in-addr.arpa.]
Dec  7 19:58:41 2016 SYSLOG[0]: [Host 192.168.0.1] UDP 192.168.0.52,45992 --> 8.8.8.8,53 ALLOW: Outbound access request [DNS query for 1.0.168.192.in-addr.arpa.]
Dec  7 19:58:42 2016 SYSLOG[0]: [Host 192.168.0.1] UDP 192.168.0.52,54276 --> 8.8.8.8,53 DENY: Inbound or outbound [LAN-side UDP Flood] attack
Dec  7 19:58:47 2016 SYSLOG[0]: [Host 192.168.0.1] UDP 192.168.0.52,54276 --> 8.8.8.8,53 ALLOW: Outbound access request [DNS query for 1.0.168.192.in-addr.arpa.]
Dec  7 19:58:47 2016 SYSLOG[0]: [Host 192.168.0.1] UDP 192.168.0.52,46991 --> 8.8.8.8,53 ALLOW: Outbound access request [DNS query for 1.0.168.192.in-addr.arpa.]
Dec  7 19:58:47 2016 SYSLOG[0]: [Host 192.168.0.1] UDP 192.168.0.52,34459 --> 8.8.8.8,53 ALLOW: Outbound access request [DNS query for 1.0.168.192.in-addr.arpa.]
Dec  7 19:58:47 2016 SYSLOG[0]: [Host 192.168.0.1] UDP 192.168.0.52,48138 --> 8.8.8.8,53 ALLOW: Outbound access request [DNS query for 1.0.168.192.in-addr.arpa.]
Dec  7 19:58:47 2016 SYSLOG[0]: [Host 192.168.0.1] UDP 192.168.0.52,34044 --> 8.8.8.8,53 ALLOW: Outbound access request [DNS query for 1.0.168.192.in-addr.arpa.]
Dec  7 19:58:47 2016 SYSLOG[0]: [Host 192.168.0.1] UDP 192.168.0.52,57829 --> 8.8.8.8,53 ALLOW: Outbound access request [DNS query for 1.0.168.192.in-addr.arpa.]
Dec  7 19:58:47 2016 SYSLOG[0]: [Host 192.168.0.1] UDP 192.168.0.52,54601 --> 8.8.8.8,53 ALLOW: Outbound access request [DNS query for 1.0.168.192.in-addr.arpa.]
Dec  7 19:58:47 2016 SYSLOG[0]: [Host 192.168.0.1] UDP 192.168.0.52,48719 --> 8.8.8.8,53 ALLOW: Outbound access request [DNS query for 1.0.168.192.in-addr.arpa.]
Dec  7 19:58:47 2016 SYSLOG[0]: [Host 192.168.0.1] UDP 192.168.0.52,54128 --> 8.8.8.8,53 ALLOW: Outbound access request [DNS query for 1.0.168.192.in-addr.arpa.]
Dec  7 19:58:47 2016 SYSLOG[0]: [Host 192.168.0.1] UDP 192.168.0.52,42749 --> 8.8.8.8,53 DENY: Inbound or outbound [LAN-side UDP Flood] attack
Dec  7 19:58:52 2016 SYSLOG[0]: [Host 192.168.0.1] UDP 192.168.0.52,42749 --> 8.8.8.8,53 ALLOW: Outbound access request [DNS query for 1.0.168.192.in-addr.arpa.]
Dec  7 19:58:52 2016 SYSLOG[0]: [Host 192.168.0.1] UDP 192.168.0.52,40286 --> 8.8.8.8,53 ALLOW: Outbound access request [DNS query for 1.0.168.192.in-addr.arpa.]
Dec  7 19:58:52 2016 SYSLOG[0]: [Host 192.168.0.1] UDP 192.168.0.52,55261 --> 8.8.8.8,53 ALLOW: Outbound access request [DNS query for 1.0.168.192.in-addr.arpa.]
Dec  7 19:58:52 2016 SYSLOG[0]: [Host 192.168.0.1] UDP 192.168.0.52,51153 --> 8.8.8.8,53 ALLOW: Outbound access request [DNS query for 1.0.168.192.in-addr.arpa.]
Dec  7 19:58:52 2016 SYSLOG[0]: [Host 192.168.0.1] UDP 192.168.0.52,55636 --> 8.8.8.8,53 ALLOW: Outbound access request [DNS query for 1.0.168.192.in-addr.arpa.]

TinCanTech

mobalized wrote8.8.8.8,53 ALLOW: Outbound access request [DNS query for 1.0.168.192.in-addr.arpa.]

You are asking google for your private server name .. which is never going to work.

mobalized

TinCanTech wrote
mobalized wrote8.8.8.8,53 ALLOW: Outbound access request [DNS query for 1.0.168.192.in-addr.arpa.]
You are asking google for your private server name .. which is never going to work.

So I determined that it is not associated with OpenVPN. But it is associated with the Syslog server. I am not sure how to stop those requests though. I have tried adding net.enableDNS="off" to syslog.conf. Any ideas how that can be stopped?

TinCanTech

Use IP address not name.

mobalized

Can you elaborate on how to do that? Is that done through the conf file?

mobalized

TinCanTech wroteUse IP address not name.

I've been looking for a solution and have yet to find one. My log conf file (not my syslog.conf) contains fromhost-ip, I thought this is what would tell it to disregard the hostname and use IP though that isn't the case clearly.

TinCanTech

mobalized wroteDec 7 19:58:41 2016 SYSLOG[0]: [Host 192.168.0.1] UDP 192.168.0.52,47781 --> 8.8.8.8,53 ALLOW: Outbound access request [DNS query for 1.0.168.192.in-addr.arpa.]

mobalized wroteit is associated with the Syslog server

No, it is not.

mobalized wroteMy log conf file (not my syslog.conf) contains fromhost-ip, I thought this is what would tell it to disregard the hostname and use IP though that isn't the case clearly

Something on 192.168.0.52 is trying to do reverse ? DNS lookup for 192.168.0.1 .. Something is configured badly but it could be anything.

mobalized

TinCanTech wrote
mobalized wroteDec 7 19:58:41 2016 SYSLOG[0]: [Host 192.168.0.1] UDP 192.168.0.52,47781 --> 8.8.8.8,53 ALLOW: Outbound access request [DNS query for 1.0.168.192.in-addr.arpa.]
mobalized wroteit is associated with the Syslog server
No, it is not.
mobalized wroteMy log conf file (not my syslog.conf) contains fromhost-ip, I thought this is what would tell it to disregard the hostname and use IP though that isn't the case clearly
Something on 192.168.0.52 is trying to do reverse ? DNS lookup for 192.168.0.1 .. Something is configured badly but it could be anything.

I retract my initial question. It in some way has to be associated with the syslog server. I had disabled the server on one of the network Pi's and enabled it on another Pi. The second Pi's IP then became the culprit committing the look ups. I'm assuming that doesn't give you any ideas, but I'll ask anyways. Do you have any thoughts on a solution?

TinCanTech

TinCanTech wrote
mobalized wroteDec 7 19:58:41 2016 SYSLOG[0]: [Host 192.168.0.1] UDP 192.168.0.52,47781 --> 8.8.8.8,53 ALLOW: Outbound access request [DNS query for 1.0.168.192.in-addr.arpa.]
mobalized wroteit is associated with the Syslog server
No, it is not.
mobalized wroteMy log conf file (not my syslog.conf) contains fromhost-ip, I thought this is what would tell it to disregard the hostname and use IP though that isn't the case clearly
Something on 192.168.0.52 is trying to do reverse ? DNS lookup for 192.168.0.1 .. Something is configured badly but it could be anything.

mobalized wroteI had disabled the server on one of the network Pi's and enabled it on another Pi. The second Pi's IP then became the culprit committing the look ups

May be it is syslog server .. doing something like "Resolve Client Host name" ..