How to get clients to use server's (W7) hosts file?

zYx

Hi there,

my setup: iOS 10 device Connected remotely via 3G/4G to the server on Windows 7. I use a custom hosts file to block certain servers. The client device seems to be ignoring this, which from what I've seen on Google, is "normal". I just couldn't find any solution that would work for me.

Is there a way to get all clients to use that hosts file installed on Windows 7, where OpenVPN server is running? Or use a similar hosts file with in OpenVPN?

Server config file

local 192.168.0.19 
dev tun
proto udp
tun-mtu 1500
mssfix 1450
port 1194
ca "C:\\Program Files (x86)\\OpenVPN\\config\\ca.crt"
cert "C:\\Program Files (x86)\\OpenVPN\\config\\server.crt"
key "C:\\Program Files (x86)\\OpenVPN\\config\\server.key"
dh "C:\\Program Files (x86)\\OpenVPN\\config\\dh1024.pem"
server 10.8.0.0 255.255.255.0
# server and remote endpoints
ifconfig 10.8.0.1 10.8.0.2
# Add route to Client routing table for the OpenVPN Server
push "route 10.8.0.1 255.255.255.255"
# Add route to Client routing table for the OpenVPN Subnet
push "route 10.8.0.0 255.255.255.0"
# your local subnet
push "route 192.168.0.1 255.255.255.255" 
# Set primary domain name server address to the SOHO Router
# If your router does not do DNS, you can use Google DNS 8.8.8.8
push "dhcp-option DNS 192.168.0.1" # THIS SHOULD ALREADY MATCH YOUR OWN ROUTER ADDRESS AND SHOULD NOT NEED$
# Override the Client default gateway by using 0.0.0.0/1 and
# 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of
# overriding but not wiping out the original default gateway.
push "redirect-gateway def1"
client-to-client
duplicate-cn
keepalive 15 60
;tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0
;cipher AES-128-CBC
comp-lzo
;user nobody
;group nogroup
persist-key
persist-tun
;status /var/log/openvpn-status.log 20
;log /var/log/openvpn.log
verb 1

(oconf BB code didn't work :/)

some of options are disabled, some enabled for experimenting purposes and this configuration works fine with me. I did have to enable ISC on W7 to get this working on my iPhone.

So, I have an Intel-NUC with Windows 7 and OpenVPN installed on it. It runs 24/7. My router IP is 192.168.0.1 and Intel NUC's IP is 192.168.0.19

I currently have something like this: 127.0.0.0 facebook.com to block Facebook, and so on. Facebook will be blocked on Windows 7, but it will work fine on my iPhone.

Any advise will be much appreciated.

TinCanTech

zYx wroteIs there a way to get all clients to use that hosts file installed on Windows 7, where OpenVPN server is running?

You would need your Windows 7 machine to be running a private DNS server.

zYx wroteMy router IP is 192.168.0.1 and Intel NUC's IP is 192.168.0.19

This is a bad idea ..

NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.

:arrow: Never use 192.168.0.0/24 or 192.168.1.0/24 (or other common subnets) for your OpenVPN Server LAN :!:

You are advised to change your server LAN to a more unique RFC1918 compliant subnet. f.e 192.168.143.0/24

zYx

Thanks TinCanTech for your info. I am aware of those conflicts and I'm only testing at this stage. I'm only really planning to use this VPN via mobile connections. I have unlimited 4G data.

Will enabling DNS server feature on W7 do? I just tried it, but I wouldn't know where to start. I also have a VM Windows Server, I shall try that... Do I understand it correctly that i have to have a seperate Winodws machine running just DNS server?

All I'm trying to do is to block ads on my iPhone. Perhaps there are easier ways of doing this?

Or, can I block a web address/server within a config file?

SomeGuy

zYx wroteWill enabling DNS server feature on W7 do? I just tried it, but I wouldn't know where to start. I also have a VM Windows Server, I shall try that... Do I understand it correctly that i have to have a seperate Winodws machine running just DNS server?

A DNS Server can run on the same server as the OpenVPN Server.

That approach is a good one to provide bogus DNS resolution to clients. In order to make that work, you would need to configure a DNS server with all "zones" for each domain you want to block, and answer authoritatively for each, and all clients would need to be configured to only use that DNS server (and any other DNS Servers you run like it.) In this way, you would MitM (Man-in-the-Middle) all of the DNS requests to provide the answers you want for each FQDN requested lookup.)

There may be complications, however, if any of those domains use DNSSEC, and end-clients with enabled support for DNSSEC in their resolver may find that these domains should be secured with DNSSEC records and your answers won't be signed with the right key, or any key. This may not be bad if you are only interested in denying service to entire domains, but for other uses, risk for creating a DoS in your clients access to resolve some names.

It is the approach I would use if I was going to manage it.

There may be DNS Servers out there that do this for you. If so, you can just send these DNS Server IP to your clients, but that is relying on a 3rd party to manage these for you.

Another option which is a bit kludgy would be to have your windows OpenVPN Server also run a WINS server, and populate it with the names you want to have resolve to another IP. (At one time, the default for MS Windows for resolving names to addresses was: "lmhosts" file first, "hosts" second, "WINS server" third, then "DNS Servers" last. Using WINS kind of relies on side-effects and is limited to just Windows clients, and an assumption on their configuration for name resolution. It is a poorer choice than your own DNS.

All I'm trying to do is to block ads on my iPhone. Perhaps there are easier ways of doing this?

A third party DNS that does this for you, but that has its own issues in trusting them.

Or, can I block a web address/server within a config file?

I do not think so.

You could "push" routes for all IP that the names you do not want to be reachable to be a gateway other than you, or maybe a metric that breaks after 1 hop, but that is also kludgy and relies on side-effects, and would need up-keep to resolve names to the IP to block, and coulc exceed the maximum number of routes pushed by a server to clients.

SomeGuy

On second thought, the "pushed routes" is even worse as an idea, since the metrics would require policy/cost-based routing to consume the metrics, and then change what happens to those packets when routed. Please ignore that as a suggestion; too much overhead is required to make it work.

If the OpenVPN server is meant to take all IPv4 traffic from your client, then the server could have network filter rules to block subnets that you have found advertisers use for web content, but this is also a bad idea, as there is no guarantee that there is no overlap between advertisers content from those IP addresses and content you actually want. This would also require refreshing the IP from DNS lookups periodically, so not reliable, too.

From the OpenVPN server, local routing for each subnet to go to blackhole IP using the same lookup for IP addresses and subnets, but again, such a list would need to be regenerated periodically, and suffers the same risk of collateral loss of data, and require all traffic pass through the OpenVPN Server.

So, the WINS option may work for windows clients, as you can push a WINS server setting to OpenVPN clients on connect, but it will require clients resolve through WINS before DNS, and for you to populate names in WINS service on your OpenVPN Server (or whatever server is doing WINS for you.) Also, this it limited to just windows clients.

A google search for public DNS that filter out ad servers shows several providers, and would be the easiest, but relies/requires:
* The provider is reliable; if they are offline much, and they are the only provider of DNS for you, when DNS resolution happens, clients are unhappy
* You trust that DNS provider to not do anything underhanded or deceptive or provide you with results from poisoned DNS caches that they allow to be added.
* They maintain their security to prevent a third party evil user from altering zones and adding records that could be bad for you (drive-by download web servers on IP addresses in a botnet)
* You have no control over what is added or removed; at best you have a method to request addition of new entries and removal of false-positives
* Your network admin does not care if you use other DNS and will not block this.
* You do not need access to internal resource that are available with DNS lookup to an internal server that serves resolution for names that do not resolve on public DNS Servers.
* Probably more items...

zYx

Thanks SomeGuy for your great info.

It seems more complicated than I anticipated.

I found some DNS services online, but like you say, should you trust them entirely? I will try it for sure. But ultimately I'd like to run it myself. I'm currently trying to create a DNS server on VM Windows Server 2016. I'm very new to Windows Server. The Intel-NUC is running Windows 7, but eventually I want to run Windows Server on it, so I'm experimenting with various settings.

I'm not expecting more clients than like 2-3 iPhones/devices.

I'm just not quite sure how to configure my own DNS server on the same Windows 7/Server where the modified hosts file is installed. I suppose setting it up on Windows Server will be easier.
Basically, what are the steps in relation to zones and linking that DNS server with Windows Server's hosts file? Once the DNS server is set up, what will I need to do in OpenVPN config?

SomeGuy

I'm just not quite sure how to configure my own DNS server on the same Windows 7/Server where the modified hosts file is installed. I suppose setting it up on Windows Server will be easier.
Basically, what are the steps in relation to zones and linking that DNS server with Windows Server's hosts file?

If you plan to run our own DNS Server, then your first step should be to try to setup a generic DNS that is capable of accepting requests from clients, and then complete "fully recursive" resolution of lookups that clients request of it. You will want to limit access to your DNS server (with full recursion) to just your own clients for security reasons. You may want to look into totally disabling DNS caching on your server, too, for security reasons (or set an upper limit for caching to be ~10 minutes regardless of the TTL provided to you on query.)

Setting up a DNS server has security issues (DNS cache poisoning, DNSSEC validation and failing to validate chain to root signer, risks for becoming an unwitting participant in a network-based "amplification attack" like "recent" attacks against NTP and a bit more distant attacks against DNS Servers.)

Making your DNS server internal-only can help decrease these risks, but not eliminate them.

After you have a working, generic DNS Server internally completing fully recursive lookups for clients (and not asking clients to take the information you provide and move on to other DNS servers) then you can look to create "zone files" (or zones -- I have not configured DNS on Windows. I've work with BIND/named.) Each zone would contain a domain, and you could then have all lookups for hosts in a domain, or specific names in a domain resolve to the same IP address like 127.0.0.1, or something else.)

When your DNS is completing the fully recursive lookup of names to IP, you can then block DNS lookups that do not pass through your DNS Server, to bypass your DNS filtering.

It is possible someone may have built a simple DNS server or procedure for doing what i describe for MS Windows. Once you have a procedure the steps to populate your zones/zone-files is trivial.

For DNS, I am going to suggest you check for a DNS Server support forum. It is possible someone here is experienced with this for windows and willing and able to help you, it is technically beyond the scope of "OpenVPN Server Config Files" (the topic of this forum.) I do not know how strict the mods/admin of this forum are with respect to "off topic conversations."

Hopefully, the information I provided with you above on setting up a DNS Server is enough for your to find keywords sufficient to help you to use google to find support specific to DNS for Windows and setting up your own DNS to filter domain lookups you want to filter from your hosts.

If/when you do find a forum or details on how to do this for windows, would you provide a link to what you found that helped you?
Such information will help anyone else that is looking to do what you are planning to do when they complete a google search.

Once the DNS server is set up, what will I need to do in OpenVPN config?

Once you have a working DNS Server, you could push the IP address for your DNS to your clients for them to use it.
See OpenVPN docs on "dhcp-option" and DNS server IP addresses that can be pushed by server to connecting clients. (Same with WINS if you chose that route.)

zYx

Thank you so much for your help. I'm sure admins won't mind 🙂

I will continue with my setup and I will post once I'm finished. However those DNS Services available online don't seem too bad. They get updated regularly.

My last question, in relation to OpenVPN, can I use this two DNS servers? Can I just duplicate this option like below?

dhcp-option DNS 192.168.0.1
dhcp-option DNS 192.168.0.2

or like this?

dhcp-option DNS 192.168.0.1, 192.168.0.2

I'm finding conflicting info about this.

SomeGuy

The man page says:

--dhcp-option type [parm]
Set extended TAP-Win32 TCP/IP properties, *must* be used with --ip-win32 dynamic or --ip-win32 adaptive.
[chop]
DNS addr -- Set primary domain name server address. Repeat this option to set secondary DNS server addresses.
[chop]

So, that would mean from the server config:

push "dhcp-option DNS 192.168.0.1"
push "dhcp-option DNS 192.168.0.2"

or you could test in a client config:

ip-win32 [dynamic||adaptive] ... # This is not a literal value, these are options for choices based on man page directions on use of "--dhcp-option"
dhcp-option DNS 192.168.0.1
dhcp-option DNS 192.168.0.2

Each "dhcp-option" should be evaluated by the client, one ata time. Same would be true with multiple NTP servers, one NTP server would be specified per "dhcp-option" line in config.

If you "push" the settings from the server config, then the client does not need them in its config.

(IIRC, from linux, when a linux client gets these settings, they are in an array-like listing of dhcp options environmental variables with each option (ntp, dns, wins, etc) in a separate variable/index. Having one value for each variable/value makes parsing these variables easier from non-windows machines, too.)

Remember, if you change your server config, you need the server to reload the config. This can be done many ways, but a bounce of just the OpenVPN service will work.

300000

it is very easy done with little help from dns server run in your windows 7 . you can use hosts file from win7 to block what ever you like . but it will be slow down dns lookup if the host file very big .

my openvpn server run on meegopad t07 24/7 and setup hostfile to block ad so when ever i go out just make connect to openvpn and suf the web must faster because there is no ad

there is no need to run winserver at all . all you need is software dns server run on win7 and it will run ok . you can map host name with ip in your device at home so instead input ip just type the name and it will works out for you .