Hi all, another bug, unless you have redirect-gateway def1 on client side, DNS settings will not be received by client (pushed from server)... is there any procedure to rollback from previous version please ? Thanks.

[quote=cyayon post_id=75591 time=1515503576 user_id=42903] Hi all, another bug, unless you have redirect-gateway def1 on client side, DNS settings will not be received by client (pushed from server)... [/quote] Could you please send the connection log to iOS @ openvpn . net ? [quote=cyayon post_id=75591 time=1515503576 user_id=42903] is there any procedure to rollback from previous version please ? [/quote] Not really. The AppStore does not allow that. Thanks

[quote=ordex post_id=75593 time=1515506753 user_id=39103] [quote=cyayon post_id=75591 time=1515503576 user_id=42903] Hi all, another bug, unless you have redirect-gateway def1 on client side, DNS settings will not be received by client (pushed from server)... [/quote] Could you please send the connection log to iOS @ openvpn . net ? [quote=cyayon post_id=75591 time=1515503576 user_id=42903] is there any procedure to rollback from previous version please ? [/quote] Not really. The AppStore does not allow that. Thanks [/quote] Nothing in the log about a problem with DNS. But when using another app and check my current IP params, the DNS settings has not been updated.... If i modify my opvn client config file and "add redirect-gateway def1", the DNS setting is correctly defined.

[quote=cyayon post_id=75601 time=1515509105 user_id=42903] Nothing in the log about a problem with DNS. [/quote] yeah, I did not expect an error. But the log should allow the devs to understand what's the flow of the setup routine and what is being skipped. You can email it to iOS @ openvpn.net and mention your problem, if possible. Thanks

[quote=ordex post_id=75602 time=1515509292 user_id=39103] [quote=cyayon post_id=75601 time=1515509105 user_id=42903] Nothing in the log about a problem with DNS. [/quote] yeah, I did not expect an error. But the log should allow the devs to understand what's the flow of the setup routine and what is being skipped. You can email it to iOS @ openvpn.net and mention your problem, if possible. Thanks [/quote] here is the log : -----------------2018-01-09 15:29:20 EVENT: RESOLVE 2018-01-09 15:29:20 Contacting [xxxx]:443/TCP via TCP 2018-01-09 15:29:20 EVENT: WAIT 2018-01-09 15:29:20 Connecting to [xxxx:443 (xxxx) via TCPv4 2018-01-09 15:29:20 EVENT: CONNECTING 2018-01-09 15:29:20 Tunnel Options:V4,dev-type tun,link-mtu 1544,tun-mtu 1500,proto TCPv4_CLIENT,comp-lzo,keydir 1,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client 2018-01-09 15:29:20 Creds: UsernameEmpty/PasswordEmpty 2018-01-09 15:29:20 Peer Info: IV_GUI_VER=net.openvpn.connect.ios 1.2.5-1 IV_VER=3.1.2 IV_PLAT=ios IV_NCP=2 IV_TCPNL=1 IV_PROTO=2 IV_LZO=1 IV_AUTO_SESS=1 IV_BS64DL=1 2018-01-09 15:29:20 VERIFY OK : depth=0 cert. version : 3 serial number : 01 issuer name : C=FR, L=Paris, O=xxxx, CN=xxxx, emailAddress=xxxx subject name : C=FR, L=Paris, O=xxxx, CN=xxxx, emailAddress=xxxx issued on : 2014-09-16 08:36:10 expires on : 2024-09-13 08:36:10 signed using : RSA with SHA1 RSA key size : 1024 bits basic constraints : CA=false cert. type : SSL Server key usage : Digital Signature, Key Encipherment ext key usage : TLS Web Server Authentication 2018-01-09 15:29:21 SSL Handshake: TLSv1.2/TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384 2018-01-09 15:29:21 Session is ACTIVE 2018-01-09 15:29:21 EVENT: GET_CONFIG 2018-01-09 15:29:21 Sending PUSH_REQUEST to server... 2018-01-09 15:29:21 OPTIONS: 0 [route] [192.168.1.0] [255.255.255.0] 1 [route] [192.168.2.0] [255.255.255.0] 2 [route] [192.168.3.0] [255.255.255.0] 3 [route] [192.168.4.0] [255.255.255.0] 4 [route] [192.168.40.0] [255.255.255.0] 5 [route] [192.168.42.0] [255.255.255.0] 6 [route] [192.168.43.0] [255.255.255.0] 7 [route] [192.168.44.0] [255.255.255.0] 8 [route] [192.168.250.0] [255.255.255.0] 9 [dhcp-option] [DOMAIN] [xxxx] [xxxx] 10 [dhcp-option] [DNS] [192.168.43.1] 11 [dhcp-option] [NTP] [192.168.42.254] 12 [route-gateway] [192.168.43.1] 13 [topology] [subnet] 14 [ping] [10] 15 [ping-restart] [60] 16 [socket-flags] [TCP_NODELAY] 17 [ifconfig] [192.168.43.2] [255.255.255.0] 18 [peer-id] [0] 19 [cipher] [AES-256-GCM] 2018-01-09 15:29:21 PROTOCOL OPTIONS: cipher: AES-256-GCM digest: SHA1 compress: LZO peer ID: 0 2018-01-09 15:29:21 EVENT: ASSIGN_IP 2018-01-09 15:29:21 NIP: preparing TUN network settings 2018-01-09 15:29:21 NIP: init TUN network settings with endpoint: xxxx 2018-01-09 15:29:21 NIP: adding IPv4 address to network settings 192.168.43.2/255.255.255.0 2018-01-09 15:29:21 NIP: adding (included) IPv4 route 192.168.1.0/24 2018-01-09 15:29:21 NIP: adding (included) IPv4 route 192.168.2.0/24 2018-01-09 15:29:21 NIP: adding (included) IPv4 route 192.168.3.0/24 2018-01-09 15:29:21 NIP: adding (included) IPv4 route 192.168.4.0/24 2018-01-09 15:29:21 NIP: adding (included) IPv4 route 192.168.40.0/24 2018-01-09 15:29:21 NIP: adding (included) IPv4 route 192.168.42.0/24 2018-01-09 15:29:21 NIP: adding (included) IPv4 route 192.168.43.0/24 2018-01-09 15:29:21 NIP: adding (included) IPv4 route 192.168.44.0/24 2018-01-09 15:29:21 NIP: adding (included) IPv4 route 192.168.250.0/24 2018-01-09 15:29:21 NIP: adding search domain xxxx 2018-01-09 15:29:21 NIP: adding search domain xxxx 2018-01-09 15:29:21 NIP: adding DNS 192.168.43.1 2018-01-09 15:29:21 Connected via NetworkExtensionTUN 2018-01-09 15:29:21 LZO-ASYM init swap=0 asym=0 2018-01-09 15:29:21 EVENT: CONNECTED @xxxx:443 (xxxx) via /TCPv4 on NetworkExtensionTUN/192.168.43.2/ gw=[/]

[quote=cyayon post_id=75607 time=1515512073 user_id=42903] 2018-01-09 15:29:21 NIP: adding DNS 192.168.43.1 [/quote] I see the DNS IP is being pushed down to the Apple API, therefore it should have been applied. Have you tried to verify on the server if any DNS traffic is coming from this device? Note that in this case the DNS is going to be private to the tunnel interface and not system-wide. Are you sure your app is able to see interface specific DNS settings?

With the latest 1.2.5 version, we can also confirm that custom DNS settings are not propagating to our users. How can we help to get this resolved as fast as possible?

[quote=risyer post_id=75616 time=1515516805 user_id=42906] With the latest 1.2.5 version, we can also confirm that custom DNS settings are not propagating to our users. How can we help to get this resolved as fast as possible? [/quote] Can you confirm that also in your case you are not pushing the default route to your clients? How are you verifying that the DNS settings are not applied? can you see actual traffic going to the wrong DNS? Thanks

>Can you confirm that also in your case you are not pushing the default route to your clients? What's the easiest way to confirm that? We don't pass through traffic. Can I email you a stripped down version of our logs? >How are you verifying that the DNS settings are not applied? can you see actual traffic going to the wrong DNS? On iOS, v1.1.1 we were able to access our intranet through apps, safari etc (I used it yesterday). Today on 1.2.5 we cannot, ontop of that our desktop clients work fine and android as well.

[quote=risyer post_id=75622 time=1515518190 user_id=42906] >Can you confirm that also in your case you are not pushing the default route to your clients? What's the easiest way to confirm that? We don't pass through traffic. Can I email you a stripped down version of our logs? [/quote] yes, please. The log of the connection setup, from the start to the CONNECTED event would be appreciated. You can paste it here if you can, in a code box. [quote=risyer post_id=75622 time=1515518190 user_id=42906] >How are you verifying that the DNS settings are not applied? can you see actual traffic going to the wrong DNS? On iOS, v1.1.1 we were able to access our intranet through apps, safari etc (I used it yesterday). Today on 1.2.5 we cannot, ontop of that our desktop clients work fine and android as well. [/quote] ok, this sounds suspicious. It might be related to this problem

[code] ----- OpenVPN Start ----- OpenVPN core 3.1.2 ios arm64 64-bit built on Jan 5 2018 23:09:59 2018-01-09 09:43:11 Frame=512/2048/512 mssfix-ctrl=1250 2018-01-09 09:43:11 UNUSED OPTIONS 3 [nobind] 16 [sndbuf] [100000] 17 [rcvbuf] [100000] 20 [verb] [3] 30 [CLI_PREF_ALLOW_WEB_IMPORT] [True] 31 [CLI_PREF_BASIC_CLIENT] [False] 32 [CLI_PREF_ENABLE_CONNECT] [True] 33 [CLI_PREF_ENABLE_XD_PROXY] [True] 34 [WSHOST] [xxxxxxxxxxxxx:443] 35 [WEB_CA_BUNDLE] [-----BEGIN CERTIFICATE----- ............] 36 [IS_OPENVPN_WEB_CA] [0] 37 [ORGANIZATION] [OpenVPN Technologies, Inc.] 2018-01-09 09:43:11 EVENT: RESOLVE 2018-01-09 09:43:12 Contacting [xx.xx.xx.xx]:1194/UDP via UDP 2018-01-09 09:43:12 EVENT: WAIT 2018-01-09 09:43:12 Connecting to [xxxxxxxxxxxxx]:1194 (xx.xx.xx.xx) via UDPv4 2018-01-09 09:43:12 EVENT: CONNECTING 2018-01-09 09:43:12 Tunnel Options:V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 1,cipher AES-128-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-client 2018-01-09 09:43:12 Creds: Username/Password 2018-01-09 09:43:12 Peer Info: IV_GUI_VER=net.openvpn.connect.ios 1.2.5-1 IV_VER=3.1.2 IV_PLAT=ios IV_NCP=2 IV_TCPNL=1 IV_PROTO=2 IV_LZO=1 IV_LZO_SWAP=1 IV_LZ4=1 IV_LZ4v2=1 IV_COMP_STUB=1 IV_COMP_STUBv2=1 2018-01-09 09:43:13 VERIFY OK : depth=1 cert. version : 3 serial number : 58:C9:0C:03 issuer name : CN=OpenVPN CA subject name : CN=OpenVPN CA issued on : 2017-03-08 09:40:19 expires on : 2027-03-13 09:40:19 signed using : RSA with SHA-256 RSA key size : 2048 bits basic constraints : CA=true 2018-01-09 09:43:13 VERIFY OK : depth=0 cert. version : 3 serial number : 01 issuer name : CN=OpenVPN CA subject name : CN=OpenVPN Server issued on : 2017-03-08 09:40:19 expires on : 2027-03-13 09:40:19 signed using : RSA with SHA-256 RSA key size : 2048 bits basic constraints : CA=false cert. type : SSL Server 2018-01-09 09:43:13 SSL Handshake: TLSv1.0/TLS-ECDHE-RSA-WITH-3DES-EDE-CBC-SHA 2018-01-09 09:43:13 Session is ACTIVE 2018-01-09 09:43:13 EVENT: GET_CONFIG 2018-01-09 09:43:13 Sending PUSH_REQUEST to server... 2018-01-09 09:43:14 Sending PUSH_REQUEST to server... 2018-01-09 09:43:14 OPTIONS: 0 [explicit-exit-notify] 1 [topology] [subnet] 2 [route-delay] [5] [30] 3 [dhcp-pre-release] 4 [dhcp-renew] 5 [dhcp-release] 6 [route-metric] [101] 7 [ping] [12] 8 [ping-restart] [50] 9 [auth-token] ... 10 [comp-lzo] [yes] 11 [redirect-private] [def1] 12 [redirect-private] [bypass-dhcp] 13 [redirect-private] [autolocal] 14 [route-gateway] [172.27.232.1] 15 [route] [172.27.224.0] [255.255.240.0] 16 [route] [10.30.0.0] [255.255.0.0] 17 [dhcp-option] [DNS] [10.30.0.2] 18 [dhcp-option] [DNS] [10.30.0.2] 19 [register-dns] 20 [block-ipv6] 21 [ifconfig] [172.27.233.249] [255.255.248.0] 2018-01-09 09:43:14 Session token: [redacted] 2018-01-09 09:43:14 PROTOCOL OPTIONS: cipher: AES-128-CBC digest: SHA1 compress: LZO peer ID: -1 2018-01-09 09:43:14 EVENT: ASSIGN_IP 2018-01-09 09:43:14 NIP: preparing TUN network settings 2018-01-09 09:43:14 NIP: init TUN network settings with endpoint: xx.xx.xx.xx 2018-01-09 09:43:14 NIP: adding IPv4 address to network settings 172.27.233.249/255.255.248.0 2018-01-09 09:43:14 NIP: adding (included) IPv4 route 172.27.224.0/20 2018-01-09 09:43:14 NIP: adding (included) IPv4 route 10.30.0.0/16 2018-01-09 09:43:14 NIP: adding DNS 10.30.0.2 2018-01-09 09:43:14 NIP: adding DNS 10.30.0.2 2018-01-09 09:43:14 NIP: adding search domain 2018-01-09 09:43:14 Connected via NetworkExtensionTUN 2018-01-09 09:43:14 LZO-ASYM init swap=0 asym=0 2018-01-09 09:43:14 EVENT: CONNECTED xxxxxxx@xxxxxxxxxxxxx:1194 (xx.xx.xx.xx) via /UDPv4 on NetworkExtensionTUN/172.27.233.249/ gw=[/] [/code]

Upgrade to OpenVPN 1.2.5 (iOS): DNS settings not applied

tos42

Hi,

same problem here. The workaround with redirect-gateway works, although it can't be a permanent solution as all internet traffic from the device goes through VPN connection...

It seems to be related to the Apple Network Extensions migration, do you have any clues on how to permanently resolve this behaviour ?

--

manchik

Hi ALL,

Same here. Does not seem to affect iOS 9.x versions but 11.x does. Not sure about 10.x though.

ordex

tos42 wrote Hi,

same problem here. The workaround with redirect-gateway works, although it can't be a permanent solution as all internet traffic from the device goes through VPN connection...

It seems to be related to the Apple Network Extensions migration, do you have any clues on how to permanently resolve this behaviour ?

--

Hi there,
this answer was given some posts above.
We already have a solution and it has been confirmed to be working by our beta testers.

The next release will be unaffected 😉

tos42

ordex wrote
tos42 wrote Hi,

same problem here. The workaround with redirect-gateway works, although it can't be a permanent solution as all internet traffic from the device goes through VPN connection...

It seems to be related to the Apple Network Extensions migration, do you have any clues on how to permanently resolve this behaviour ?

--
Hi there,
this answer was given some posts above.
We already have a solution and it has been confirmed to be working by our beta testers.

The next release will be unaffected 😉

Thanks ordex, do you know approximatively how much time will it take to release this unaffected new version ?

dynax60

ordex wrote
tos42 wrote Hi,

same problem here. The workaround with redirect-gateway works, although it can't be a permanent solution as all internet traffic from the device goes through VPN connection...

It seems to be related to the Apple Network Extensions migration, do you have any clues on how to permanently resolve this behaviour ?

--
Hi there,
this answer was given some posts above.
We already have a solution and it has been confirmed to be working by our beta testers.

The next release will be unaffected 😉

Our users already stayed 5 days without access to the corporate network. We have not possible to redirect all client's traffic through our router due to lack of such resources. I understand, you need time to collect a lot of bug fixes to build and release the next revision of the OpenVPN client. But... Is it possible to release critical updates immediately after a successful test? Idle of VPN service is strongly affects on Service Level Agreement in my company. Discontent growing among VPN users. We look forward to the update. Thank you!

martux

Hello, I have the same problem in my Pfsense 2.4.1 box. I could not configure manual DNS with the command push "route $DNS_SERVER_IP 255.255.255.255", neither on the server or in the client.
I already set a DNS Default Domain and DNS Server manually in the configuration of openvpn on pfsense but not work.
The problem is just with IOS because I have clients with android and there is no problem.
Do you know approximatively how much time will it take to release this unaffected new version? Or some temporary solution?
Thanks and sorry for my spanglish!!!

lpo

martux wrote Or some temporary solution?

the solution is in the first post!
just add
redirect-gateway def1
to your ovpn profile file.

Anonymous

With regards to the expected time of the bugfix release, I came across this in another thread:

ordex wrote we are currently going through the final Apple review, therefore we expect a new release anytime this week.

Truly hope this is the case!

martux

lpo wrote
martux wrote Or some temporary solution?
the solution is in the first post!
just add
redirect-gateway def1
to your ovpn profile file.

Thanks, I trie to put this into a client file and test the conection!

martux

lpo wrote
martux wrote Or some temporary solution?
the solution is in the first post!
just add
redirect-gateway def1
to your ovpn profile file.

This is an example of a ovpn client file, I put in the last line the command but not work. Could you give me an example!! I can configure some user to alleviate the situation, but I must wait for the update, because it is impractical to configure this for my 60 users.

Thanks you very much.

persist-tun
persist-key
cipher AES-128-CBC
ncp-ciphers AES-256-GCM:AES-128-GCM
auth SHA1
tls-client
client
remote 111.111.111.111 1194 udp
verify-x509-name "openvpn-server" name
auth-user-pass
remote-cert-tls server
comp-lzo adaptive
redirect-gateway def1

<ca>
-----BEGIN CERTIFICATE-----
MIIEWzCCA0OgAwIBAgIBADANBgkqhkiG9w0BAQsFADB8MQswCQYDVQQGEwJVWTEN
MAsGA1UECBMETWRlbzETMBEGA1UEBxMKTW9udGV2aWRlbzEOMAwGA1UEChMFUHVs
p+rESSF7Wb8E8XTlJ7AstaR3vlT1CfaIX4WD4000leDGdrpJOU6+3kAQMyxsCsBU
-----END CERTIFICATE-----
</ca>
<cert>
-----BEGIN CERTIFICATE-----
MIIEtDCCA5ygAwIBAgIBJzANBgkqhkiG9w0BAQsFADB8MQswCQYDVQQGEwJVWTEN
MAsGA1UECBMETWRlbzETMBEGA1UEBxMKTW9udGV2aWRlbzEOMAwGA1UEChMFUHVs
wR0ccz9QIxtvTn94eBc2XkdkS8BZADWP3eOphYLhOFVuKnODM06gXiWy6kEjj6pT
xmOZc9WHUIw=
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN PRIVATE KEY-----
MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDEjrFTQdlEfFlD
o5wZScviqwGb8GmC0ju08agn8wb6dE5CjEQ6X6Ibc2I6xGp573sYWdRVgK8mkg+J
zWaAPUjz18TzSUYel6PVjy8gKBhcvuIJeQqDBADoHrnWJ0y4e2ovzOxvvRy37UiY
LGqLQKGoJCIiOw+ZA+Ao0d4w
-----END PRIVATE KEY-----
</key>
<tls-auth>
#
# 2048 bit OpenVPN static key
#
-----BEGIN OpenVPN Static key V1-----
1478642e1dcea7d98bbc7a014e8ec70f
b498d6d3347d533eadd474a542cfb59d
-----END OpenVPN Static key V1-----
</tls-auth>
key-direction 1

jmpita

We have the same problem. We try to include the redirect-gateway def1 in the ovpn file of an user, but dosen't work.

jmpita

We have the same problem. We try to include the redirect-gateway def1 in the ovpn file of an user, but dosen't work.

ordex

OpenVPN Connect for iOS 1.2.6 is out!

Please refer to this post if you want to submit bugs of feature requests: https://forums.openvpn.net/viewtopic.php?f=36&t=25650

Thanks!

« Previous Page