DNS wont resolve over tunnel

yotefn

I am embarking on my first "Cloud Computing" project, and I began by creating a Windows VM in Azure. I would like to connect to this VM from on-premises, so I set out on creating a VPN.

I began with the Azure VPN Gateway, and created an IPSEC VPN to a SonicWALL NSA-2400. The end result was that the Azure VM could communicated with any computer on the LAN (Ping, DNS, RDP, etc.), but no computers on the LAN could talk to the VM. Being that it is impossible for that to be a routing issue (since if it was, communication would work so well the other way and there's no NAT), I ripped apart every firewall in the way, and after wasting 10 hours on this, I finally gave up.

I instead used the Windows VM as an OpenVPN server, and a Windows server on-prem as an OpenVPN client. I installed RRAS on both servers, set the registry IPEnableRouter, and got the OpenVPN tunnel up. The strange result now is that all computers can communicate perfectly with each other in both directions, BUT DNS WON'T RESOLVE OVER THE TUNNEL! Meaning, I can ping the IP of the Domain Controller on-prem, I can RDP into it (and vice-versa), but if I do a nslookup to that IP address the request times out. If I nslookup to a Public DNS (i.e. 8.8.8.8), it will resolve. All firewalls are off...

Anyone here have any ideas, both as to what might cause one-way IPSEC, and why DNS wouldn't work when every other TCP protocol does over an OpenVPN tunnel?

geeksquads

I don't know about the IPSEC issue...

But in regards to your DNS issue, have you tried pushing the appropriate DNS server as a dhcp-option? This setting should be configured on the OpenVPN server-side configuration.

Something along the lines of:

push "dhcp-option DNS 10.20.30.40"

"10.20.30.40" should be replaced with the IP address of the DNS server that resides within your VPN network.

yotefn

There are 2 reasons that won't work:
1. The DNS I'm trying to reach is from the OpenVPN server to the client LAN. So there's nothing to push.
2. Even manually attempting to query the server using dig or nslookup fails with a timeout. So this isn't related to DNS assignment.

Thanks for the reply though.

yotefn

For some more info:
Wireshark confirms that DNS traffic enters the tunnel toward the client side, but never comes out on the other side. I don't like pulling the "BUG" card, but this is starting to look fishy. I'm using OpenVPN 2.4.5 for Windows.

yotefn

I JUST FOUND THE PROBLEM!
Symantec Anti-Virus