Option allow-pull-fqdn Not Working

sam2426679

Below are the base settings of the client.ovpn file, being run on Windows 10 via OpenVPN GUI.

client
dev tun
proto udp
remote <vpn_address> <vpn_port>
resolv-retry infinite
nobind
persist-key
persist-tun
key-direction 1
remote-cert-tls server
tls-version-min 1.2
verify-x509-name server name
cipher AES-256-CBC
auth SHA256
comp-lzo
verb 1

I am attempting to configure this client so that only one, single address is routed over the VPN.

Doing this via IP address works like a charm:

[CASE 1]

route-nopull
route 192.168.1.123 255.255.255.255

However, changing the settings to:

[CASE 2]

route-nopull
allow-pull-fqdn
route sam2426679.service 255.255.255.255

Fails with:

Thu Sep 27 14:28:33 2018 RESOLVE: Cannot resolve host address: sam2426679.service: (No such host is known. )
Thu Sep 27 14:28:33 2018 OpenVPN ROUTE: failed to parse/resolve route for host/network: sam2426679.service

The curious part is that I can connect to "sam2426679.service" just fine over the VPN with these settings:

[CASE 3]

route-nopull
allow-pull-fqdn
route sam2426679.service 255.255.255.255
dhcp-option DNS 192.168.1.1
redirect-gateway def1

Note: I still get the error message/log entry of "Cannot resolve host address ..." and "failed to parse ..."

But, when I actually hit "sam2426679.service" in my application, it is successful.

What gives? For some reason, the config load of "route sam2426679.service 255.255.255.255" does not succeed in making the DNS request, but the DNS is resolved without problem over the same VPN connection later on (when using VPN for all DNS requests in [CASE 3], which is not the desired scenario of [CASE 2], which doesn't work at all).

The man page says that "allow-pull-fqdn" will "Allow client to pull DNS names from server" for "route", but this does not appear to be happening.

TinCanTech

The problem is clear:

sam2426679 wrote RESOLVE: Cannot resolve host address: sam2426679.service: (No such host is known. )

--allow-pull-fqdn is working normally.

user2426679

TinCanTech wrote The problem is clear:
sam2426679 wrote RESOLVE: Cannot resolve host address: sam2426679.service: (No such host is known. )
--allow-pull-fqdn is working normally.

Well it's not clear to my dumba**

Am I misinterpreting the documentation when it says "--allow-pull-fqdn" will "Allow client to pull DNS names from server" for "route"?

I am reading that to mean that "route", when used with an fqdn, will use the server to resolve the name.

CASE 3 shows that the name is able to be resolved (and that the host is known) server-side by the VPN.

Thanks for any insight you can provide.

edit:

I understand a little better now; the only thing "--allow-pull-fqdn" does is to make it so the client will not ignore a "push route" from the server, when the route contains an fqdn.

So it's impossible to configure a client-side route with an fqdn that the client cannot resolve on its own, i.e. rely on the VPN server to resolve the fqdn in "route"?

TinCanTech

TinCanTech wrote The problem is clear:
sam2426679 wrote RESOLVE: Cannot resolve host address: sam2426679.service: (No such host is known. )
--allow-pull-fqdn is working normally.

The error message is telling you that:

Client DNS resolution has queried the DNS server successfully.
The DNS server replied "sam2426679.service" is unknown.

user2426679

TinCanTech wrote
TinCanTech wrote The problem is clear:
sam2426679 wrote RESOLVE: Cannot resolve host address: sam2426679.service: (No such host is known. )
--allow-pull-fqdn is working normally.
The error message is telling you that:
Client DNS resolution has queried the DNS server successfully.

The DNS server replied "sam2426679.service" is unknown.

Thanks for the help.

I guess what I'm trying to do is not possible without introducing an outside proxy like Squid.

TinCanTech

I suggest you contact your server administrator.