Dear all, I am trying to set up a killswitch for openvpn through IPtables (following [url]https://linuxconfig.org/how-to-create-a-vpn-killswitch-using-iptables-on-linux[/url]), and have seemingly stumbled upon an issue that I haven't seen/found elsewhere online: my VPN host is not a static IP address, but comes as a hostname - openvpn fails to resolve it with my current IPTables setup. [b]CLIENT[/b] [code]pi@raspberrypi:~ $ uname -a Linux raspberrypi 4.9.35-v7+ #1014 SMP Fri Jun 30 14:47:43 BST 2017 armv7l GNU/Linux[/code] [b]CLIENT CONFIG[/b] [oconf=Client Server Config]client dev tun remote hostname.goeshere.com 53 push "dhcp-option DNS 1.1.1.1" proto udp nobind persist-key persist-tun tls-auth Wdc.key 1 ca ca.crt cipher AES-256-CBC comp-lzo verb 1 mute 20 float route-method exe route-delay 2 auth-user-pass auth.txt auth-retry interact explicit-exit-notify 2 ifconfig-nowarn auth-nocache[/oconf] [b]NETWORK SETUP[/b] [code]pi@raspberrypi:~ $ ifconfig eth0 Link encap:Ethernet HWaddr b8:27:eb:9d:1d:0f inet addr:192.168.178.22 Bcast:192.168.178.255 Mask:255.255.255.0 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:3154 errors:0 dropped:4 overruns:0 frame:0 TX packets:4625 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:597849 (583.8 KiB) TX bytes:1105935 (1.0 MiB) lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 UP LOOPBACK RUNNING MTU:65536 Metric:1 RX packets:1864 errors:0 dropped:0 overruns:0 frame:0 TX packets:1864 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1 RX bytes:311689 (304.3 KiB) TX bytes:311689 (304.3 KiB) wlan0 Link encap:Ethernet HWaddr b8:27:eb:c8:48:5a UP BROADCAST MULTICAST MTU:1500 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:0 (0.0 B) TX bytes:0 (0.0 B) [/code] [b]IPTABLES[/b] [code]-P INPUT DROP -P FORWARD DROP -P OUTPUT DROP -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A OUTPUT -o lo -j ACCEPT -A OUTPUT -o tun0 -p icmp -j ACCEPT -A OUTPUT -d 192.168.178.0/24 -j ACCEPT -A INPUT -d 192.168.178.0/24 -j ACCEPT -A OUTPUT -d 1.1.1.1 -j ACCEPT -A OUTPUT -p udp -m udp --dport 1194 -j ACCEPT[/code] [b]SERVER LOG[/b] with "verb 4" added to server.conf [code]Mar 11 11:23:11 raspberrypi systemd[1]: Stopping OpenVPN service... Mar 11 11:23:11 raspberrypi systemd[1]: Starting OpenVPN service... Mar 11 11:23:11 raspberrypi systemd[1]: Started OpenVPN service. Mar 11 11:23:12 raspberrypi ovpn-server[3047]: write UDPv4: Operation not permitted (code=1) Mar 11 11:23:14 raspberrypi ovpn-server[3047]: ERROR: Linux route delete command failed: external program exited with error status: 2 Mar 11 11:23:14 raspberrypi ovpn-server[3047]: ERROR: Linux route delete command failed: external program exited with error status: 2 Mar 11 11:23:14 raspberrypi avahi-daemon[536]: Withdrawing workstation service for tun0. Mar 11 11:23:14 raspberrypi ovpn-server[3047]: SIGTERM[soft,exit-with-notification] received, process exiting Mar 11 11:23:14 raspberrypi systemd[1]: Starting OpenVPN connection to server... Mar 11 11:23:14 raspberrypi ovpn-server[3391]: OpenVPN 2.3.4 arm-unknown-linux-gnueabihf [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Jun 27 2017 Mar 11 11:23:14 raspberrypi ovpn-server[3391]: library versions: OpenSSL 1.0.1t 3 May 2016, LZO 2.08 Mar 11 11:23:14 raspberrypi ovpn-server[3391]: WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info. Mar 11 11:23:14 raspberrypi ovpn-server[3391]: WARNING: file 'Wdc.key' is group or others accessible Mar 11 11:23:14 raspberrypi ovpn-server[3391]: Control Channel Authentication: using 'Wdc.key' as a OpenVPN static key file Mar 11 11:23:34 raspberrypi ovpn-server[3391]: RESOLVE: Cannot resolve host address: hostname.goeshere.com: Temporary failure in name resolution Mar 11 11:23:34 raspberrypi systemd[1]: Started OpenVPN connection to server. Mar 11 11:23:54 raspberrypi ovpn-server[3393]: RESOLVE: Cannot resolve host address: hostname.goeshere.com: Temporary failure in name resolution[/code] I attempt to have openvpn use 1.1.1.1 as the DNS server, and try to allow that connection via the IPtables rule, so that openvpn can resolve the hostname of my VPN provider's server. I must have something wrong however, as the syslog shows it cannot resolve the host address. Could somebody point me in the right direction? Many thanks for your time.

[quote=timcaffrey post_id=84303 time=1552244795 user_id=46611] [b]client[/b] dev tun remote de-ao1-ovpn-udp.pointtoserver.com 53 [b]push[/b] "dhcp-option DNS 1.1.1.1" [/quote]I highly recommend you start with the Howto. https://forums.openvpn.net/viewtopic.php?f=30&t=22603

Setting up IPTables - Issue with resolving hostname when establishing connection to VPN server

timcaffrey

Dear all,

I am trying to set up a killswitch for openvpn through IPtables (following https://linuxconfig.org/how-to-create-a-vpn-killswitch-using-iptables-on-linux), and have seemingly stumbled upon an issue that I haven't seen/found elsewhere online: my VPN host is not a static IP address, but comes as a hostname - openvpn fails to resolve it with my current IPTables setup.

CLIENT

pi@raspberrypi:~ $ uname -a
Linux raspberrypi 4.9.35-v7+ #1014 SMP Fri Jun 30 14:47:43 BST 2017 armv7l GNU/Linux

CLIENT CONFIG

client
dev tun
remote hostname.goeshere.com 53
push "dhcp-option DNS 1.1.1.1"
proto udp
nobind
persist-key
persist-tun
tls-auth Wdc.key 1
ca ca.crt
cipher AES-256-CBC
comp-lzo
verb 1
mute 20
float
route-method exe
route-delay 2
auth-user-pass auth.txt
auth-retry interact
explicit-exit-notify 2
ifconfig-nowarn
auth-nocache

NETWORK SETUP

pi@raspberrypi:~ $ ifconfig
eth0      Link encap:Ethernet  HWaddr b8:27:eb:9d:1d:0f  
          inet addr:192.168.178.22  Bcast:192.168.178.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:3154 errors:0 dropped:4 overruns:0 frame:0
          TX packets:4625 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:597849 (583.8 KiB)  TX bytes:1105935 (1.0 MiB)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:1864 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1864 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1 
          RX bytes:311689 (304.3 KiB)  TX bytes:311689 (304.3 KiB)

wlan0     Link encap:Ethernet  HWaddr b8:27:eb:c8:48:5a  
          UP BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

IPTABLES

-P INPUT DROP
-P FORWARD DROP
-P OUTPUT DROP
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -o tun0 -p icmp -j ACCEPT
-A OUTPUT -d 192.168.178.0/24 -j ACCEPT
-A INPUT -d 192.168.178.0/24 -j ACCEPT
-A OUTPUT -d 1.1.1.1 -j ACCEPT
-A OUTPUT -p udp -m udp --dport 1194 -j ACCEPT

SERVER LOG with "verb 4" added to server.conf

Mar 11 11:23:11 raspberrypi systemd[1]: Stopping OpenVPN service...
Mar 11 11:23:11 raspberrypi systemd[1]: Starting OpenVPN service...
Mar 11 11:23:11 raspberrypi systemd[1]: Started OpenVPN service.
Mar 11 11:23:12 raspberrypi ovpn-server[3047]: write UDPv4: Operation not permitted (code=1)
Mar 11 11:23:14 raspberrypi ovpn-server[3047]: ERROR: Linux route delete command failed: external program exited with error status: 2
Mar 11 11:23:14 raspberrypi ovpn-server[3047]: ERROR: Linux route delete command failed: external program exited with error status: 2
Mar 11 11:23:14 raspberrypi avahi-daemon[536]: Withdrawing workstation service for tun0.
Mar 11 11:23:14 raspberrypi ovpn-server[3047]: SIGTERM[soft,exit-with-notification] received, process exiting
Mar 11 11:23:14 raspberrypi systemd[1]: Starting OpenVPN connection to server...
Mar 11 11:23:14 raspberrypi ovpn-server[3391]: OpenVPN 2.3.4 arm-unknown-linux-gnueabihf [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Jun 27 2017
Mar 11 11:23:14 raspberrypi ovpn-server[3391]: library versions: OpenSSL 1.0.1t  3 May 2016, LZO 2.08
Mar 11 11:23:14 raspberrypi ovpn-server[3391]: WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Mar 11 11:23:14 raspberrypi ovpn-server[3391]: WARNING: file 'Wdc.key' is group or others accessible
Mar 11 11:23:14 raspberrypi ovpn-server[3391]: Control Channel Authentication: using 'Wdc.key' as a OpenVPN static key file
Mar 11 11:23:34 raspberrypi ovpn-server[3391]: RESOLVE: Cannot resolve host address: hostname.goeshere.com: Temporary failure in name resolution
Mar 11 11:23:34 raspberrypi systemd[1]: Started OpenVPN connection to server.
Mar 11 11:23:54 raspberrypi ovpn-server[3393]: RESOLVE: Cannot resolve host address: hostname.goeshere.com: Temporary failure in name resolution

I attempt to have openvpn use 1.1.1.1 as the DNS server, and try to allow that connection via the IPtables rule, so that openvpn can resolve the hostname of my VPN provider's server. I must have something wrong however, as the syslog shows it cannot resolve the host address.

Could somebody point me in the right direction? Many thanks for your time.

TinCanTech

timcaffrey wrote client
dev tun
remote de-ao1-ovpn-udp.pointtoserver.com 53
push "dhcp-option DNS 1.1.1.1"

I highly recommend you start with the Howto.

https://forums.openvpn.net/viewtopic.php?f=30&t=22603