DNS Resolution not working

patrikr

Hi,

we have the issue, that DNS resolution at some clients is not working as expected. The first DNS request is done correctly over the "default_gateway" but seems to be ignored through the system. After that, 7 faulty DNS requests are done over the VPN interface, which isn't working because we don't allow it. The only exception is cmd line interface of Windows, thats always working. Therefore endusers with this problem experience intense lag for everything which requires DNS resolution.

Restart of DNS service is not solving the problem. Routes are totally fine. NSlookup always works fine.

I'm open for any idea's to test.

Thanks

#Network Settings
mode server
local x.x.x.x
proto tcp
port 2000
dev tun0

#Radius Auth Settings
plugin /usr/lib/openvpn/openvpn-auth-pam.so openvpn

#Set renegotiation to 24h
reneg-sec 86400

#No Client Certs needed#
client-cert-not-required
username-as-common-name

#Allow Multiple Login with same Account#
duplicate-cn

#Cert Settings
tls-server
ca /var/x/ca/cacert.pem
crl-verify /var/x/crl/x_crl.pem
cert /var/x/ca/servercert.pem
key /var/x/ca/serverkey.pem
dh /var/x/ca/dh2048.pem

#Crypto Settings
cipher AES-128-CBC

persist-key
persist-tun

#Client Network Settings
server x.x.x.x 255.255.254.0
client-config-dir /etc/openvpn/clients/client_conf
persist-local-ip
persist-remote-ip

#Push Options#
push "redirect-gateway"

#DNS Options
push "dhcp-option DNS x.x.x.x"
push "dhcp-option DNS x.x.x.x"
push "dhcp-option DOMAIN x.at"
push "dhcp-option WINS x.x.x.x"

push "route x.x.x.x 255.255.128.0 net_gateway"
push "route x.x.x.x 255.255.128.0 net_gateway"
push "route x.x.x.x 255.255.255.0 net_gateway"
push "route x.x.x.x 255.255.255.0 net_gateway"

#Connection Optimization
keepalive 10 600
comp-lzo

#Automatic Disconnect if less then 150 KByte is transmitted within 2 hour#
inactive 7200 153600

#Run OpenVPN Server as nobody
user nobody
group nogroup

#Enable Management Interface
management 192.168.200.6 5556

#Logging
status /var/log/openvpn/x_x_radius_tcp_2000.stat
#automatic logging to syslog instead of:
#log-append /var/log/openvpn/x_x_radius_tcp_2000.log
verb 4

Server Log

Mar 26 10:00:09 servername-n1 ovpn-x_x_radius_tcp_2000[15553]: TCP connection established with x.x.x.x:50265
Mar 26 10:00:09 servername-n1 ovpn-x_x_radius_tcp_2000[15553]: TCPv4_SERVER link remote: x.x.x.x:50265
Mar 26 10:00:10 servername-n1 ovpn-x_x_radius_tcp_2000[15553]: x.x.x.x:50265 TLS: Initial packet from x.x.x.x:50265, sid=215e97c6 441a9877
Mar 26 10:00:10 servername-n1 ovpn-x_x_radius_tcp_2000[15553]: x.x.x.x:50265 PLUGIN_CALL: POST /usr/lib/openvpn/openvpn-auth-pam.so/PLUGIN_AUTH_USER_PASS_VERIFY status=0
Mar 26 10:00:10 servername-n1 ovpn-x_x_radius_tcp_2000[15553]: x.x.x.x:50265 TLS: Username/Password authentication succeeded for username 'user' [CN SET]
Mar 26 10:00:10 servername-n1 ovpn-x_x_radius_tcp_2000[15553]: x.x.x.x:50265 Data Channel Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Mar 26 10:00:10 servername-n1 ovpn-x_x_radius_tcp_2000[15553]: x.x.x.x:50265 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mar 26 10:00:10 servername-n1 ovpn-x_x_radius_tcp_2000[15553]: x.x.x.x:50265 Data Channel Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Mar 26 10:00:10 servername-n1 ovpn-x_x_radius_tcp_2000[15553]: x.x.x.x:50265 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mar 26 10:00:10 servername-n1 ovpn-x_x_radius_tcp_2000[15553]: x.x.x.x:50265 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA
Mar 26 10:00:10 servername-n1 ovpn-x_x_radius_tcp_2000[15553]: x.x.x.x:50265 [user] Peer Connection Initiated with x.x.x.x:50265
Mar 26 10:00:10 servername-n1 ovpn-x_x_radius_tcp_2000[15553]: user/x.x.x.x:50265 OPTIONS IMPORT: reading client specific options from: /etc/openvpn/clients/client_conf/DEFAULT
Mar 26 10:00:10 servername-n1 ovpn-x_x_radius_tcp_2000[15553]: user/x.x.x.x:50265 MULTI: Learn: x.x.x.x -> user/x.x.x.x:50265
Mar 26 10:00:10 servername-n1 ovpn-x_x_radius_tcp_2000[15553]: user/x.x.x.x:50265 MULTI: primary virtual IP for user/x.x.x.x:50265: x.x.x.x
Mar 26 10:00:12 servername-n1 ovpn-x_x_radius_tcp_2000[15553]: user/x.x.x.x:50265 PUSH: Received control message: 'PUSH_REQUEST'
Mar 26 10:00:12 servername-n1 ovpn-x_x_radius_tcp_2000[15553]: user/x.x.x.x:50265 SENT CONTROL [user]: 'PUSH_REPLY,redirect-gateway,dhcp-option DNS x.x.x.x,dhcp-option DNS x.x.x.x,dhcp-option DOMAIN x.at,dhcp-option WINS x.x.x.x,route x.x.0.0 255.255.128.0 net_gateway,route x.x.150.0 255.255.255.0 net_gateway,route x.x.151.0 255.255.255.0 net_gateway,route x.x.200.0 255.255.255.0 net_gateway,route x.x.201.0 255.255.255.0 net_gateway,route x.x.0.0 255.255.0.0 net_gateway,route x.x.88.0 255.255.252.0 net_gateway,route x.x.0.0 255.255.0.0 net_gateway,route x.x.0.0 255.255.0.0 net_gateway,route x.x.0.0 255.255.0.0 net_gateway,route x.x.124.1,topology net30,ping 10,ping-restart 600,route x.x.29.38 255.255.255.255 vpn_gateway,route x.x.30.2 255.255.255.255 vpn_gateway,ifconfig x.x.x.x x.x.124.193' (status=1)

#Client Settings#
tls-client
client
dev tun

#Network Settings
proto tcp
remote x.at 2000

#Nobind for Double VPN Connection#
nobind

#Radius Auth Settings
auth-user-pass
auth-nocache

reneg-sec 86400

#Crypto and Certificate Settings
ca x\\x\\x.pem

cipher AES-128-CBC

persist-key
persist-tun

#Connection Optimization
comp-lzo
keepalive 10 600

verb 4
ns-cert-type server

#Win Vista/7 Options
route-method exe
route-delay 2

Client Log

Tue Mar 26 09:59:54 2019 us=619238 Current Parameter Settings:
Tue Mar 26 09:59:54 2019 us=619238   config = 'x_x.ovpn'
Tue Mar 26 09:59:54 2019 us=619238   mode = 0
Tue Mar 26 09:59:54 2019 us=619238   show_ciphers = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   show_digests = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   show_engines = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   genkey = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   key_pass_file = '[UNDEF]'
Tue Mar 26 09:59:54 2019 us=619238   show_tls_ciphers = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   connect_retry_max = 0
Tue Mar 26 09:59:54 2019 us=619238 Connection profiles [0]:
Tue Mar 26 09:59:54 2019 us=619238   proto = tcp-client
Tue Mar 26 09:59:54 2019 us=619238   local = '[UNDEF]'
Tue Mar 26 09:59:54 2019 us=619238   local_port = '[UNDEF]'
Tue Mar 26 09:59:54 2019 us=619238   remote = 'xxgw.x.at'
Tue Mar 26 09:59:54 2019 us=619238   remote_port = '2000'
Tue Mar 26 09:59:54 2019 us=619238   remote_float = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   bind_defined = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   bind_local = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   bind_ipv6_only = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   connect_retry_seconds = 5
Tue Mar 26 09:59:54 2019 us=619238   connect_timeout = 120
Tue Mar 26 09:59:54 2019 us=619238   socks_proxy_server = '[UNDEF]'
Tue Mar 26 09:59:54 2019 us=619238   socks_proxy_port = '[UNDEF]'
Tue Mar 26 09:59:54 2019 us=619238   tun_mtu = 1500
Tue Mar 26 09:59:54 2019 us=619238   tun_mtu_defined = ENABLED
Tue Mar 26 09:59:54 2019 us=619238   link_mtu = 1500
Tue Mar 26 09:59:54 2019 us=619238   link_mtu_defined = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   tun_mtu_extra = 0
Tue Mar 26 09:59:54 2019 us=619238   tun_mtu_extra_defined = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   mtu_discover_type = -1
Tue Mar 26 09:59:54 2019 us=619238   fragment = 0
Tue Mar 26 09:59:54 2019 us=619238   mssfix = 1450
Tue Mar 26 09:59:54 2019 us=619238   explicit_exit_notification = 0
Tue Mar 26 09:59:54 2019 us=619238 Connection profiles END
Tue Mar 26 09:59:54 2019 us=619238   remote_random = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   ipchange = '[UNDEF]'
Tue Mar 26 09:59:54 2019 us=619238   dev = 'tun'
Tue Mar 26 09:59:54 2019 us=619238   dev_type = '[UNDEF]'
Tue Mar 26 09:59:54 2019 us=619238   dev_node = '[UNDEF]'
Tue Mar 26 09:59:54 2019 us=619238   lladdr = '[UNDEF]'
Tue Mar 26 09:59:54 2019 us=619238   topology = 1
Tue Mar 26 09:59:54 2019 us=619238   ifconfig_local = '[UNDEF]'
Tue Mar 26 09:59:54 2019 us=619238   ifconfig_remote_netmask = '[UNDEF]'
Tue Mar 26 09:59:54 2019 us=619238   ifconfig_noexec = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   ifconfig_nowarn = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   ifconfig_ipv6_local = '[UNDEF]'
Tue Mar 26 09:59:54 2019 us=619238   ifconfig_ipv6_netbits = 0
Tue Mar 26 09:59:54 2019 us=619238   ifconfig_ipv6_remote = '[UNDEF]'
Tue Mar 26 09:59:54 2019 us=619238   shaper = 0
Tue Mar 26 09:59:54 2019 us=619238   mtu_test = 0
Tue Mar 26 09:59:54 2019 us=619238   mlock = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   keepalive_ping = 10
Tue Mar 26 09:59:54 2019 us=619238   keepalive_timeout = 600
Tue Mar 26 09:59:54 2019 us=619238   inactivity_timeout = 0
Tue Mar 26 09:59:54 2019 us=619238   ping_send_timeout = 10
Tue Mar 26 09:59:54 2019 us=619238   ping_rec_timeout = 600
Tue Mar 26 09:59:54 2019 us=619238   ping_rec_timeout_action = 2
Tue Mar 26 09:59:54 2019 us=619238   ping_timer_remote = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   remap_sigusr1 = 0
Tue Mar 26 09:59:54 2019 us=619238   persist_tun = ENABLED
Tue Mar 26 09:59:54 2019 us=619238   persist_local_ip = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   persist_remote_ip = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   persist_key = ENABLED
Tue Mar 26 09:59:54 2019 us=619238   passtos = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   resolve_retry_seconds = 1000000000
Tue Mar 26 09:59:54 2019 us=619238   resolve_in_advance = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   username = '[UNDEF]'
Tue Mar 26 09:59:54 2019 us=619238   groupname = '[UNDEF]'
Tue Mar 26 09:59:54 2019 us=619238   chroot_dir = '[UNDEF]'
Tue Mar 26 09:59:54 2019 us=619238   cd_dir = '[UNDEF]'
Tue Mar 26 09:59:54 2019 us=619238   writepid = '[UNDEF]'
Tue Mar 26 09:59:54 2019 us=619238   up_script = '[UNDEF]'
Tue Mar 26 09:59:54 2019 us=619238   down_script = '[UNDEF]'
Tue Mar 26 09:59:54 2019 us=619238   down_pre = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   up_restart = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   up_delay = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   daemon = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   inetd = 0
Tue Mar 26 09:59:54 2019 us=619238   log = ENABLED
Tue Mar 26 09:59:54 2019 us=619238   suppress_timestamps = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   machine_readable_output = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   nice = 0
Tue Mar 26 09:59:54 2019 us=619238   verbosity = 4
Tue Mar 26 09:59:54 2019 us=619238   mute = 0
Tue Mar 26 09:59:54 2019 us=619238   gremlin = 0
Tue Mar 26 09:59:54 2019 us=619238   status_file = '[UNDEF]'
Tue Mar 26 09:59:54 2019 us=619238   status_file_version = 1
Tue Mar 26 09:59:54 2019 us=619238   status_file_update_freq = 60
Tue Mar 26 09:59:54 2019 us=619238   occ = ENABLED
Tue Mar 26 09:59:54 2019 us=619238   rcvbuf = 0
Tue Mar 26 09:59:54 2019 us=619238   sndbuf = 0
Tue Mar 26 09:59:54 2019 us=619238   sockflags = 0
Tue Mar 26 09:59:54 2019 us=619238   fast_io = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   comp.alg = 2
Tue Mar 26 09:59:54 2019 us=619238   comp.flags = 1
Tue Mar 26 09:59:54 2019 us=619238   route_script = '[UNDEF]'
Tue Mar 26 09:59:54 2019 us=619238   route_default_gateway = '[UNDEF]'
Tue Mar 26 09:59:54 2019 us=619238   route_default_metric = 0
Tue Mar 26 09:59:54 2019 us=619238   route_noexec = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   route_delay = 2
Tue Mar 26 09:59:54 2019 us=619238   route_delay_window = 30
Tue Mar 26 09:59:54 2019 us=619238   route_delay_defined = ENABLED
Tue Mar 26 09:59:54 2019 us=619238   route_nopull = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   route_gateway_via_dhcp = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   allow_pull_fqdn = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   management_addr = '127.0.0.1'
Tue Mar 26 09:59:54 2019 us=619238   management_port = '25346'
Tue Mar 26 09:59:54 2019 us=619238   management_user_pass = 'stdin'
Tue Mar 26 09:59:54 2019 us=619238   management_log_history_cache = 250
Tue Mar 26 09:59:54 2019 us=619238   management_echo_buffer_size = 100
Tue Mar 26 09:59:54 2019 us=619238   management_write_peer_info_file = '[UNDEF]'
Tue Mar 26 09:59:54 2019 us=619238   management_client_user = '[UNDEF]'
Tue Mar 26 09:59:54 2019 us=619238   management_client_group = '[UNDEF]'
Tue Mar 26 09:59:54 2019 us=619238   management_flags = 6
Tue Mar 26 09:59:54 2019 us=619238   shared_secret_file = '[UNDEF]'
Tue Mar 26 09:59:54 2019 us=619238   key_direction = not set
Tue Mar 26 09:59:54 2019 us=619238   ciphername = 'AES-128-CBC'
Tue Mar 26 09:59:54 2019 us=619238   ncp_enabled = ENABLED
Tue Mar 26 09:59:54 2019 us=619238   ncp_ciphers = 'AES-256-GCM:AES-128-GCM'
Tue Mar 26 09:59:54 2019 us=619238   authname = 'SHA1'
Tue Mar 26 09:59:54 2019 us=619238   prng_hash = 'SHA1'
Tue Mar 26 09:59:54 2019 us=619238   prng_nonce_secret_len = 16
Tue Mar 26 09:59:54 2019 us=619238   keysize = 0
Tue Mar 26 09:59:54 2019 us=619238   engine = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   replay = ENABLED
Tue Mar 26 09:59:54 2019 us=619238   mute_replay_warnings = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   replay_window = 64
Tue Mar 26 09:59:54 2019 us=619238   replay_time = 15
Tue Mar 26 09:59:54 2019 us=619238   packet_id_file = '[UNDEF]'
Tue Mar 26 09:59:54 2019 us=619238   use_iv = ENABLED
Tue Mar 26 09:59:54 2019 us=619238   test_crypto = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   tls_server = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   tls_client = ENABLED
Tue Mar 26 09:59:54 2019 us=619238   key_method = 2
Tue Mar 26 09:59:54 2019 us=619238   ca_file = 'certs\x\cacert.pem'
Tue Mar 26 09:59:54 2019 us=619238   ca_path = '[UNDEF]'
Tue Mar 26 09:59:54 2019 us=619238   dh_file = '[UNDEF]'
Tue Mar 26 09:59:54 2019 us=619238   cert_file = '[UNDEF]'
Tue Mar 26 09:59:54 2019 us=619238   extra_certs_file = '[UNDEF]'
Tue Mar 26 09:59:54 2019 us=619238   priv_key_file = '[UNDEF]'
Tue Mar 26 09:59:54 2019 us=619238   pkcs12_file = '[UNDEF]'
Tue Mar 26 09:59:54 2019 us=619238   cryptoapi_cert = '[UNDEF]'
Tue Mar 26 09:59:54 2019 us=619238   cipher_list = '[UNDEF]'
Tue Mar 26 09:59:54 2019 us=619238   cipher_list_tls13 = '[UNDEF]'
Tue Mar 26 09:59:54 2019 us=619238   tls_cert_profile = '[UNDEF]'
Tue Mar 26 09:59:54 2019 us=619238   tls_verify = '[UNDEF]'
Tue Mar 26 09:59:54 2019 us=619238   tls_export_cert = '[UNDEF]'
Tue Mar 26 09:59:54 2019 us=619238   verify_x509_type = 0
Tue Mar 26 09:59:54 2019 us=619238   verify_x509_name = '[UNDEF]'
Tue Mar 26 09:59:54 2019 us=619238   crl_file = '[UNDEF]'
Tue Mar 26 09:59:54 2019 us=619238   ns_cert_type = 1
Tue Mar 26 09:59:54 2019 us=619238   remote_cert_ku[i] = 0
Tue Mar 26 09:59:54 2019 us=619238   remote_cert_ku[i] = 0
Tue Mar 26 09:59:54 2019 us=619238   remote_cert_ku[i] = 0
Tue Mar 26 09:59:54 2019 us=619238   remote_cert_ku[i] = 0
Tue Mar 26 09:59:54 2019 us=619238   remote_cert_ku[i] = 0
Tue Mar 26 09:59:54 2019 us=619238   remote_cert_ku[i] = 0
Tue Mar 26 09:59:54 2019 us=619238   remote_cert_ku[i] = 0
Tue Mar 26 09:59:54 2019 us=619238   remote_cert_ku[i] = 0
Tue Mar 26 09:59:54 2019 us=619238   remote_cert_ku[i] = 0
Tue Mar 26 09:59:54 2019 us=619238   remote_cert_ku[i] = 0
Tue Mar 26 09:59:54 2019 us=619238   remote_cert_ku[i] = 0
Tue Mar 26 09:59:54 2019 us=619238   remote_cert_ku[i] = 0
Tue Mar 26 09:59:54 2019 us=619238   remote_cert_ku[i] = 0
Tue Mar 26 09:59:54 2019 us=619238   remote_cert_ku[i] = 0
Tue Mar 26 09:59:54 2019 us=619238   remote_cert_ku[i] = 0
Tue Mar 26 09:59:54 2019 us=619238   remote_cert_ku[i] = 0
Tue Mar 26 09:59:54 2019 us=619238   remote_cert_eku = '[UNDEF]'
Tue Mar 26 09:59:54 2019 us=619238   ssl_flags = 0
Tue Mar 26 09:59:54 2019 us=619238   tls_timeout = 2
Tue Mar 26 09:59:54 2019 us=619238   renegotiate_bytes = -1
Tue Mar 26 09:59:54 2019 us=619238   renegotiate_packets = 0
Tue Mar 26 09:59:54 2019 us=619238   renegotiate_seconds = 86400
Tue Mar 26 09:59:54 2019 us=619238   handshake_window = 60
Tue Mar 26 09:59:54 2019 us=619238   transition_window = 3600
Tue Mar 26 09:59:54 2019 us=619238   single_session = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   push_peer_info = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   tls_exit = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   tls_auth_file = '[UNDEF]'
Tue Mar 26 09:59:54 2019 us=619238   tls_crypt_file = '[UNDEF]'
Tue Mar 26 09:59:54 2019 us=619238   pkcs11_protected_authentication = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   pkcs11_protected_authentication = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   pkcs11_protected_authentication = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   pkcs11_protected_authentication = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   pkcs11_protected_authentication = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   pkcs11_protected_authentication = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   pkcs11_protected_authentication = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   pkcs11_protected_authentication = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   pkcs11_protected_authentication = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   pkcs11_protected_authentication = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   pkcs11_protected_authentication = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   pkcs11_protected_authentication = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   pkcs11_protected_authentication = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   pkcs11_protected_authentication = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   pkcs11_protected_authentication = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   pkcs11_protected_authentication = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   pkcs11_private_mode = 00000000
Tue Mar 26 09:59:54 2019 us=619238   pkcs11_private_mode = 00000000
Tue Mar 26 09:59:54 2019 us=619238   pkcs11_private_mode = 00000000
Tue Mar 26 09:59:54 2019 us=619238   pkcs11_private_mode = 00000000
Tue Mar 26 09:59:54 2019 us=619238   pkcs11_private_mode = 00000000
Tue Mar 26 09:59:54 2019 us=619238   pkcs11_private_mode = 00000000
Tue Mar 26 09:59:54 2019 us=619238   pkcs11_private_mode = 00000000
Tue Mar 26 09:59:54 2019 us=619238   pkcs11_private_mode = 00000000
Tue Mar 26 09:59:54 2019 us=619238   pkcs11_private_mode = 00000000
Tue Mar 26 09:59:54 2019 us=619238   pkcs11_private_mode = 00000000
Tue Mar 26 09:59:54 2019 us=619238   pkcs11_private_mode = 00000000
Tue Mar 26 09:59:54 2019 us=619238   pkcs11_private_mode = 00000000
Tue Mar 26 09:59:54 2019 us=619238   pkcs11_private_mode = 00000000
Tue Mar 26 09:59:54 2019 us=619238   pkcs11_private_mode = 00000000
Tue Mar 26 09:59:54 2019 us=619238   pkcs11_private_mode = 00000000
Tue Mar 26 09:59:54 2019 us=619238   pkcs11_private_mode = 00000000
Tue Mar 26 09:59:54 2019 us=619238   pkcs11_cert_private = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   pkcs11_cert_private = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   pkcs11_cert_private = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   pkcs11_cert_private = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   pkcs11_cert_private = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   pkcs11_cert_private = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   pkcs11_cert_private = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   pkcs11_cert_private = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   pkcs11_cert_private = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   pkcs11_cert_private = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   pkcs11_cert_private = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   pkcs11_cert_private = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   pkcs11_cert_private = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   pkcs11_cert_private = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   pkcs11_cert_private = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   pkcs11_cert_private = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   pkcs11_pin_cache_period = -1
Tue Mar 26 09:59:54 2019 us=619238   pkcs11_id = '[UNDEF]'
Tue Mar 26 09:59:54 2019 us=619238   pkcs11_id_management = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   server_network = 0.0.0.0
Tue Mar 26 09:59:54 2019 us=619238   server_netmask = 0.0.0.0
Tue Mar 26 09:59:54 2019 us=619238   server_network_ipv6 = ::
Tue Mar 26 09:59:54 2019 us=619238   server_netbits_ipv6 = 0
Tue Mar 26 09:59:54 2019 us=619238   server_bridge_ip = 0.0.0.0
Tue Mar 26 09:59:54 2019 us=619238   server_bridge_netmask = 0.0.0.0
Tue Mar 26 09:59:54 2019 us=619238   server_bridge_pool_start = 0.0.0.0
Tue Mar 26 09:59:54 2019 us=619238   server_bridge_pool_end = 0.0.0.0
Tue Mar 26 09:59:54 2019 us=619238   ifconfig_pool_defined = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   ifconfig_pool_start = 0.0.0.0
Tue Mar 26 09:59:54 2019 us=619238   ifconfig_pool_end = 0.0.0.0
Tue Mar 26 09:59:54 2019 us=619238   ifconfig_pool_netmask = 0.0.0.0
Tue Mar 26 09:59:54 2019 us=619238   ifconfig_pool_persist_filename = '[UNDEF]'
Tue Mar 26 09:59:54 2019 us=619238   ifconfig_pool_persist_refresh_freq = 600
Tue Mar 26 09:59:54 2019 us=619238   ifconfig_ipv6_pool_defined = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   ifconfig_ipv6_pool_base = ::
Tue Mar 26 09:59:54 2019 us=619238   ifconfig_ipv6_pool_netbits = 0
Tue Mar 26 09:59:54 2019 us=619238   n_bcast_buf = 256
Tue Mar 26 09:59:54 2019 us=619238   tcp_queue_limit = 64
Tue Mar 26 09:59:54 2019 us=619238   real_hash_size = 256
Tue Mar 26 09:59:54 2019 us=619238   virtual_hash_size = 256
Tue Mar 26 09:59:54 2019 us=619238   client_connect_script = '[UNDEF]'
Tue Mar 26 09:59:54 2019 us=619238   learn_address_script = '[UNDEF]'
Tue Mar 26 09:59:54 2019 us=619238   client_disconnect_script = '[UNDEF]'
Tue Mar 26 09:59:54 2019 us=619238   client_config_dir = '[UNDEF]'
Tue Mar 26 09:59:54 2019 us=619238   ccd_exclusive = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   tmp_dir = 'C:\Users\x\AppData\Local\Temp\'
Tue Mar 26 09:59:54 2019 us=619238   push_ifconfig_defined = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   push_ifconfig_local = 0.0.0.0
Tue Mar 26 09:59:54 2019 us=619238   push_ifconfig_remote_netmask = 0.0.0.0
Tue Mar 26 09:59:54 2019 us=619238   push_ifconfig_ipv6_defined = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   push_ifconfig_ipv6_local = ::/0
Tue Mar 26 09:59:54 2019 us=619238   push_ifconfig_ipv6_remote = ::
Tue Mar 26 09:59:54 2019 us=619238   enable_c2c = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   duplicate_cn = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   cf_max = 0
Tue Mar 26 09:59:54 2019 us=619238   cf_per = 0
Tue Mar 26 09:59:54 2019 us=619238   max_clients = 1024
Tue Mar 26 09:59:54 2019 us=619238   max_routes_per_client = 256
Tue Mar 26 09:59:54 2019 us=619238   auth_user_pass_verify_script = '[UNDEF]'
Tue Mar 26 09:59:54 2019 us=619238   auth_user_pass_verify_script_via_file = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   auth_token_generate = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   auth_token_lifetime = 0
Tue Mar 26 09:59:54 2019 us=619238   client = ENABLED
Tue Mar 26 09:59:54 2019 us=619238   pull = ENABLED
Tue Mar 26 09:59:54 2019 us=619238   auth_user_pass_file = 'stdin'
Tue Mar 26 09:59:54 2019 us=619238   show_net_up = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   route_method = 2
Tue Mar 26 09:59:54 2019 us=619238   block_outside_dns = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   ip_win32_defined = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   ip_win32_type = 3
Tue Mar 26 09:59:54 2019 us=619238   dhcp_masq_offset = 0
Tue Mar 26 09:59:54 2019 us=619238   dhcp_lease_time = 31536000
Tue Mar 26 09:59:54 2019 us=619238   tap_sleep = 0
Tue Mar 26 09:59:54 2019 us=619238   dhcp_options = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   dhcp_renew = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   dhcp_pre_release = DISABLED
Tue Mar 26 09:59:54 2019 us=619238   domain = '[UNDEF]'
Tue Mar 26 09:59:54 2019 us=619238   netbios_scope = '[UNDEF]'
Tue Mar 26 09:59:54 2019 us=619238   netbios_node_type = 0
Tue Mar 26 09:59:54 2019 us=619238   disable_nbt = DISABLED
Tue Mar 26 09:59:54 2019 us=619238 OpenVPN 2.4.7 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on Feb 21 2019
Tue Mar 26 09:59:54 2019 us=619238 Windows version 6.2 (Windows 8 or greater) 64bit
Tue Mar 26 09:59:54 2019 us=619238 library versions: OpenSSL 1.1.0j  20 Nov 2018, LZO 2.10
Enter Management Password:
Tue Mar 26 09:59:54 2019 us=634863 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25346
Tue Mar 26 09:59:54 2019 us=634863 Need hold release from management interface, waiting...
Tue Mar 26 09:59:55 2019 us=119408 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25346
Tue Mar 26 09:59:55 2019 us=228673 MANAGEMENT: CMD 'state on'
Tue Mar 26 09:59:55 2019 us=228673 MANAGEMENT: CMD 'log all on'
Tue Mar 26 09:59:55 2019 us=306829 MANAGEMENT: CMD 'echo all on'
Tue Mar 26 09:59:55 2019 us=306829 MANAGEMENT: CMD 'bytecount 5'
Tue Mar 26 09:59:55 2019 us=306829 MANAGEMENT: CMD 'hold off'
Tue Mar 26 09:59:55 2019 us=306829 MANAGEMENT: CMD 'hold release'
Tue Mar 26 10:00:09 2019 us=774466 MANAGEMENT: CMD 'username "Auth" "x"'
Tue Mar 26 10:00:09 2019 us=774466 MANAGEMENT: CMD 'password [...]'
Tue Mar 26 10:00:09 2019 us=774466 WARNING: --ns-cert-type is DEPRECATED.  Use --remote-cert-tls instead.
Tue Mar 26 10:00:09 2019 us=790309 LZO compression initializing
Tue Mar 26 10:00:09 2019 us=790309 Control Channel MTU parms [ L:1624 D:1210 EF:40 EB:0 ET:0 EL:3 ]
Tue Mar 26 10:00:09 2019 us=790309 MANAGEMENT: >STATE:1553590809,RESOLVE,,,,,,
Tue Mar 26 10:00:09 2019 us=790309 Data Channel MTU parms [ L:1624 D:1450 EF:124 EB:406 ET:0 EL:3 ]
Tue Mar 26 10:00:09 2019 us=790309 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1560,tun-mtu 1500,proto TCPv4_CLIENT,comp-lzo,cipher AES-128-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Tue Mar 26 10:00:09 2019 us=790309 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1560,tun-mtu 1500,proto TCPv4_SERVER,comp-lzo,cipher AES-128-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Tue Mar 26 10:00:09 2019 us=790309 TCP/UDP: Preserving recently used remote address: [AF_INET]x:2000
Tue Mar 26 10:00:09 2019 us=790309 Socket Buffers: R=[65536->65536] S=[65536->65536]
Tue Mar 26 10:00:09 2019 us=790309 Attempting to establish TCP connection with [AF_INET]x:2000 [nonblock]
Tue Mar 26 10:00:09 2019 us=790309 MANAGEMENT: >STATE:1553590809,TCP_CONNECT,,,,,,
Tue Mar 26 10:00:10 2019 us=790422 TCP connection established with [AF_INET]x:2000
Tue Mar 26 10:00:10 2019 us=790422 TCP_CLIENT link local: (not bound)
Tue Mar 26 10:00:10 2019 us=790422 TCP_CLIENT link remote: [AF_INET]x:2000
Tue Mar 26 10:00:10 2019 us=790422 MANAGEMENT: >STATE:1553590810,WAIT,,,,,,
Tue Mar 26 10:00:10 2019 us=790422 MANAGEMENT: >STATE:1553590810,AUTH,,,,,,
Tue Mar 26 10:00:10 2019 us=790422 TLS: Initial packet from [AF_INET]x:2000, sid=85c148f3 1cd224e9
Tue Mar 26 10:00:10 2019 us=899625 VERIFY OK: depth=1, C=AT, ST=State, L=x, O=x x, OU=x x, CN=www.x-x.com, emailAddress=x@x-x.com
Tue Mar 26 10:00:10 2019 us=899625 VERIFY OK: nsCertType=SERVER
Tue Mar 26 10:00:10 2019 us=899625 VERIFY OK: depth=0, C=AT, ST=State, L=x, O=x x, OU=x x, CN=Server, emailAddress=x@x-x.com
Tue Mar 26 10:00:11 2019 us=8964 Control Channel: TLSv1, cipher SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Tue Mar 26 10:00:11 2019 us=8964 [Server] Peer Connection Initiated with [AF_INET]x:2000
Tue Mar 26 10:00:12 2019 us=243463 MANAGEMENT: >STATE:1553590812,GET_CONFIG,,,,,,
Tue Mar 26 10:00:12 2019 us=243463 SENT CONTROL [Server]: 'PUSH_REQUEST' (status=1)
Tue Mar 26 10:00:12 2019 us=290541 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway,dhcp-option DNS x64.88,dhcp-option DNS x64.84,dhcp-option DOMAIN x.at,dhcp-option WINS x64.88,route x0.0 255.255.128.0 net_gateway,route x150.0 255.255.255.0 net_gateway,route x151.0 255.255.255.0 net_gateway,route x200.0 255.255.255.0 net_gateway,route x201.0 255.255.255.0 net_gateway,route x.0.0 255.255.0.0 net_gateway,route x88.0 255.255.252.0 net_gateway,route x.0.0 255.255.0.0 net_gateway,route x.x.0.0 255.255.0.0 net_gateway,route x.x.0.0 255.255.0.0 net_gateway,route x124.1,topology net30,ping 10,ping-restart 600,route x29.38 255.255.255.255 vpn_gateway,route x30.2 255.255.255.255 vpn_gateway,ifconfig x124.194 x124.193'
Tue Mar 26 10:00:12 2019 us=290541 OPTIONS IMPORT: timers and/or timeouts modified
Tue Mar 26 10:00:12 2019 us=290541 OPTIONS IMPORT: --ifconfig/up options modified
Tue Mar 26 10:00:12 2019 us=290541 OPTIONS IMPORT: route options modified
Tue Mar 26 10:00:12 2019 us=290541 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Tue Mar 26 10:00:12 2019 us=290541 Data Channel MTU parms [ L:1560 D:1450 EF:60 EB:406 ET:0 EL:3 ]
Tue Mar 26 10:00:12 2019 us=290541 Outgoing Data Channel: Cipher 'AES-128-CBC' initialized with 128 bit key
Tue Mar 26 10:00:12 2019 us=290541 Outgoing Data Channel: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Mar 26 10:00:12 2019 us=290541 Incoming Data Channel: Cipher 'AES-128-CBC' initialized with 128 bit key
Tue Mar 26 10:00:12 2019 us=290541 Incoming Data Channel: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Mar 26 10:00:12 2019 us=290541 interactive service msg_channel=0
Tue Mar 26 10:00:12 2019 us=290541 ROUTE_GATEWAY x20.254/255.255.255.0 I=16 HWADDR=e4:b9:7a:c8:e0:7d
Tue Mar 26 10:00:12 2019 us=305995 open_tun
Tue Mar 26 10:00:12 2019 us=305995 TAP-WIN32 device [Ethernet 3] opened: \\.\Global\{50A33D17-CEAF-4420-874B-813085C7DEEF}.tap
Tue Mar 26 10:00:12 2019 us=305995 TAP-Windows Driver Version 9.21 
Tue Mar 26 10:00:12 2019 us=305995 TAP-Windows MTU=1500
Tue Mar 26 10:00:12 2019 us=305995 Notified TAP-Windows driver to set a DHCP IP/netmask of x124.194/255.255.255.252 on interface {50A33D17-CEAF-4420-874B-813085C7DEEF} [DHCP-serv: x124.193, lease-time: 31536000]
Tue Mar 26 10:00:12 2019 us=305995 DHCP option string: 0f086b6e 6170702e 61740608 ac144058 ac144054 2c04ac14 4058
Tue Mar 26 10:00:12 2019 us=305995 Successful ARP Flush on interface [9] {50A33D17-CEAF-4420-874B-813085C7DEEF}
Tue Mar 26 10:00:12 2019 us=305995 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Tue Mar 26 10:00:12 2019 us=305995 MANAGEMENT: >STATE:1553590812,ASSIGN_IP,,x124.194,,,,
Tue Mar 26 10:00:15 2019 us=72010 TEST ROUTES: 14/14 succeeded len=13 ret=1 a=0 u/d=up
Tue Mar 26 10:00:15 2019 us=72010 C:\WINDOWS\system32\route.exe ADD x MASK 255.255.255.255 x20.254
Tue Mar 26 10:00:15 2019 us=72010 env_block: add PATH=C:\WINDOWS\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Tue Mar 26 10:00:15 2019 us=103124 C:\WINDOWS\system32\route.exe DELETE 0.0.0.0 MASK 0.0.0.0 x20.254
Tue Mar 26 10:00:15 2019 us=103124 env_block: add PATH=C:\WINDOWS\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Tue Mar 26 10:00:15 2019 us=150004 C:\WINDOWS\system32\route.exe ADD 0.0.0.0 MASK 0.0.0.0 x124.193
Tue Mar 26 10:00:15 2019 us=150004 env_block: add PATH=C:\WINDOWS\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Tue Mar 26 10:00:15 2019 us=181257 MANAGEMENT: >STATE:1553590815,ADD_ROUTES,,,,,,
Tue Mar 26 10:00:15 2019 us=181257 C:\WINDOWS\system32\route.exe ADD x0.0 MASK 255.255.128.0 x20.254
Tue Mar 26 10:00:15 2019 us=181257 env_block: add PATH=C:\WINDOWS\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Tue Mar 26 10:00:15 2019 us=228138 C:\WINDOWS\system32\route.exe ADD x150.0 MASK 255.255.255.0 x20.254
Tue Mar 26 10:00:15 2019 us=228138 env_block: add PATH=C:\WINDOWS\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Tue Mar 26 10:00:15 2019 us=275041 C:\WINDOWS\system32\route.exe ADD x151.0 MASK 255.255.255.0 x20.254
Tue Mar 26 10:00:15 2019 us=275041 env_block: add PATH=C:\WINDOWS\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Tue Mar 26 10:00:15 2019 us=321897 C:\WINDOWS\system32\route.exe ADD x200.0 MASK 255.255.255.0 x20.254
Tue Mar 26 10:00:15 2019 us=321897 env_block: add PATH=C:\WINDOWS\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Tue Mar 26 10:00:15 2019 us=368805 C:\WINDOWS\system32\route.exe ADD x201.0 MASK 255.255.255.0 x20.254
Tue Mar 26 10:00:15 2019 us=368805 env_block: add PATH=C:\WINDOWS\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Tue Mar 26 10:00:15 2019 us=400029 C:\WINDOWS\system32\route.exe ADD x.0.0 MASK 255.255.0.0 x20.254
Tue Mar 26 10:00:15 2019 us=400029 env_block: add PATH=C:\WINDOWS\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Tue Mar 26 10:00:15 2019 us=446909 C:\WINDOWS\system32\route.exe ADD x88.0 MASK 255.255.252.0 x20.254
Tue Mar 26 10:00:15 2019 us=446909 env_block: add PATH=C:\WINDOWS\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Tue Mar 26 10:00:15 2019 us=478161 C:\WINDOWS\system32\route.exe ADD x.0.0 MASK 255.255.0.0 x20.254
Tue Mar 26 10:00:15 2019 us=478161 env_block: add PATH=C:\WINDOWS\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Tue Mar 26 10:00:15 2019 us=525041 C:\WINDOWS\system32\route.exe ADD x.x.0.0 MASK 255.255.0.0 x20.254
Tue Mar 26 10:00:15 2019 us=525041 env_block: add PATH=C:\WINDOWS\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Tue Mar 26 10:00:15 2019 us=556297 C:\WINDOWS\system32\route.exe ADD x.x.0.0 MASK 255.255.0.0 x20.254
Tue Mar 26 10:00:15 2019 us=556297 env_block: add PATH=C:\WINDOWS\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Tue Mar 26 10:00:15 2019 us=603201 C:\WINDOWS\system32\route.exe ADD x124.1 MASK 255.255.255.255 x124.193
Tue Mar 26 10:00:15 2019 us=603201 env_block: add PATH=C:\WINDOWS\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Tue Mar 26 10:00:15 2019 us=634427 C:\WINDOWS\system32\route.exe ADD x29.38 MASK 255.255.255.255 x124.193
Tue Mar 26 10:00:15 2019 us=634427 env_block: add PATH=C:\WINDOWS\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Tue Mar 26 10:00:15 2019 us=681307 C:\WINDOWS\system32\route.exe ADD x30.2 MASK 255.255.255.255 x124.193
Tue Mar 26 10:00:15 2019 us=681307 env_block: add PATH=C:\WINDOWS\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Tue Mar 26 10:00:15 2019 us=712590 Initialization Sequence Completed
Tue Mar 26 10:00:15 2019 us=712590 MANAGEMENT: >STATE:1553590815,CONNECTED,SUCCESS,x124.194,x,2000,x20.91,50265

TCPDump from DNS Request

TinCanTech

Due to your masking of IPs it is difficult to understand what the problem is,
however, try using the def1 flag to redirect-gateway.

patrikr

Couldn't test the def1 configuration until now, as it's a production openvpn server. We are setting up a test system which should be finished within this week.

Anyway we could solve the problem with a solution, which doesn't make me happy, but works. If you manipulate the metrik of the Windows TAP adapter, which is used for OpenVPN, to 15, the DNS server set to the TAP adapter will be used always.

TinCanTech

There is --block-outside-dns ..