maddening intermittent DNS on Windows 10

db984

Hi,
I've been fighting with this for a week or so. I've got an intermittent DNS issue that's driving me crazy.

I can't reliably resolve FQDN's through the OpenVPN tunnel. I *think* it's related to ipv6 somehow since i can always ping the FQDN using the -4 flag; maybe some sort of DNS lookup time-out situation that relates to ipv6 since it always seems to start working randomly after i fiddle with it a bit.

The Tunnel connects no problem, and pinging the remote ip addresses always works.

Pinging just the hostname, seems to always work. It resolves to the correct FQDN, and resolves to the correct remote ip address:

C:\WINDOWS\system32>ping ptsterminal

Pinging ptsterminal.ad.mydomain.com [10.1.1.44] with 32 bytes of data:
Reply from 10.1.1.44: bytes=32 time=12ms TTL=127
Reply from 10.1.1.44: bytes=32 time=12ms TTL=127
Reply from 10.1.1.44: bytes=32 time=11ms TTL=127
Reply from 10.1.1.44: bytes=32 time=10ms TTL=127

Pinging the FQDN explicitly using ipv4 also always works:

C:\WINDOWS\system32>ping ptsterminal.ad.mydomain.com -4

Pinging ptsterminal.ad.mydomain.com [10.1.1.44] with 32 bytes of data:
Reply from 10.1.1.44: bytes=32 time=10ms TTL=127
Reply from 10.1.1.44: bytes=32 time=19ms TTL=127
Reply from 10.1.1.44: bytes=32 time=10ms TTL=127
Reply from 10.1.1.44: bytes=32 time=10ms TTL=127

However, pinging the FQDN intermittently results in:

C:\WINDOWS\system32>ping ptsterminal.ad.mydomain.com
Ping request could not find host ptsterminal.ad.mydomain.com. Please check the name and try again.

Then i start troubleshooting, and suddenly it works. And by troubleshooting, i just mean trying these other pings. I'm not flushing DNS or anything, or reconnecting the VPN or anything. Just doing some ping tests... and within a minute or 5 it usually starts working. That said flushing the DNS doesn't seem to make any difference, nor does reconnecting the VPN, or rebooting.

And in fact flushing the DNS seems to "break it". For example, when its working, flushing the DNS seems to break it. I just issued these commands in rapid succession: -- ping (worked), flushdns, ping (doesn't work)

C:\WINDOWS\system32>ping ptsterminal.ad.mydomain.com

Pinging ptsterminal.ad.mydomain.com [10.1.1.44] with 32 bytes of data:
Reply from 10.1.1.44: bytes=32 time=10ms TTL=127
Reply from 10.1.1.44: bytes=32 time=11ms TTL=127
Reply from 10.1.1.44: bytes=32 time=15ms TTL=127
Reply from 10.1.1.44: bytes=32 time=11ms TTL=127

Ping statistics for 10.1.1.44:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 10ms, Maximum = 15ms, Average = 11ms

C:\WINDOWS\system32>ipconfig /flushdns

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

C:\WINDOWS\system32>ping ptsterminal.ad.mydomain.com
Ping request could not find host ptsterminal.ad.mydomain.com. Please check the name and try again.

C:\WINDOWS\system32>

And some times, pinging it explicitly with -4 fixes it... but some times not: these commands were all issued in rapid succession: 3 pings (that didnt work), 1 ping with the -4 flag (that worked), and then another pin without the -4 flag that now worked...

C:\WINDOWS\system32>ping ptsterminal.ad.mydomain.com
Ping request could not find host ptsterminal.ad.mydomain.com. Please check the name and try again.

C:\WINDOWS\system32>ping ptsterminal.ad.mydomain.com
Ping request could not find host ptsterminal.ad.mydomain.com. Please check the name and try again.

C:\WINDOWS\system32>ping ptsterminal.ad.mydomain.com
Ping request could not find host ptsterminal.ad.mydomain.com. Please check the name and try again.

C:\WINDOWS\system32>ping ptsterminal.ad.mydomain.com -4

Pinging ptsterminal.ad.mydomain.com [10.1.1.44] with 32 bytes of data:
Reply from 10.1.1.44: bytes=32 time=10ms TTL=127
Reply from 10.1.1.44: bytes=32 time=10ms TTL=127

Ping statistics for 10.1.1.44:
    Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 10ms, Maximum = 10ms, Average = 10ms
Control-C
^C
C:\WINDOWS\system32>ping ptsterminal.ad.mydomain.com

Pinging ptsterminal.ad.mydomain.com [10.1.1.44] with 32 bytes of data:
Reply from 10.1.1.44: bytes=32 time=10ms TTL=127
Reply from 10.1.1.44: bytes=32 time=11ms TTL=127
Reply from 10.1.1.44: bytes=32 time=10ms TTL=127
Reply from 10.1.1.44: bytes=32 time=10ms TTL=127

Ping statistics for 10.1.1.44:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 10ms, Maximum = 11ms, Average = 10ms

C:\WINDOWS\system32>

I'm at wits end. Worst of all, I need to use the FQDN to connect to a terminal server gateway over the VPN, otherwise the certificate name in gateway doesn't match the connection attempt. So simply using the host name or ip address to work around it isn't an option. I could force it to work by editing my hosts file I guess, but I figured I'd take a stab at solving it properly first. Especially as there are other hosts over the VPN i need to access as well, and I'm not the only one using it.

client config:
dev tun
persist-tun
persist-key
cipher AES-128-CBC
ncp-ciphers AES-128-GCM
auth SHA256
tls-client
client
resolv-retry infinite
remote vpn1.mydomain.com 1195 udp
lport 0
verify-x509-name "vpn1.mydomain.com" name
auth-user-pass
remote-cert-tls server
reneg-sec 0
auth-nocache

server config:
dev ovpns2
verb 1
dev-type tun
dev-node /dev/tun2
writepid /var/run/openvpn_server2.pid
#user nobody
#group nobody
script-security 3
daemon
keepalive 10 60
ping-timer-rem
persist-tun
persist-key
proto udp4
cipher AES-128-CBC
auth SHA256
up /usr/local/sbin/ovpn-linkup
down /usr/local/sbin/ovpn-linkdown
client-connect /usr/local/sbin/openvpn.attributes.sh
client-disconnect /usr/local/sbin/openvpn.attributes.sh
local [public ip address]
engine rdrand
tls-server
server 10.0.9.0 255.255.255.0
client-config-dir /var/etc/openvpn-csc/server2
username-as-common-name
plugin /usr/local/lib/openvpn/plugins/openvpn-plugin-auth-script.so /usr/local/sbin/ovpn_auth_verify_async user [key] true server2 1195
tls-verify "/usr/local/sbin/ovpn_auth_verify tls 'vpn1.mydomain.com' 1"
lport 1195
management /var/etc/openvpn/server2.sock unix
push "route 10.1.1.0 255.255.255.0"
push "route 10.1.2.0 255.255.255.0"
push "dhcp-option DOMAIN ad.mydomain.com"
push "dhcp-option DNS 10.1.1.40"
ca /var/etc/openvpn/server2.ca
cert /var/etc/openvpn/server2.cert
key /var/etc/openvpn/server2.key
dh /etc/dh-parameters.4096
crl-verify /var/etc/openvpn/server2.crl-verify
tls-auth /var/etc/openvpn/server2.tls-auth 0
ncp-ciphers AES-128-GCM
persist-remote-ip
float
topology subnet
reneg-sec 0

my ip config looks like this:

Windows IP Configuration

   Host Name . . . . . . . . . . . . : myhostname
   Primary Dns Suffix  . . . . . . . :
   Node Type . . . . . . . . . . . . : Hybrid
   IP Routing Enabled. . . . . . . . : No
   WINS Proxy Enabled. . . . . . . . : No
   DNS Suffix Search List. . . . . . : lan.myotherdomain.ca
                                       ad.mydomain.com

Ethernet adapter Ethernet:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Intel(R) Ethernet Connection (2) I219-V
   Physical Address. . . . . . . . . : E0-D5-5E-29-51-2A
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes

Ethernet adapter vEthernet (DockerNAT):

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Hyper-V Virtual Ethernet Adapter #2
   Physical Address. . . . . . . . . : 00-15-5D-F0-11-0D
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
   IPv4 Address. . . . . . . . . . . : 10.0.75.1(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . :
   DNS Servers . . . . . . . . . . . : fec0:0:0:ffff::1%1
                                       fec0:0:0:ffff::2%1
                                       fec0:0:0:ffff::3%1
   NetBIOS over Tcpip. . . . . . . . : Enabled

Ethernet adapter vEthernet (local network):

   Connection-specific DNS Suffix  . : lan.myotherdomain.ca
   Description . . . . . . . . . . . : Hyper-V Virtual Ethernet Adapter #3
   Physical Address. . . . . . . . . : E0-D5-5E-29-51-2C
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   IPv6 Address. . . . . . . . . . . : [redacted] (Preferred)
   Lease Obtained. . . . . . . . . . : December 3, 2019 6:54:26 PM
   Lease Expires . . . . . . . . . . : December 5, 2019 12:12:12 PM
   IPv6 Address. . . . . . . . . . . : [redacted](Preferred)
   Temporary IPv6 Address. . . . . . : [redacted](Preferred)
   Temporary IPv6 Address. . . . . . : [redacted] (Deprecated)
   Link-local IPv6 Address . . . . . : fe80::d8ec:f66e:eb7:9fbf%6(Preferred)
   IPv4 Address. . . . . . . . . . . : 10.5.5.57(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Lease Obtained. . . . . . . . . . : December 3, 2019 6:54:25 PM
   Lease Expires . . . . . . . . . . : December 5, 2019 12:04:50 PM
   Default Gateway . . . . . . . . . : fe80::1:1%6
                                       10.5.5.1
   DHCP Server . . . . . . . . . . . : 10.5.5.1
   DHCPv6 IAID . . . . . . . . . . . : 484496734
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-21-D6-AF-17-E0-D5-5E-29-51-2A
   DNS Servers . . . . . . . . . . . : 2604:3d08:757f:c246:208:a2ff:fe0b:ff69
                                       10.5.5.1
                                       2604:3d08:757f:c246:208:a2ff:fe0b:ff69
   NetBIOS over Tcpip. . . . . . . . : Enabled
   Connection-specific DNS Suffix Search List :
                                       lan.myotherdomain.ca

Ethernet adapter Ethernet 3:

   Connection-specific DNS Suffix  . : ad.mydomain.com
   Description . . . . . . . . . . . : TAP-Windows Adapter V9
   Physical Address. . . . . . . . . : 00-FF-D9-DC-B3-83
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   Link-local IPv6 Address . . . . . : fe80::4184:c053:25d4:538%19(Preferred)
   IPv4 Address. . . . . . . . . . . : 10.0.9.2(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Lease Obtained. . . . . . . . . . : December 4, 2019 11:38:06 AM
   Lease Expires . . . . . . . . . . : December 3, 2020 11:38:05 AM
   Default Gateway . . . . . . . . . :
   DHCP Server . . . . . . . . . . . : 10.0.9.254
   DHCPv6 IAID . . . . . . . . . . . : 83951577
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-21-D6-AF-17-E0-D5-5E-29-51-2A
   DNS Servers . . . . . . . . . . . : 10.1.1.40
   NetBIOS over Tcpip. . . . . . . . : Enabled

Ethernet adapter vEthernet (Default Switch):

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Hyper-V Virtual Ethernet Adapter
   Physical Address. . . . . . . . . : 00-15-5D-21-83-D5
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
   Link-local IPv6 Address . . . . . : fe80::9ad:40c5:5cb1:b6e9%26(Preferred)
   IPv4 Address. . . . . . . . . . . : 192.168.34.1(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.240
   Default Gateway . . . . . . . . . :
   DHCPv6 IAID . . . . . . . . . . . : 436213085
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-21-D6-AF-17-E0-D5-5E-29-51-2A
   DNS Servers . . . . . . . . . . . : fec0:0:0:ffff::1%1
                                       fec0:0:0:ffff::2%1
                                       fec0:0:0:ffff::3%1
   NetBIOS over Tcpip. . . . . . . . : Enabled

juliengreard

Hi, just created an account to thank you ! I had a similar issue using a DNS via openVPN. Sometimes it worked, sometimes not...
I just disabled ipv6 in my network settings (in the virtual card created by openVPN). It's working like a charm now !
Thanks again, many kudos to you

TiTex

it's probably because ipv6 has a higher precedence than ipv4, on widows that's the case even with link local addresses
you can change that though with some winreg editing

TinCanTech

See --block-outside-dns in the manual (because Windows sucks.. )