Hello, My config.: [b]- Server[/b] VPS with "Debian GNU/Linux 10 (buster)" OpenVPN 2.4.7 x86_64-pc-linux-gnu [b]- Client[/b] Windows 8.1 Community OpenVPN & GUI installed from "openvpn-install-2.4.8-I602-Win7.exe" [b]server.conf[/b] [code] local 151.xx.xx.xx port 1194 proto udp dev tun ca ca.crt cert server.crt key server.key dh dh.pem auth SHA512 auth-nocache tls-crypt tc.key topology subnet server 10.8.0.0 255.255.255.0 ifconfig-pool-persist ipp.txt push "redirect-gateway def1 bypass-dhcp" push "dhcp-option DNS 9.9.9.9" push "block-outside-dns" keepalive 10 120 cipher AES-128-GCM user nobody group nogroup persist-key persist-tun status openvpn-status.log verb 4 crl-verify crl.pem explicit-exit-notify sndbuf 0 rcvbuf 0 tun-mtu 1400 mssfix 1360[/code] [b]win81_client.ovpn[/b] [code]client dev tun proto udp remote 151.xx.xx.xx 1194 resolv-retry infinite nobind persist-key persist-tun remote-cert-tls server auth SHA512 ncp-disable cipher AES-128-GCM auth-nocache block-outside-dns verb 4 sndbuf 393216 rcvbuf 393216 tun-mtu 1400 mssfix 1360 -----BEGIN CERTIFICATE----- xxxxx -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- xxxxx -----END CERTIFICATE----- -----BEGIN PRIVATE KEY----- xxxxxx -----END PRIVATE KEY----- -----BEGIN OpenVPN Static key V1----- xxxxx -----END OpenVPN Static key V1----- [/code] On Windows 8.1, with OpenVPN "ON", I get via [b]dnsleak.com[/b] : [code]Your IP: 151.xx.xx.xx DNS IP: 80.67.169.40 Hostname: ns1.fdn.org[/code] It is the DNS I set for the TAP interface used by OpenVPN, using an easy small tool called "DNSjumper.exe". I should get "[b]DNS IP : 9.9.9.9"[/b] . [b]push "block_outside_dns"[/b] and [b]push "dhcp-option DNS 9.9.9.9"[/b] don't seem to work.... :( Here is the [b]win81_client.log[/b] file : [code]Mon Jan 06 15:25:04 2020 OpenVPN 2.4.8 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on Oct 31 2019 Mon Jan 06 15:25:04 2020 Windows version 6.2 (Windows 8 or greater) 64bit Mon Jan 06 15:25:04 2020 library versions: OpenSSL 1.1.0l 10 Sep 2019, LZO 2.10 Enter Management Password: Mon Jan 06 15:25:04 2020 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340 Mon Jan 06 15:25:04 2020 Need hold release from management interface, waiting... Mon Jan 06 15:25:05 2020 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340 Mon Jan 06 15:25:05 2020 MANAGEMENT: CMD 'state on' Mon Jan 06 15:25:05 2020 MANAGEMENT: CMD 'log all on' Mon Jan 06 15:25:05 2020 MANAGEMENT: CMD 'echo all on' Mon Jan 06 15:25:05 2020 MANAGEMENT: CMD 'bytecount 5' Mon Jan 06 15:25:05 2020 MANAGEMENT: CMD 'hold off' Mon Jan 06 15:25:05 2020 MANAGEMENT: CMD 'hold release' Mon Jan 06 15:25:05 2020 Outgoing Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key Mon Jan 06 15:25:05 2020 Outgoing Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication Mon Jan 06 15:25:05 2020 Incoming Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key Mon Jan 06 15:25:05 2020 Incoming Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication Mon Jan 06 15:25:05 2020 WARNING: normally if you use --mssfix and/or --fragment, you should also set --tun-mtu 1500 (currently it is 1400) Mon Jan 06 15:25:05 2020 TCP/UDP: Preserving recently used remote address: [AF_INET]151.xx.xx.xx:1194 Mon Jan 06 15:25:05 2020 Socket Buffers: R=[65536->393216] S=[65536->393216] Mon Jan 06 15:25:05 2020 UDP link local: (not bound) Mon Jan 06 15:25:05 2020 UDP link remote: [AF_INET]151.xx.xx.xx:1194 Mon Jan 06 15:25:05 2020 MANAGEMENT: >STATE:1578320705,WAIT,,,,,, Mon Jan 06 15:25:05 2020 MANAGEMENT: >STATE:1578320705,AUTH,,,,,, Mon Jan 06 15:25:05 2020 TLS: Initial packet from [AF_INET]151.xx.xx.xx:1194, sid=xxx Mon Jan 06 15:25:05 2020 VERIFY OK: depth=1, CN=ChangeMe Mon Jan 06 15:25:05 2020 VERIFY KU OK Mon Jan 06 15:25:05 2020 Validating certificate extended key usage Mon Jan 06 15:25:05 2020 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication Mon Jan 06 15:25:05 2020 VERIFY EKU OK Mon Jan 06 15:25:05 2020 VERIFY OK: depth=0, CN=server Mon Jan 06 15:25:05 2020 Control Channel: TLSv1.2, cipher TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384, 2048 bit RSA Mon Jan 06 15:25:05 2020 [server] Peer Connection Initiated with [AF_INET]151.xx.xx.xx:1194 Mon Jan 06 15:25:06 2020 MANAGEMENT: >STATE:1578320706,GET_CONFIG,,,,,, Mon Jan 06 15:25:06 2020 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1) Mon Jan 06 15:25:06 2020 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 9.9.9.9,block-outside-dns,route-gateway 10.8.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.8.0.2 255.255.255.0,peer-id 0' Mon Jan 06 15:25:06 2020 OPTIONS IMPORT: timers and/or timeouts modified Mon Jan 06 15:25:06 2020 OPTIONS IMPORT: --ifconfig/up options modified Mon Jan 06 15:25:06 2020 OPTIONS IMPORT: route options modified Mon Jan 06 15:25:06 2020 OPTIONS IMPORT: route-related options modified Mon Jan 06 15:25:06 2020 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified Mon Jan 06 15:25:06 2020 OPTIONS IMPORT: peer-id set Mon Jan 06 15:25:06 2020 OPTIONS IMPORT: adjusting link_mtu to 1524 Mon Jan 06 15:25:06 2020 Outgoing Data Channel: Cipher 'AES-128-GCM' initialized with 128 bit key Mon Jan 06 15:25:06 2020 Incoming Data Channel: Cipher 'AES-128-GCM' initialized with 128 bit key Mon Jan 06 15:25:06 2020 interactive service msg_channel=308 Mon Jan 06 15:25:06 2020 ROUTE_GATEWAY 192.168.1.1/255.255.255.0 I=3 HWADDR=90:48:9a:da:48:13 Mon Jan 06 15:25:06 2020 open_tun Mon Jan 06 15:25:06 2020 TAP-WIN32 device [Connexion au réseau local 2] opened: \\.\Global\{xxx}.tap Mon Jan 06 15:25:06 2020 TAP-Windows Driver Version 9.24 Mon Jan 06 15:25:06 2020 Set TAP-Windows TUN subnet mode network/local/netmask = 10.8.0.0/10.8.0.2/255.255.255.0 [SUCCEEDED] Mon Jan 06 15:25:06 2020 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.2/255.255.255.0 on interface {xxx} [DHCP-serv: 10.8.0.254, lease-time: 31536000] Mon Jan 06 15:25:06 2020 Successful ARP Flush on interface [41] {xxx} Mon Jan 06 15:25:06 2020 MANAGEMENT: >STATE:1578320706,ASSIGN_IP,,10.8.0.2,,,, Mon Jan 06 15:25:07 2020 Blocking outside dns using service succeeded. Mon Jan 06 15:25:12 2020 TEST ROUTES: 1/1 succeeded len=0 ret=1 a=0 u/d=up Mon Jan 06 15:25:12 2020 C:\WINDOWS\system32\route.exe ADD 151.xx.xx.xx MASK 255.255.255.255 192.168.1.1 Mon Jan 06 15:25:12 2020 Route addition via service succeeded Mon Jan 06 15:25:12 2020 C:\WINDOWS\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.8.0.1 Mon Jan 06 15:25:12 2020 Route addition via service succeeded Mon Jan 06 15:25:12 2020 C:\WINDOWS\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 10.8.0.1 Mon Jan 06 15:25:12 2020 Route addition via service succeeded Mon Jan 06 15:25:12 2020 Initialization Sequence Completed Mon Jan 06 15:25:12 2020 MANAGEMENT: >STATE:1578320712,CONNECTED,SUCCESS,10.8.0.2,151.xx.xx.xx,1194,,[/code] No errors. I can even see "Mon Jan 06 15:25:06 2020 OPTIONS IMPORT: --ip-win32 and/or [b]--dhcp-option options modified[/b]" I can give you any more info if you need to troubleshoot this problem. NB: on an Android 6.1 client, it works fine :) , I well get DNS IP 9.9.9.9 when connected with Wifi via OpenVPN, although I set a different DNS IP and static IP on this device. Quite normal since "block_outside_dns" is an option dedicated to Windows devices. Thanks in advance ! Regards, Steve

[quote=Steve_92 post_id=88796 time=1578324762 user_id=48901] It is the DNS I set for the TAP interface used by OpenVPN, using an easy small tool called "DNSjumper.exe". [/quote]Don't use DNSJumper.exe as it does not appear to work. [quote=Steve_92 post_id=88796 time=1578324762 user_id=48901] I can give you any more info if you need to troubleshoot this problem [/quote]Please paste the output from [b]ipconfig /all[/b]

Well seen TinCanTech ! :ugeek: I used DNSJumper.exe to reset initial DNS value for TAP adapter, in fact : no value (empty field). And now, it's working like a charm ! I get under Windows the DNS address pushed by OpenVPN server (can be different from DNS IP used by Debian server). :) It's a little bit curious, it supposes this kind of logic in the code of OpenVPN: [code]if DNS IP value not empty in TAP inteface then use it else use DNS IP pushed by OpenVPN server[/code] Is it a bug or is it a feature ? :D In fact, perhaps a feature allowing the client to bypass the DNS IP pushed by the server... :shock: strange because it can create a DNS leak. I'd like to have the advice of developers. Thanks for your help ! Regards, Steve.

Windows 8.1: "block_outside_dns" does not work ?!?

[deleted]

Sorry, we encountered an error while displaying this content. If you're a user, please try again later. If you're an administrator, take a look in your Flarum log files for more information.

TinCanTech

Steve_92 wrote It is the DNS I set for the TAP interface used by OpenVPN, using an easy small tool called "DNSjumper.exe".

Don't use DNSJumper.exe as it does not appear to work.

Steve_92 wrote I can give you any more info if you need to troubleshoot this problem

Please paste the output from ipconfig /all

[deleted]

Well seen TinCanTech ! :ugeek:

I used DNSJumper.exe to reset initial DNS value for TAP adapter, in fact : no value (empty field).
And now, it's working like a charm !
I get under Windows the DNS address pushed by OpenVPN server (can be different from DNS IP used by Debian server). 🙂

It's a little bit curious, it supposes this kind of logic in the code of OpenVPN:

if DNS IP value not empty in TAP inteface
then use it
else use DNS IP pushed by OpenVPN server

Is it a bug or is it a feature ? 😃

In fact, perhaps a feature allowing the client to bypass the DNS IP pushed by the server... :shock: strange because it can create a DNS leak.
I'd like to have the advice of developers.

Thanks for your help !

Regards,

Steve.

TinCanTech

Quoth The Manual wrote
--block-outside-dns

Block DNS servers on other network adapters to prevent DNS leaks. This option prevents any application from accessing TCP or UDP port 53 except one inside the tunnel. It uses Windows Filtering Platform (WFP) and works on Windows Vista or later.

[deleted]

It does not explain why if a DNS IP is defined for TAP adapter used by OpenVPN, it orverrides DNS IP pushed by OpenVPN server ... 😐

TinCanTech

What you are saying is that this is a bug in --block-outside-dns .. therefore you should report the bug, please.

https://community.openvpn.net/openvpn/newticket