linux and mac client dns problem

merrow

Hi,

I have a problem resolving dns when my mac and linux clients connect with vpn, dns works for windows clients.
The nat works (it works for windows clients)

I tried with the :
-> https://github.com/jonathanio/update-systemd-resolved
-> https://github.com/alfredopalhares/openvpn-update-resolv-conf

But nothing changes.
I'm passing you the server and client configuration file
My version of the openvpn server is 2.4.7-1 on debian 10
The firewall is nftables.conf

local ip_serveur
port 443
proto tcp
dev tun
ca ssl/ca.crt
cert ssl/nom_certifciat.crt
key ssl/nom_cle.key
dh ssl/dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist /etc/openvpn/pool-vpn-util.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.8.4"
push "dhcp-option DOMAIN lan"
keepalive 5 120
push "comp-lzo no"
push "compress stub-v2"
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn/openvpn-status.log
log-append /var/log/openvpn/openvpn.log
verb 4
script-security 2
tls-server
plugin /usr/lib/openvpn/openvpn-auth-ldap.so /etc/openvpn/auth/auth-ldap.conf

client
dev tun
proto tcp
remote ip_serveur 443
resolv-retry infinite
nobind
persist-key
persist-tun
verb 3

verify-x509-name name_serveur name

# Autentification par login et mot de passe
auth-user-pass
auth-nocache

# CERTIFICAT
ca CA-All.crt
#Pas d'espace dans le nommage du certificat
pkcs12 name-certifcat.p12
remote-cert-tls client

When I go to the mac and I look at resolv.conf, I get the dns pushed by the server.

If anyone has any ideas on how to make the dns work, I'll take it.

Thank you in advance.
Sincerely

TinCanTech

Use https://github.com/alfredopalhares/openvpn-update-resolv-conf

Your client will also require:

script-security 2
up /etc/openvpn/update-resolv-conf.sh
down  /etc/openvpn/update-resolv-conf.sh

merrow

hi,

Thank you for the answer.

I already did.

I put:

script-security 2
up /etc/openvpn/update-resolv-conf.sh
down /etc/openvpn/update-resolv-conf.sh

I tried with

script-security 2
setenv PATH /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/bin
up /etc/openvpn/scripts/update-systemd-resolved
up-restart
down /etc/openvpn/scripts/update-systemd-resolved
down-pre

I tried => https://askubuntu.com/questions/1032476/ubuntu-18-04-no-dns-resolution-when-connected-to-openvpn

with or without it doesn't work.

I also installed the openresolv package

Sorry I didn't put all the tests in the client. Conf.

best regards

TinCanTech

Use either of the two solutions.

Yes they do work, if you do it correctly.

merrow

I don't have to do the right thing.
Is there a mistake with what I passed on to you?

I'll put the logs of the connection to the vpn server.

PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.8.4,dhcp-option DOMAIN lkb.upmc.fr,comp-lzo no,compress stub-v2,route 10.8.0.1,topology net30,ping 5,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5,peer-id 0,cipher AES-256-GCM'
Thu Feb 20 16:22:22 2020 OPTIONS IMPORT: timers and/or timeouts modified
Thu Feb 20 16:22:22 2020 OPTIONS IMPORT: compression parms modified
Thu Feb 20 16:22:22 2020 OPTIONS IMPORT: --ifconfig/up options modified
Thu Feb 20 16:22:22 2020 OPTIONS IMPORT: route options modified
Thu Feb 20 16:22:22 2020 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Thu Feb 20 16:22:22 2020 OPTIONS IMPORT: peer-id set
Thu Feb 20 16:22:22 2020 OPTIONS IMPORT: adjusting link_mtu to 1627
Thu Feb 20 16:22:22 2020 OPTIONS IMPORT: data channel crypto options modified
Thu Feb 20 16:22:22 2020 Data Channel: using negotiated cipher 'AES-256-GCM'
Thu Feb 20 16:22:22 2020 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Thu Feb 20 16:22:22 2020 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Thu Feb 20 16:22:22 2020 ROUTE_GATEWAY 10.0.2.2/255.255.255.0 IFACE=enp0s3 HWADDR=08:00:27:ad:10:54
Thu Feb 20 16:22:22 2020 TUN/TAP device tun0 opened
Thu Feb 20 16:22:22 2020 TUN/TAP TX queue length set to 100
Thu Feb 20 16:22:22 2020 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Thu Feb 20 16:22:22 2020 /sbin/ip link set dev tun0 up mtu 1500
Thu Feb 20 16:22:22 2020 /sbin/ip addr add dev tun0 local 10.8.0.6 peer 10.8.0.5
Thu Feb 20 16:22:22 2020 /etc/openvpn/scripts/update-systemd-resolved tun0 1500 1555 10.8.0.6 10.8.0.5 init
<14>Feb 20 16:22:22 update-systemd-resolved: Link 'tun0' coming up
<14>Feb 20 16:22:22 update-systemd-resolved: Adding IPv4 DNS Server 8.8.8.8
<14>Feb 20 16:22:22 update-systemd-resolved: Adding IPv4 DNS Server 8.8.8.4
<14>Feb 20 16:22:22 update-systemd-resolved: Adding DNS Domain lkb.upmc.fr
<14>Feb 20 16:22:22 update-systemd-resolved: SetLinkDNS(3 2 2 4 8 8 8 8 2 4 8 8 8 4)
<14>Feb 20 16:22:22 update-systemd-resolved: SetLinkDomains(3 1 lkb.upmc.fr false)
Thu Feb 20 16:22:22 2020 /sbin/ip route add ip_serveur/32 via 10.0.2.2
Thu Feb 20 16:22:22 2020 /sbin/ip route add 0.0.0.0/1 via 10.8.0.5
Thu Feb 20 16:22:22 2020 /sbin/ip route add 128.0.0.0/1 via 10.8.0.5
Thu Feb 20 16:22:22 2020 /sbin/ip route add 10.8.0.1/32 via 10.8.0.5
Thu Feb 20 16:22:22 2020 Initialization Sequence Completed

thanks

TinCanTech

merrow wrote <14>Feb 20 16:22:22 update-systemd-resolved: Adding IPv4 DNS Server 8.8.8.8
<14>Feb 20 16:22:22 update-systemd-resolved: Adding IPv4 DNS Server 8.8.8.4
<14>Feb 20 16:22:22 update-systemd-resolved: Adding DNS Domain lkb.upmc.fr

Looks ok.

merrow

Thanks for the help.

It worked, once I restarted my vpn server.

I wouldn't say what was wrong with it, but the reboot makes the dns work for both linux and mac clients.

Thanks again and sorry for the inconvenience.