[SOLVED] DNS resolution fails with "block-ouside-dns" on Windows client

sebelk

My problem is that Linux clients work but Windows 10 Pro ones don't.

My server configuration is:

dev tun
proto udp
port 1194
ca /etc/openvpn/easy-rsa/pki/ca.crt
cert /etc/openvpn/easy-rsa/pki/issued/LS00005_0965fef4-6b54-462a-ba28-485f1a1ac5ab.crt
key /etc/openvpn/easy-rsa/pki/private/LS00005_0965fef4-6b54-462a-ba28-485f1a1ac5ab.key
dh none
ecdh-curve prime256v1
topology subnet
server 10.8.1.0 255.255.255.0
push "dhcp-option DNS e.f.g.h"
push "dhcp-option DNS i.j.k.l"
push "dhcp-option DNS w.x.y.z"
push "route 10.0.220.0 255.255.255.0"
push "route 10.0.100.0 255.255.255.0"
push "block-outside-dns"
client-to-client
client-config-dir /etc/openvpn/ccd
keepalive 15 120
remote-cert-tls client
tls-version-min 1.2
tls-crypt /etc/openvpn/easy-rsa/pki/ta.key
cipher AES-256-CBC
auth SHA256
user openvpn
group openvpn
persist-key
persist-tun
crl-verify /etc/openvpn/crl.pem
status /var/log/openvpn-status.log 20
status-version 3
syslog
verb 4

For client that I'm testing I have /etc/openvpn/ccd/oneclient with this content:

ifconfig-push 10.8.1.93 255.255.255.0

Windows 10 Client configuration:

client
dev tun
proto udp
remote a.b.c.d 1194
resolv-retry infinite
nobind
remote-cert-tls server
tls-version-min 1.2
verify-x509-name LS00005_0965fef4-6b54-462a-ba28-485f1a1ac5ab name
cipher AES-256-CBC
auth SHA256
auth-nocache
verb 4

Client log:

Sun Mar 29 16:49:03 2020 us=94550 Current Parameter Settings:
Sun Mar 29 16:49:03 2020 us=94550   config = 'backup_oneclient.ovpn'
Sun Mar 29 16:49:03 2020 us=94550   mode = 0
Sun Mar 29 16:49:03 2020 us=94550   show_ciphers = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   show_digests = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   show_engines = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   genkey = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   key_pass_file = '[UNDEF]'
Sun Mar 29 16:49:03 2020 us=94550   show_tls_ciphers = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   connect_retry_max = 0
Sun Mar 29 16:49:03 2020 us=94550 Connection profiles [0]:
Sun Mar 29 16:49:03 2020 us=94550   proto = udp
Sun Mar 29 16:49:03 2020 us=94550   local = '[UNDEF]'
Sun Mar 29 16:49:03 2020 us=94550   local_port = '[UNDEF]'
Sun Mar 29 16:49:03 2020 us=94550   remote = 'a.b.c.d'
Sun Mar 29 16:49:03 2020 us=94550   remote_port = '1194'
Sun Mar 29 16:49:03 2020 us=94550   remote_float = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   bind_defined = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   bind_local = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   bind_ipv6_only = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   connect_retry_seconds = 5
Sun Mar 29 16:49:03 2020 us=94550   connect_timeout = 120
Sun Mar 29 16:49:03 2020 us=94550   socks_proxy_server = '[UNDEF]'
Sun Mar 29 16:49:03 2020 us=94550   socks_proxy_port = '[UNDEF]'
Sun Mar 29 16:49:03 2020 us=94550   tun_mtu = 1500
Sun Mar 29 16:49:03 2020 us=94550   tun_mtu_defined = ENABLED
Sun Mar 29 16:49:03 2020 us=94550   link_mtu = 1500
Sun Mar 29 16:49:03 2020 us=94550   link_mtu_defined = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   tun_mtu_extra = 0
Sun Mar 29 16:49:03 2020 us=94550   tun_mtu_extra_defined = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   mtu_discover_type = -1
Sun Mar 29 16:49:03 2020 us=94550   fragment = 0
Sun Mar 29 16:49:03 2020 us=94550   mssfix = 1450
Sun Mar 29 16:49:03 2020 us=94550   explicit_exit_notification = 0
Sun Mar 29 16:49:03 2020 us=94550 Connection profiles END
Sun Mar 29 16:49:03 2020 us=94550   remote_random = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   ipchange = '[UNDEF]'
Sun Mar 29 16:49:03 2020 us=94550   dev = 'tun'
Sun Mar 29 16:49:03 2020 us=94550   dev_type = '[UNDEF]'
Sun Mar 29 16:49:03 2020 us=94550   dev_node = '[UNDEF]'
Sun Mar 29 16:49:03 2020 us=94550   lladdr = '[UNDEF]'
Sun Mar 29 16:49:03 2020 us=94550   topology = 1
Sun Mar 29 16:49:03 2020 us=94550   ifconfig_local = '[UNDEF]'
Sun Mar 29 16:49:03 2020 us=94550   ifconfig_remote_netmask = '[UNDEF]'
Sun Mar 29 16:49:03 2020 us=94550   ifconfig_noexec = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   ifconfig_nowarn = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   ifconfig_ipv6_local = '[UNDEF]'
Sun Mar 29 16:49:03 2020 us=94550   ifconfig_ipv6_netbits = 0
Sun Mar 29 16:49:03 2020 us=94550   ifconfig_ipv6_remote = '[UNDEF]'
Sun Mar 29 16:49:03 2020 us=94550   shaper = 0
Sun Mar 29 16:49:03 2020 us=94550   mtu_test = 0
Sun Mar 29 16:49:03 2020 us=94550   mlock = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   keepalive_ping = 0
Sun Mar 29 16:49:03 2020 us=94550   keepalive_timeout = 0
Sun Mar 29 16:49:03 2020 us=94550   inactivity_timeout = 0
Sun Mar 29 16:49:03 2020 us=94550   ping_send_timeout = 0
Sun Mar 29 16:49:03 2020 us=94550   ping_rec_timeout = 0
Sun Mar 29 16:49:03 2020 us=94550   ping_rec_timeout_action = 0
Sun Mar 29 16:49:03 2020 us=94550   ping_timer_remote = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   remap_sigusr1 = 0
Sun Mar 29 16:49:03 2020 us=94550   persist_tun = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   persist_local_ip = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   persist_remote_ip = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   persist_key = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   passtos = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   resolve_retry_seconds = 1000000000
Sun Mar 29 16:49:03 2020 us=94550   resolve_in_advance = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   username = '[UNDEF]'
Sun Mar 29 16:49:03 2020 us=94550   groupname = '[UNDEF]'
Sun Mar 29 16:49:03 2020 us=94550   chroot_dir = '[UNDEF]'
Sun Mar 29 16:49:03 2020 us=94550   cd_dir = '[UNDEF]'
Sun Mar 29 16:49:03 2020 us=94550   writepid = '[UNDEF]'
Sun Mar 29 16:49:03 2020 us=94550   up_script = '[UNDEF]'
Sun Mar 29 16:49:03 2020 us=94550   down_script = '[UNDEF]'
Sun Mar 29 16:49:03 2020 us=94550   down_pre = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   up_restart = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   up_delay = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   daemon = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   inetd = 0
Sun Mar 29 16:49:03 2020 us=94550   log = ENABLED
Sun Mar 29 16:49:03 2020 us=94550   suppress_timestamps = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   machine_readable_output = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   nice = 0
Sun Mar 29 16:49:03 2020 us=94550   verbosity = 4
Sun Mar 29 16:49:03 2020 us=94550   mute = 0
Sun Mar 29 16:49:03 2020 us=94550   gremlin = 0
Sun Mar 29 16:49:03 2020 us=94550   status_file = '[UNDEF]'
Sun Mar 29 16:49:03 2020 us=94550   status_file_version = 1
Sun Mar 29 16:49:03 2020 us=94550   status_file_update_freq = 60
Sun Mar 29 16:49:03 2020 us=94550   occ = ENABLED
Sun Mar 29 16:49:03 2020 us=94550   rcvbuf = 0
Sun Mar 29 16:49:03 2020 us=94550   sndbuf = 0
Sun Mar 29 16:49:03 2020 us=94550   sockflags = 0
Sun Mar 29 16:49:03 2020 us=94550   fast_io = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   comp.alg = 0
Sun Mar 29 16:49:03 2020 us=94550   comp.flags = 0
Sun Mar 29 16:49:03 2020 us=94550   route_script = '[UNDEF]'
Sun Mar 29 16:49:03 2020 us=94550   route_default_gateway = '[UNDEF]'
Sun Mar 29 16:49:03 2020 us=94550   route_default_metric = 0
Sun Mar 29 16:49:03 2020 us=94550   route_noexec = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   route_delay = 5
Sun Mar 29 16:49:03 2020 us=94550   route_delay_window = 30
Sun Mar 29 16:49:03 2020 us=94550   route_delay_defined = ENABLED
Sun Mar 29 16:49:03 2020 us=94550   route_nopull = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   route_gateway_via_dhcp = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   allow_pull_fqdn = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   Pull filters:
Sun Mar 29 16:49:03 2020 us=94550     ignore "route-method"
Sun Mar 29 16:49:03 2020 us=94550   management_addr = '127.0.0.1'
Sun Mar 29 16:49:03 2020 us=94550   management_port = '25340'
Sun Mar 29 16:49:03 2020 us=94550   management_user_pass = 'stdin'
Sun Mar 29 16:49:03 2020 us=94550   management_log_history_cache = 250
Sun Mar 29 16:49:03 2020 us=94550   management_echo_buffer_size = 100
Sun Mar 29 16:49:03 2020 us=94550   management_write_peer_info_file = '[UNDEF]'
Sun Mar 29 16:49:03 2020 us=94550   management_client_user = '[UNDEF]'
Sun Mar 29 16:49:03 2020 us=94550   management_client_group = '[UNDEF]'
Sun Mar 29 16:49:03 2020 us=94550   management_flags = 6
Sun Mar 29 16:49:03 2020 us=94550   shared_secret_file = '[UNDEF]'
Sun Mar 29 16:49:03 2020 us=94550   key_direction = not set
Sun Mar 29 16:49:03 2020 us=94550   ciphername = 'AES-256-CBC'
Sun Mar 29 16:49:03 2020 us=94550   ncp_enabled = ENABLED
Sun Mar 29 16:49:03 2020 us=94550   ncp_ciphers = 'AES-256-GCM:AES-128-GCM'
Sun Mar 29 16:49:03 2020 us=94550   authname = 'SHA256'
Sun Mar 29 16:49:03 2020 us=94550   prng_hash = 'SHA1'
Sun Mar 29 16:49:03 2020 us=94550   prng_nonce_secret_len = 16
Sun Mar 29 16:49:03 2020 us=94550   keysize = 0
Sun Mar 29 16:49:03 2020 us=94550   engine = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   replay = ENABLED
Sun Mar 29 16:49:03 2020 us=94550   mute_replay_warnings = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   replay_window = 64
Sun Mar 29 16:49:03 2020 us=94550   replay_time = 15
Sun Mar 29 16:49:03 2020 us=94550   packet_id_file = '[UNDEF]'
Sun Mar 29 16:49:03 2020 us=94550   use_iv = ENABLED
Sun Mar 29 16:49:03 2020 us=94550   test_crypto = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   tls_server = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   tls_client = ENABLED
Sun Mar 29 16:49:03 2020 us=94550   key_method = 2
Sun Mar 29 16:49:03 2020 us=94550   ca_file = '[[INLINE]]'
Sun Mar 29 16:49:03 2020 us=94550   ca_path = '[UNDEF]'
Sun Mar 29 16:49:03 2020 us=94550   dh_file = '[UNDEF]'
Sun Mar 29 16:49:03 2020 us=94550   cert_file = '[[INLINE]]'
Sun Mar 29 16:49:03 2020 us=94550   extra_certs_file = '[UNDEF]'
Sun Mar 29 16:49:03 2020 us=94550   priv_key_file = '[[INLINE]]'
Sun Mar 29 16:49:03 2020 us=94550   pkcs12_file = '[UNDEF]'
Sun Mar 29 16:49:03 2020 us=94550   cryptoapi_cert = '[UNDEF]'
Sun Mar 29 16:49:03 2020 us=94550   cipher_list = '[UNDEF]'
Sun Mar 29 16:49:03 2020 us=94550   cipher_list_tls13 = '[UNDEF]'
Sun Mar 29 16:49:03 2020 us=94550   tls_cert_profile = '[UNDEF]'
Sun Mar 29 16:49:03 2020 us=94550   tls_verify = '[UNDEF]'
Sun Mar 29 16:49:03 2020 us=94550   tls_export_cert = '[UNDEF]'
Sun Mar 29 16:49:03 2020 us=94550   verify_x509_type = 2
Sun Mar 29 16:49:03 2020 us=94550   verify_x509_name = 'LS00005_0965fef4-6b54-462a-ba28-485f1a1ac5ab'
Sun Mar 29 16:49:03 2020 us=94550   crl_file = '[UNDEF]'
Sun Mar 29 16:49:03 2020 us=94550   ns_cert_type = 0
Sun Mar 29 16:49:03 2020 us=94550   remote_cert_ku[i] = 65535
Sun Mar 29 16:49:03 2020 us=94550   remote_cert_ku[i] = 0
Sun Mar 29 16:49:03 2020 us=94550   remote_cert_ku[i] = 0
Sun Mar 29 16:49:03 2020 us=94550   remote_cert_ku[i] = 0
Sun Mar 29 16:49:03 2020 us=94550   remote_cert_ku[i] = 0
Sun Mar 29 16:49:03 2020 us=94550   remote_cert_ku[i] = 0
Sun Mar 29 16:49:03 2020 us=94550   remote_cert_ku[i] = 0
Sun Mar 29 16:49:03 2020 us=94550   remote_cert_ku[i] = 0
Sun Mar 29 16:49:03 2020 us=94550   remote_cert_ku[i] = 0
Sun Mar 29 16:49:03 2020 us=94550   remote_cert_ku[i] = 0
Sun Mar 29 16:49:03 2020 us=94550   remote_cert_ku[i] = 0
Sun Mar 29 16:49:03 2020 us=94550   remote_cert_ku[i] = 0
Sun Mar 29 16:49:03 2020 us=94550   remote_cert_ku[i] = 0
Sun Mar 29 16:49:03 2020 us=94550   remote_cert_ku[i] = 0
Sun Mar 29 16:49:03 2020 us=94550   remote_cert_ku[i] = 0
Sun Mar 29 16:49:03 2020 us=94550   remote_cert_ku[i] = 0
Sun Mar 29 16:49:03 2020 us=94550   remote_cert_eku = 'TLS Web Server Authentication'
Sun Mar 29 16:49:03 2020 us=94550   ssl_flags = 192
Sun Mar 29 16:49:03 2020 us=94550   tls_timeout = 2
Sun Mar 29 16:49:03 2020 us=94550   renegotiate_bytes = -1
Sun Mar 29 16:49:03 2020 us=94550   renegotiate_packets = 0
Sun Mar 29 16:49:03 2020 us=94550   renegotiate_seconds = 3600
Sun Mar 29 16:49:03 2020 us=94550   handshake_window = 60
Sun Mar 29 16:49:03 2020 us=94550   transition_window = 3600
Sun Mar 29 16:49:03 2020 us=94550   single_session = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   push_peer_info = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   tls_exit = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   tls_auth_file = '[UNDEF]'
Sun Mar 29 16:49:03 2020 us=94550   tls_crypt_file = '[[INLINE]]'
Sun Mar 29 16:49:03 2020 us=94550   pkcs11_protected_authentication = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   pkcs11_protected_authentication = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   pkcs11_protected_authentication = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   pkcs11_protected_authentication = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   pkcs11_protected_authentication = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   pkcs11_protected_authentication = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   pkcs11_protected_authentication = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   pkcs11_protected_authentication = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   pkcs11_protected_authentication = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   pkcs11_protected_authentication = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   pkcs11_protected_authentication = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   pkcs11_protected_authentication = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   pkcs11_protected_authentication = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   pkcs11_protected_authentication = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   pkcs11_protected_authentication = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   pkcs11_protected_authentication = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   pkcs11_private_mode = 00000000
Sun Mar 29 16:49:03 2020 us=94550   pkcs11_private_mode = 00000000
Sun Mar 29 16:49:03 2020 us=94550   pkcs11_private_mode = 00000000
Sun Mar 29 16:49:03 2020 us=94550   pkcs11_private_mode = 00000000
Sun Mar 29 16:49:03 2020 us=94550   pkcs11_private_mode = 00000000
Sun Mar 29 16:49:03 2020 us=94550   pkcs11_private_mode = 00000000
Sun Mar 29 16:49:03 2020 us=94550   pkcs11_private_mode = 00000000
Sun Mar 29 16:49:03 2020 us=94550   pkcs11_private_mode = 00000000
Sun Mar 29 16:49:03 2020 us=94550   pkcs11_private_mode = 00000000
Sun Mar 29 16:49:03 2020 us=94550   pkcs11_private_mode = 00000000
Sun Mar 29 16:49:03 2020 us=94550   pkcs11_private_mode = 00000000
Sun Mar 29 16:49:03 2020 us=94550   pkcs11_private_mode = 00000000
Sun Mar 29 16:49:03 2020 us=94550   pkcs11_private_mode = 00000000
Sun Mar 29 16:49:03 2020 us=94550   pkcs11_private_mode = 00000000
Sun Mar 29 16:49:03 2020 us=94550   pkcs11_private_mode = 00000000
Sun Mar 29 16:49:03 2020 us=94550   pkcs11_private_mode = 00000000
Sun Mar 29 16:49:03 2020 us=94550   pkcs11_cert_private = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   pkcs11_cert_private = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   pkcs11_cert_private = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   pkcs11_cert_private = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   pkcs11_cert_private = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   pkcs11_cert_private = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   pkcs11_cert_private = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   pkcs11_cert_private = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   pkcs11_cert_private = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   pkcs11_cert_private = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   pkcs11_cert_private = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   pkcs11_cert_private = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   pkcs11_cert_private = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   pkcs11_cert_private = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   pkcs11_cert_private = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   pkcs11_cert_private = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   pkcs11_pin_cache_period = -1
Sun Mar 29 16:49:03 2020 us=94550   pkcs11_id = '[UNDEF]'
Sun Mar 29 16:49:03 2020 us=94550   pkcs11_id_management = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   server_network = 0.0.0.0
Sun Mar 29 16:49:03 2020 us=94550   server_netmask = 0.0.0.0
Sun Mar 29 16:49:03 2020 us=94550   server_network_ipv6 = ::
Sun Mar 29 16:49:03 2020 us=94550   server_netbits_ipv6 = 0
Sun Mar 29 16:49:03 2020 us=94550   server_bridge_ip = 0.0.0.0
Sun Mar 29 16:49:03 2020 us=94550   server_bridge_netmask = 0.0.0.0
Sun Mar 29 16:49:03 2020 us=94550   server_bridge_pool_start = 0.0.0.0
Sun Mar 29 16:49:03 2020 us=94550   server_bridge_pool_end = 0.0.0.0
Sun Mar 29 16:49:03 2020 us=94550   ifconfig_pool_defined = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   ifconfig_pool_start = 0.0.0.0
Sun Mar 29 16:49:03 2020 us=94550   ifconfig_pool_end = 0.0.0.0
Sun Mar 29 16:49:03 2020 us=94550   ifconfig_pool_netmask = 0.0.0.0
Sun Mar 29 16:49:03 2020 us=94550   ifconfig_pool_persist_filename = '[UNDEF]'
Sun Mar 29 16:49:03 2020 us=94550   ifconfig_pool_persist_refresh_freq = 600
Sun Mar 29 16:49:03 2020 us=94550   ifconfig_ipv6_pool_defined = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   ifconfig_ipv6_pool_base = ::
Sun Mar 29 16:49:03 2020 us=94550   ifconfig_ipv6_pool_netbits = 0
Sun Mar 29 16:49:03 2020 us=94550   n_bcast_buf = 256
Sun Mar 29 16:49:03 2020 us=94550   tcp_queue_limit = 64
Sun Mar 29 16:49:03 2020 us=94550   real_hash_size = 256
Sun Mar 29 16:49:03 2020 us=94550   virtual_hash_size = 256
Sun Mar 29 16:49:03 2020 us=94550   client_connect_script = '[UNDEF]'
Sun Mar 29 16:49:03 2020 us=94550   learn_address_script = '[UNDEF]'
Sun Mar 29 16:49:03 2020 us=94550   client_disconnect_script = '[UNDEF]'
Sun Mar 29 16:49:03 2020 us=94550   client_config_dir = '[UNDEF]'
Sun Mar 29 16:49:03 2020 us=94550   ccd_exclusive = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   tmp_dir = 'C:\Users\IGNACI~1\AppData\Local\Temp\'
Sun Mar 29 16:49:03 2020 us=94550   push_ifconfig_defined = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   push_ifconfig_local = 0.0.0.0
Sun Mar 29 16:49:03 2020 us=94550   push_ifconfig_remote_netmask = 0.0.0.0
Sun Mar 29 16:49:03 2020 us=94550   push_ifconfig_ipv6_defined = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   push_ifconfig_ipv6_local = ::/0
Sun Mar 29 16:49:03 2020 us=94550   push_ifconfig_ipv6_remote = ::
Sun Mar 29 16:49:03 2020 us=94550   enable_c2c = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   duplicate_cn = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   cf_max = 0
Sun Mar 29 16:49:03 2020 us=94550   cf_per = 0
Sun Mar 29 16:49:03 2020 us=94550   max_clients = 1024
Sun Mar 29 16:49:03 2020 us=94550   max_routes_per_client = 256
Sun Mar 29 16:49:03 2020 us=94550   auth_user_pass_verify_script = '[UNDEF]'
Sun Mar 29 16:49:03 2020 us=94550   auth_user_pass_verify_script_via_file = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   auth_token_generate = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   auth_token_lifetime = 0
Sun Mar 29 16:49:03 2020 us=94550   client = ENABLED
Sun Mar 29 16:49:03 2020 us=94550   pull = ENABLED
Sun Mar 29 16:49:03 2020 us=94550   auth_user_pass_file = '[UNDEF]'
Sun Mar 29 16:49:03 2020 us=94550   show_net_up = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   route_method = 3
Sun Mar 29 16:49:03 2020 us=94550   block_outside_dns = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   ip_win32_defined = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   ip_win32_type = 3
Sun Mar 29 16:49:03 2020 us=94550   dhcp_masq_offset = 0
Sun Mar 29 16:49:03 2020 us=94550   dhcp_lease_time = 31536000
Sun Mar 29 16:49:03 2020 us=94550   tap_sleep = 0
Sun Mar 29 16:49:03 2020 us=94550   dhcp_options = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   dhcp_renew = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   dhcp_pre_release = DISABLED
Sun Mar 29 16:49:03 2020 us=94550   domain = '[UNDEF]'
Sun Mar 29 16:49:03 2020 us=94550   netbios_scope = '[UNDEF]'
Sun Mar 29 16:49:03 2020 us=94550   netbios_node_type = 0
Sun Mar 29 16:49:03 2020 us=94550   disable_nbt = DISABLED
Sun Mar 29 16:49:03 2020 us=94550 OpenVPN 2.4.8 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on Oct 31 2019
Sun Mar 29 16:49:03 2020 us=94550 Windows version 6.2 (Windows 8 or greater) 64bit
Sun Mar 29 16:49:03 2020 us=94550 library versions: OpenSSL 1.1.0l  10 Sep 2019, LZO 2.10
Enter Management Password:
Sun Mar 29 16:49:03 2020 us=94550 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Sun Mar 29 16:49:03 2020 us=94550 Need hold release from management interface, waiting...
Sun Mar 29 16:49:03 2020 us=389560 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Sun Mar 29 16:49:03 2020 us=514311 MANAGEMENT: CMD 'state on'
Sun Mar 29 16:49:03 2020 us=514311 MANAGEMENT: CMD 'log all on'
Sun Mar 29 16:49:03 2020 us=735235 MANAGEMENT: CMD 'echo all on'
Sun Mar 29 16:49:03 2020 us=749935 MANAGEMENT: CMD 'bytecount 5'
Sun Mar 29 16:49:03 2020 us=749935 MANAGEMENT: CMD 'hold off'
Sun Mar 29 16:49:03 2020 us=749935 MANAGEMENT: CMD 'hold release'
Sun Mar 29 16:49:03 2020 us=749935 Outgoing Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
Sun Mar 29 16:49:03 2020 us=749935 Outgoing Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
Sun Mar 29 16:49:03 2020 us=749935 Incoming Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
Sun Mar 29 16:49:03 2020 us=749935 Incoming Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
Sun Mar 29 16:49:03 2020 us=749935 Control Channel MTU parms [ L:1621 D:1156 EF:94 EB:0 ET:0 EL:3 ]
Sun Mar 29 16:49:03 2020 us=749935 Data Channel MTU parms [ L:1621 D:1450 EF:121 EB:406 ET:0 EL:3 ]
Sun Mar 29 16:49:03 2020 us=749935 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1569,tun-mtu 1500,proto UDPv4,cipher AES-256-CBC,auth SHA256,keysize 256,key-method 2,tls-client'
Sun Mar 29 16:49:03 2020 us=749935 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1569,tun-mtu 1500,proto UDPv4,cipher AES-256-CBC,auth SHA256,keysize 256,key-method 2,tls-server'
Sun Mar 29 16:49:03 2020 us=749935 TCP/UDP: Preserving recently used remote address: [AF_INET]a.b.c.d:1194
Sun Mar 29 16:49:03 2020 us=749935 Socket Buffers: R=[65536->65536] S=[65536->65536]
Sun Mar 29 16:49:03 2020 us=749935 UDP link local: (not bound)
Sun Mar 29 16:49:03 2020 us=749935 UDP link remote: [AF_INET]a.b.c.d:1194
Sun Mar 29 16:49:03 2020 us=749935 MANAGEMENT: >STATE:1585511343,WAIT,,,,,,
Sun Mar 29 16:49:03 2020 us=828850 MANAGEMENT: >STATE:1585511343,AUTH,,,,,,
Sun Mar 29 16:49:03 2020 us=828850 TLS: Initial packet from [AF_INET]a.b.c.d:1194, sid=4cb41c8c 3f370c0f
Sun Mar 29 16:49:03 2020 us=858377 VERIFY OK: depth=1, CN=ChangeMe
Sun Mar 29 16:49:03 2020 us=858377 VERIFY KU OK
Sun Mar 29 16:49:03 2020 us=858377 Validating certificate extended key usage
Sun Mar 29 16:49:03 2020 us=858377 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Sun Mar 29 16:49:03 2020 us=858377 VERIFY EKU OK
Sun Mar 29 16:49:03 2020 us=858377 VERIFY X509NAME OK: CN=LS00005_0965fef4-6b54-462a-ba28-485f1a1ac5ab
Sun Mar 29 16:49:03 2020 us=858377 VERIFY OK: depth=0, CN=LS00005_0965fef4-6b54-462a-ba28-485f1a1ac5ab
Sun Mar 29 16:49:03 2020 us=905442 Control Channel: TLSv1.2, cipher TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384, 256 bit EC, curve: prime256v1
Sun Mar 29 16:49:03 2020 us=905442 [LS00005_0965fef4-6b54-462a-ba28-485f1a1ac5ab] Peer Connection Initiated with [AF_INET]a.b.c.d:1194
Sun Mar 29 16:49:04 2020 us=951755 MANAGEMENT: >STATE:1585511344,GET_CONFIG,,,,,,
Sun Mar 29 16:49:04 2020 us=951755 SENT CONTROL [LS00005_0965fef4-6b54-462a-ba28-485f1a1ac5ab]: 'PUSH_REQUEST' (status=1)
Sun Mar 29 16:49:04 2020 us=982805 PUSH: Received control message: 'PUSH_REPLY,dhcp-option DNS e.f.g.h,dhcp-option DNS i.j.k.l,dhcp-option DNS w.x.y.z,route 10.0.220.0 255.255.255.0,route 10.0.100.0 255.255.255.0,block-outside-dns,route-gateway 10.8.1.1,topology subnet,ping 15,ping-restart 120,ifconfig 10.8.1.93 255.255.255.0,peer-id 1,cipher AES-256-GCM'
Sun Mar 29 16:49:04 2020 us=982805 OPTIONS IMPORT: timers and/or timeouts modified
Sun Mar 29 16:49:04 2020 us=982805 OPTIONS IMPORT: --ifconfig/up options modified
Sun Mar 29 16:49:04 2020 us=982805 OPTIONS IMPORT: route options modified
Sun Mar 29 16:49:04 2020 us=982805 OPTIONS IMPORT: route-related options modified
Sun Mar 29 16:49:04 2020 us=982805 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Sun Mar 29 16:49:04 2020 us=982805 OPTIONS IMPORT: peer-id set
Sun Mar 29 16:49:04 2020 us=982805 OPTIONS IMPORT: adjusting link_mtu to 1624
Sun Mar 29 16:49:04 2020 us=982805 OPTIONS IMPORT: data channel crypto options modified
Sun Mar 29 16:49:04 2020 us=982805 Data Channel: using negotiated cipher 'AES-256-GCM'
Sun Mar 29 16:49:04 2020 us=982805 Data Channel MTU parms [ L:1552 D:1450 EF:52 EB:406 ET:0 EL:3 ]
Sun Mar 29 16:49:04 2020 us=982805 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Sun Mar 29 16:49:04 2020 us=982805 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Sun Mar 29 16:49:04 2020 us=982805 interactive service msg_channel=600
Sun Mar 29 16:49:04 2020 us=999462 ROUTE_GATEWAY 192.168.80.1/255.255.255.0 I=7 HWADDR=08:00:27:77:2b:b9
Sun Mar 29 16:49:04 2020 us=999462 open_tun
Sun Mar 29 16:49:04 2020 us=999462 TAP-WIN32 device [Conexi??n de ??rea local] opened: \\.\Global\{B7A0DF0F-F70E-47FF-A551-D43AF6B72B57}.tap
Sun Mar 29 16:49:04 2020 us=999462 TAP-Windows Driver Version 9.24 
Sun Mar 29 16:49:04 2020 us=999462 TAP-Windows MTU=1500
Sun Mar 29 16:49:04 2020 us=999462 Set TAP-Windows TUN subnet mode network/local/netmask = 10.8.1.0/10.8.1.93/255.255.255.0 [SUCCEEDED]
Sun Mar 29 16:49:04 2020 us=999462 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.1.93/255.255.255.0 on interface {B7A0DF0F-F70E-47FF-A551-D43AF6B72B57} [DHCP-serv: 10.8.1.254, lease-time: 31536000]
Sun Mar 29 16:49:04 2020 us=999462 DHCP option string: 060c0808 08080909 09099570 7070
Sun Mar 29 16:49:05 2020 us=16355 Successful ARP Flush on interface [14] {B7A0DF0F-F70E-47FF-A551-D43AF6B72B57}
Sun Mar 29 16:49:05 2020 us=16355 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Sun Mar 29 16:49:05 2020 us=16355 MANAGEMENT: >STATE:1585511345,ASSIGN_IP,,10.8.1.93,,,,
Sun Mar 29 16:49:05 2020 us=16355 Blocking outside DNS
Sun Mar 29 16:49:05 2020 us=16355 Using service to add block dns filters
Sun Mar 29 16:49:05 2020 us=55742 Blocking outside dns using service succeeded.
Sun Mar 29 16:49:10 2020 us=389182 TEST ROUTES: 2/2 succeeded len=2 ret=1 a=0 u/d=up
Sun Mar 29 16:49:10 2020 us=389182 MANAGEMENT: >STATE:1585511350,ADD_ROUTES,,,,,,
Sun Mar 29 16:49:10 2020 us=389182 C:\Windows\system32\route.exe ADD 10.0.220.0 MASK 255.255.255.0 10.8.1.1
Sun Mar 29 16:49:10 2020 us=389182 Route addition via service succeeded
Sun Mar 29 16:49:10 2020 us=389182 C:\Windows\system32\route.exe ADD 10.0.100.0 MASK 255.255.255.0 10.8.1.1
Sun Mar 29 16:49:10 2020 us=389182 Route addition via service succeeded
Sun Mar 29 16:49:10 2020 us=389182 Initialization Sequence Completed
Sun Mar 29 16:49:10 2020 us=389182 MANAGEMENT: >STATE:1585511350,CONNECTED,SUCCESS,10.8.1.93,a.b.c.d,1194,,

Server log:

Mar 29 16:49:03 LS00005 ovpn-server[5188]: MULTI: multi_create_instance called                                                                                                            
Mar 29 16:49:03 LS00005 ovpn-server[5188]: m.n.o.p:30459 Re-using SSL/TLS context
Mar 29 16:49:03 LS00005 ovpn-server[5188]: m.n.o.p:30459 Control Channel MTU parms [ L:1621 D:1156 EF:94 EB:0 ET:0 EL:3 ]                                                           
Mar 29 16:49:03 LS00005 ovpn-server[5188]: m.n.o.p:30459 Data Channel MTU parms [ L:1621 D:1450 EF:121 EB:406 ET:0 EL:3 ]                                                           
Mar 29 16:49:03 LS00005 ovpn-server[5188]: m.n.o.p:30459 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1569,tun-mtu 1500,proto UDPv4,cipher AES-256-CBC,auth SHA256,keysi$e 256,key-method 2,tls-server'
Mar 29 16:49:03 LS00005 ovpn-server[5188]: m.n.o.p:30459 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1569,tun-mtu 1500,proto UDPv4,cipher AES-256-CBC,auth SH$256,keysize 256,key-method 2,tls-client'
Mar 29 16:49:03 LS00005 ovpn-server[5188]: m.n.o.p:30459 TLS: Initial packet from [AF_INET]m.n.o.p:30459, sid=15f300e3 e59950f0                                                
Mar 29 16:49:03 LS00005 ovpn-server[5188]: m.n.o.p:30459 VERIFY OK: depth=1, CN=ChangeMe
Mar 29 16:49:03 LS00005 ovpn-server[5188]: m.n.o.p:30459 VERIFY KU OK
Mar 29 16:49:03 LS00005 ovpn-server[5188]: m.n.o.p:30459 Validating certificate extended key usage                                                                                  
Mar 29 16:49:03 LS00005 ovpn-server[5188]: m.n.o.p:30459 ++ Certificate has EKU (str) TLS Web Client Authentication, expects TLS Web Client Authentication                          
Mar 29 16:49:03 LS00005 ovpn-server[5188]: m.n.o.p:30459 VERIFY EKU OK
Mar 29 16:49:03 LS00005 ovpn-server[5188]: m.n.o.p:30459 VERIFY OK: depth=0, CN=oneclient
Mar 29 16:49:03 LS00005 ovpn-server[5188]: m.n.o.p:30459 peer info: IV_VER=2.4.8
Mar 29 16:49:03 LS00005 ovpn-server[5188]: m.n.o.p:30459 peer info: IV_PLAT=win
Mar 29 16:49:03 LS00005 ovpn-server[5188]: m.n.o.p:30459 peer info: IV_PROTO=2
Mar 29 16:49:03 LS00005 ovpn-server[5188]: m.n.o.p:30459 peer info: IV_NCP=2
Mar 29 16:49:03 LS00005 ovpn-server[5188]: m.n.o.p:30459 peer info: IV_LZ4=1
Mar 29 16:49:03 LS00005 ovpn-server[5188]: m.n.o.p:30459 peer info: IV_LZ4v2=1
Mar 29 16:49:03 LS00005 ovpn-server[5188]: m.n.o.p:30459 peer info: IV_LZO=1
Mar 29 16:49:03 LS00005 ovpn-server[5188]: m.n.o.p:30459 peer info: IV_COMP_STUB=1
Mar 29 16:49:03 LS00005 ovpn-server[5188]: m.n.o.p:30459 peer info: IV_COMP_STUBv2=1
Mar 29 16:49:03 LS00005 ovpn-server[5188]: m.n.o.p:30459 peer info: IV_TCPNL=1
Mar 29 16:49:03 LS00005 ovpn-server[5188]: m.n.o.p:30459 peer info: IV_GUI_VER=OpenVPN_GUI_11                                                                                       
Mar 29 16:49:03 LS00005 ovpn-server[5188]: m.n.o.p:30459 Control Channel: TLSv1.2, cipher TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384, 256 bit EC, curve: prime256v1                      
Mar 29 16:49:03 LS00005 ovpn-server[5188]: m.n.o.p:30459 [oneclient] Peer Connection Initiated with [AF_INET]m.n.o.p:30459                                                        
Mar 29 16:49:03 LS00005 ovpn-server[5188]: MULTI: new connection by client 'oneclient' will cause previous active sessions by this client to be dropped.  Remember to use the --duplicate-cn
option if you want multiple clients using the same certificate or username to concurrently connect.                                                                                      
Mar 29 16:49:03 LS00005 ovpn-server[5188]: OPTIONS IMPORT: reading client specific options from: /etc/openvpn/ccd/oneclient         
Mar 29 16:49:03 LS00005 ovpn-server[5188]: OPTIONS IMPORT: reading client specific options from: /etc/openvpn/ccd/oneclient                                                                 
Mar 29 16:49:03 LS00005 ovpn-server[5188]: MULTI: Learn: 10.8.1.93 -> oneclient/m.n.o.p:30459
Mar 29 16:49:03 LS00005 ovpn-server[5188]: MULTI: primary virtual IP for oneclient/m.n.o.p:30459: 10.8.1.93
Mar 29 16:49:05 LS00005 ovpn-server[5188]: oneclient/m.n.o.p:30459 PUSH: Received control message: 'PUSH_REQUEST'
Mar 29 16:49:05 LS00005 ovpn-server[5188]: oneclient/m.n.o.p:30459 SENT CONTROL [oneclient]: 'PUSH_REPLY,dhcp-option DNS e.f.g.h,dhcp-option DNS i.j.k.l,dhcp-option DNS w.x.y.z,ro
ute 10.0.220.0 255.255.255.0,route 10.0.100.0 255.255.255.0,block-outside-dns,route-gateway 10.8.1.1,topology subnet,ping 15,ping-restart 120,ifconfig 10.8.1.93 255.255.255.0,peer-id 1,c
ipher AES-256-GCM' (status=1)
Mar 29 16:49:05 LS00005 ovpn-server[5188]: oneclient/m.n.o.p:30459 Data Channel: using negotiated cipher 'AES-256-GCM'
Mar 29 16:49:05 LS00005 ovpn-server[5188]: oneclient/m.n.o.p:30459 Data Channel MTU parms [ L:1549 D:1450 EF:49 EB:406 ET:0 EL:3 ]
Mar 29 16:49:05 LS00005 ovpn-server[5188]: oneclient/m.n.o.p:30459 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Mar 29 16:49:05 LS00005 ovpn-server[5188]: oneclient/m.n.o.p:30459 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key

The problem is dns resolution does not work, however I can ping beyond of tunnel, If I comment block-outside-tunnel, however, everything works fine.

I've read a lot of posts about such as https://forums.openvpn.net/viewtopic.php?t=25827 , I've tried even disabling smart multi-homed name resolution and windows firewall, didn't work either... by the way in Windows using OpenVPN GUI 11.14.0.0

Any idea? Is a openvpn misconfiguration?

Thanks in advance!

Pippin

Is a openvpn misconfiguration?

Config look ok.
Are there actually DNS server listening on those addresses?
Did you configure them correctly?
What is so secret about those DNS servers?
What if you push only 9.9.9.9 instead?

TinCanTech

sebelk wrote My problem is that Linux clients work but Windows 10 Pro ones don't.

M$ Firewall :twisted:

Pippin

I will move myself to Doh!
:mrgreen:

Edit:
No wait, it's possible those Linux clients do not set DNS....

sebelk

Finally I've found this one https://community.openvpn.net/openvpn/ticket/882 that helped to fix it!

The solution is

push "route 9.9.9.9 255.255.255.255"

And so for every IP DNS Server you want to push 😉

HTH!

TinCanTech

sebelk wrote Finally I've found this one https://community.openvpn.net/openvpn/ticket/882 that helped to fix it!

The solution is
push "route 9.9.9.9/32 255.255.255.255"
And so for every IP DNS Server you want to push 😉

HTH!

Which is why we could not help:

sebelk wrote

server 10.8.1.0 255.255.255.0
push "dhcp-option DNS e.f.g.h"
push "dhcp-option DNS i.j.k.l"
push "dhcp-option DNS w.x.y.z"

Pippin

The push is wrong...
Would you still be willing to answer my questions?

sebelk

Thanks Pippin, I've just fixed and delete the typo "/32"

If you wish the post can be marked as "solved" 🙂

sebelk

Sorry, we encountered an error while displaying this content. If you're a user, please try again later. If you're an administrator, take a look in your Flarum log files for more information.

TinCanTech

sebelk wrote OK, I was a bit overzealous following the guideliness

The Pirates Code 8-)