pushing a route with a DNS address

Chebachien

Hello everybody,

I am currently trying to have routing enabled based on DNS addresses on our clients connection.

On the client side I am able to add a route using a DNS address like so:

route google.com

This is working fine, I can see that the routing is properly done (IP addresses are extracted from the DNS and put into the routing table)

On the server configuration side though, if I want to push the same configuration on the client side, it is not working.

push "route google.com"

In the log, I am getting the following error message:

Fri May 01 11:28:57 2020 PUSH: Received control message: 'PUSH_REPLY,....,route google.com,....'
Fri May 01 11:28:57 2020 Options error: route parameter network/IP 'google.com' must be a valid address

My expectation would be to have the same behavior on the client side since the same command is being processed there. I don't want to force this command to be present on the client configuration (which would requires all deployed configuration to be changed) or use a static IP instead of DNS. google.com is just used here as an example, this is not the address I am currently using.

A solution compatible with openvpn 2.4.6 would be appreciated, thank you.

TinCanTech

Chebachien wrote My expectation would be to have the same behavior on the client side since the same command is being processed there

As the error message clearly states:

Chebachien wrote Options error: route parameter network/IP 'google.com' must be a valid address

That is the way openvpn works.

Chebachien

As documented by the --route command: https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage

--route network/IP [netmask] [gateway] [metric]

The network and gateway parameters can also be specified as a DNS or /etc/hosts file resolvable name

So it is still valid to believe that the network/IP section mention in the error message could be a DNS address. There is no mention of a limitation that it could not be the case (either in the documentation or the error message, as the error message does not specify that it must be a valid IP address).

TinCanTech

See --allow-pull-fqdn in the manual.

Chebachien

Thank you for your support TinCanTech. This seems to be working when the client configuration is adding this switch.

Unfortunately (and funny enough), this option cannot be pushed by the server using

push "allow-pull-fqdn"

Options error: option 'allow-pull-fqdn' cannot be used in this context ([PUSH-OPTIONS])

Well I guess I won't have a choice in modifying all of our client configurations...

Thank you