I am running an OpenVPN server on Ubuntu 18.04.
I have managed to connect to the server from another Ubuntu client and everything works flawlessly.
However, when trying to connect from Windows/iOS/Android clients, the connection is established, but the DNS resolution does not work. Those clients are able to communicate with servers using their IP, but when DNS resolution is required, the clients fail to resolve the domains.
Port 1194 UDP is opened at the firewall.
Attached are server and client configs, their logs and the server iptables.
Any help will be appreciated.
port 1194
proto udp
dev tun
sndbuf 0
rcvbuf 0
ca /etc/openvpn/ca.crt
cert /etc/openvpn/server.crt
key /etc/openvpn/server.key
dh /etc/openvpn/dh.pem
auth SHA512
tls-auth /etc/openvpn/ta.key 0
topology subnet
server 10.8.0.0 255.255.255.0
local 105.205.197.128 #Here you should add the server ipv4 address
ifconfig-pool-persist /etc/openvpn/ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
keepalive 10 120
cipher AES-256-CBC
user nobody
group nogroup
persist-key
persist-tun
client-to-client
status /etc/openvpn/openvpn-status.log
verb 6
crl-verify /etc/openvpn/crl.pem
client
dev tun
proto udp
sndbuf 0
rcvbuf 0
tun-mtu 1500
mssfix 1420
remote 105.205.197.128 1194
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
auth SHA512
auth-nocache
cipher AES-256-CBC
setenv opt block-outside-dns
key-direction 1
verb 3
Client log:
11/14/2020, 7:16:47 PM OpenVPN core 3.git::662eae9a win x86_64 64-bit built on Oct 27 2020 12:49:07
⏎11/14/2020, 7:16:47 PM Frame=512/2048/512 mssfix-ctrl=1250
⏎11/14/2020, 7:16:47 PM UNUSED OPTIONS
3 [sndbuf] [0]
4 [rcvbuf] [0]
8 [resolv-retry] [infinite]
9 [nobind]
10 [persist-key]
11 [persist-tun]
14 [auth-nocache]
16 [block-outside-dns]
18 [verb] [3]
⏎11/14/2020, 7:16:47 PM EVENT: RESOLVE ⏎11/14/2020, 7:16:47 PM EVENT: WAIT ⏎11/14/2020, 7:16:47 PM Contacting 105.205.197.128:1194 via UDP
⏎11/14/2020, 7:16:47 PM WinCommandAgent: transmitting bypass route to 105.205.197.128
{
"host" : "105.205.197.128",
"ipv6" : false
}
⏎11/14/2020, 7:16:47 PM Connecting to [105.205.197.128]:1194 (105.205.197.128) via UDPv4
⏎11/14/2020, 7:16:47 PM EVENT: CONNECTING ⏎11/14/2020, 7:16:47 PM Tunnel Options:V4,dev-type tun,link-mtu 1601,tun-mtu 1500,proto UDPv4,keydir 1,cipher AES-256-CBC,auth SHA512,keysize 256,tls-auth,key-method 2,tls-client
⏎11/14/2020, 7:16:47 PM Creds: UsernameEmpty/PasswordEmpty
⏎11/14/2020, 7:16:47 PM Peer Info:
IV_VER=3.git::662eae9a
IV_PLAT=win
IV_NCP=2
IV_TCPNL=1
IV_PROTO=2
IV_IPv6=0
IV_AUTO_SESS=1
IV_GUI_VER=OCWindows_3.2.2-1455
IV_SSO=openurl
⏎11/14/2020, 7:16:47 PM SSL Handshake: CN=server, TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 2048 bit RSA
⏎11/14/2020, 7:16:47 PM Session is ACTIVE
⏎11/14/2020, 7:16:47 PM EVENT: GET_CONFIG ⏎11/14/2020, 7:16:47 PM Sending PUSH_REQUEST to server...
⏎11/14/2020, 7:16:47 PM EVENT: ASSIGN_IP ⏎11/14/2020, 7:16:47 PM OPTIONS:
0 [redirect-gateway] [def1] [bypass-dhcp]
1 [dhcp-option] [DNS] [8.8.8.8]
2 [dhcp-option] [DNS] [8.8.4.4]
3 [route-gateway] [10.8.0.1]
4 [topology] [subnet]
5 [ping] [10]
6 [ping-restart] [120]
7 [ifconfig] [10.8.0.4] [255.255.255.0]
8 [peer-id] [0]
9 [cipher] [AES-256-GCM]
10 [block-ipv6]
⏎11/14/2020, 7:16:47 PM PROTOCOL OPTIONS:
cipher: AES-256-GCM
digest: NONE
compress: NONE
peer ID: 0
⏎11/14/2020, 7:16:47 PM CAPTURED OPTIONS:
Session Name: 105.205.197.128
Layer: OSI_LAYER_3
MTU: 1500
Remote Address: 105.205.197.128
Tunnel Addresses:
10.8.0.4/24 -> 10.8.0.1
Reroute Gateway: IPv4=1 IPv6=0 flags=[ ENABLE REROUTE_GW DEF1 BYPASS_DHCP IPv4 ]
Block IPv6: yes
Add Routes:
Exclude Routes:
DNS Servers:
8.8.8.8
8.8.4.4
Search Domains:
⏎11/14/2020, 7:16:48 PM SetupClient: transmitting tun setup list to \\.\pipe\agent_ovpnconnect
{
"confirm_event" : "800d000000000000",
"destroy_event" : "ac17000000000000",
"tun" :
{
"adapter_domain_suffix" : "",
"block_ipv6" : true,
"dns_servers" :
[
{
"address" : "8.8.8.8",
"ipv6" : false
},
{
"address" : "8.8.4.4",
"ipv6" : false
}
],
"layer" : 3,
"mtu" : 1500,
"remote_address" :
{
"address" : "105.205.197.128",
"ipv6" : false
},
"reroute_gw" :
{
"flags" : 307,
"ipv4" : true,
"ipv6" : false
},
"route_metric_default" : -1,
"session_name" : "105.205.197.128",
"tunnel_address_index_ipv4" : 0,
"tunnel_address_index_ipv6" : -1,
"tunnel_addresses" :
[
{
"address" : "10.8.0.4",
"gateway" : "10.8.0.1",
"ipv6" : false,
"metric" : -1,
"net30" : false,
"prefix_length" : 24
}
]
},
"wintun" : false
}
POST np://[\\.\pipe\agent_ovpnconnect]/tun-setup : 200 OK
TAP ADAPTERS:
guid='{12D83155-656F-4FAD-B661-E40F8A745C87}' index=8 name='Local Area Connection'
Open TAP device "Local Area Connection" PATH="\\.\Global\{12D83155-656F-4FAD-B661-E40F8A745C87}.tap" SUCCEEDED
TAP-Windows Driver Version 9.24
ActionDeleteAllRoutesOnInterface iface_index=8
netsh interface ip set interface 8 metric=1
Ok.
netsh interface ip set address 8 static 10.8.0.4 255.255.255.0 gateway=10.8.0.1 store=active
netsh interface ipv6 add route 2000::/4 interface=1 store=active
Ok.
netsh interface ipv6 add route 3000::/4 interface=1 store=active
Ok.
netsh interface ipv6 add route fc00::/7 interface=1 store=active
Ok.
netsh interface ip add route 105.205.197.128/32 21 192.168.1.1 store=active
The object already exists.
netsh interface ip add route 0.0.0.0/1 8 10.8.0.1 store=active
Ok.
netsh interface ip add route 128.0.0.0/1 8 10.8.0.1 store=active
Ok.
netsh interface ip set dnsservers 8 static 8.8.8.8 register=primary validate=no
netsh interface ip add dnsservers 8 8.8.4.4 2 validate=no
NRPT::ActionCreate names=[.] dns_servers=[8.8.8.8,8.8.4.4]
ActionWFP openvpn_app_path=C:\Program Files\OpenVPN Connect\OpenVPNConnect.exe tap_index=8 enable=1
permit IPv4 DNS requests from OpenVPN app
permit IPv6 DNS requests from OpenVPN app
block IPv4 DNS requests from other apps
block IPv6 DNS requests from other apps
allow IPv4 traffic from TAP
allow IPv6 traffic from TAP
ipconfig /flushdns
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
TAP handle: c010000000000000
⏎11/14/2020, 7:16:48 PM Connected via TUN_WIN
⏎11/14/2020, 7:16:48 PM MTU mssfix=1420 crypto_encap=24 transport_encap=0
⏎11/14/2020, 7:16:48 PM EVENT: CONNECTED 105.205.197.128:1194 (105.205.197.128) via /UDPv4 on TUN_WIN/10.8.0.4/ gw=[10.8.0.1/]⏎11/14/2020, 7:17:13 PM SetupClient: signaling tun destroy event
⏎11/14/2020, 7:17:13 PM EVENT: DISCONNECTED ⏎
Server log:
https://pastebin.com/sZGAQEm5
Iptables:
# Generated by iptables-save v1.6.1 on Sat Nov 14 00:30:41 2020
*filter
:INPUT ACCEPT [578:108107]
:FORWARD ACCEPT [2:80]
:OUTPUT ACCEPT [2322:23006697]
-A INPUT -i enp35s0 -p udp -m udp --dport 1194 -j ACCEPT
-A INPUT -i tun0 -j ACCEPT
-A FORWARD -s 10.8.0.0/24 -i tun0 -o enp35s0 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
COMMIT
# Completed on Sat Nov 14 00:30:41 2020
# Generated by iptables-save v1.6.1 on Sat Nov 14 00:30:41 2020
*nat
:PREROUTING ACCEPT [67:8622]
:INPUT ACCEPT [10:4916]
:OUTPUT ACCEPT [57:5590]
:POSTROUTING ACCEPT [57:5590]
-A POSTROUTING -s 10.8.0.0/24 -o enp35s0 -j MASQUERADE
COMMIT
# Completed on Sat Nov 14 00:30:41 2020
Thanks!
