'pull-filter ignore "block-outside-dns"' is being ignored

StrikeAgainst

I'm subscribed to the VPN provider Mullvad, which pushes the option

block-outside-dns

on connection. Since I have configured a local secondary DNS server which I want to resolve local domains of mine, I tried to work around this option with

pull-filter ignore "block-outside-dns"

so the connection to my DNS server won't be blocked by the interface. For some reason though this option seems to be ignored, on connection the log still shows up with the line "Blocking outside dns using service succeeded."

Does someone have an explanation for this and how to fix it?

My local machine runs Windows 10. I'm using OpenVPN 2.5.4-I604 amd64 via OpenVPN GUI v11.25.

My client config looks like this:

client
dev tun
proto udp

remote [remote-vpn-server] 1195

pull-filter ignore "block-outside-dns"

route 192.168.178.0 255.255.255.0 net_gateway
route 127.0.0.1 255.255.255.255 net_gateway

dhcp-option DNS 10.9.0.1
dhcp-option DNS 192.168.178.29
dhcp-option WINS 192.168.178.29
dhcp-option DOMAIN lan

...

TinCanTech

Set --verb 4 and post your client log.

StrikeAgainst

2021-11-05 18:11:30 DEPRECATED OPTION: --cipher set to 'AES-256-CBC' but missing in --data-ciphers (AES-256-GCM:AES-128-GCM). Future OpenVPN version will ignore --cipher for cipher negotiations. Add 'AES-256-CBC' to --data-ciphers or change --cipher 'AES-256-CBC' to --data-ciphers-fallback 'AES-256-CBC' to silence this warning.
2021-11-05 18:11:30 OpenVPN 2.5.4 Windows-MSVC [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on Oct 20 2021
2021-11-05 18:11:30 Windows version 10.0 (Windows 10 or greater) 64bit
2021-11-05 18:11:30 library versions: OpenSSL 1.1.1l  24 Aug 2021, LZO 2.10
2021-11-05 18:11:30 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
2021-11-05 18:11:30 Need hold release from management interface, waiting...
2021-11-05 18:11:31 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
2021-11-05 18:11:31 MANAGEMENT: CMD 'state on'
2021-11-05 18:11:31 MANAGEMENT: CMD 'log all on'
2021-11-05 18:11:31 MANAGEMENT: CMD 'echo all on'
2021-11-05 18:11:31 MANAGEMENT: CMD 'bytecount 5'
2021-11-05 18:11:31 MANAGEMENT: CMD 'hold off'
2021-11-05 18:11:31 MANAGEMENT: CMD 'hold release'
2021-11-05 18:11:31 MANAGEMENT: >STATE:1636132291,RESOLVE,,,,,,
2021-11-05 18:11:31 TCP/UDP: Preserving recently used remote address: [AF_INET]193.27.14.2:1195
2021-11-05 18:11:31 Socket Buffers: R=[65536->524288] S=[65536->524288]
2021-11-05 18:11:31 UDP link local: (not bound)
2021-11-05 18:11:31 UDP link remote: [AF_INET]193.27.14.2:1195
2021-11-05 18:11:31 MANAGEMENT: >STATE:1636132291,WAIT,,,,,,
2021-11-05 18:11:31 MANAGEMENT: >STATE:1636132291,AUTH,,,,,,
2021-11-05 18:11:31 TLS: Initial packet from [AF_INET]193.27.14.2:1195, sid=72628a10 d522d302
2021-11-05 18:11:31 VERIFY OK: depth=2, C=SE, ST=Gotaland, L=Gothenburg, O=Amagicom AB, OU=Mullvad, CN=Mullvad Root CA v2, emailAddress=security@mullvad.net
2021-11-05 18:11:31 VERIFY OK: depth=1, C=SE, ST=Gotaland, O=Amagicom AB, OU=Mullvad, CN=Mullvad Intermediate CA v3, emailAddress=security@mullvad.net
2021-11-05 18:11:31 VERIFY KU OK
2021-11-05 18:11:31 Validating certificate extended key usage
2021-11-05 18:11:31 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
2021-11-05 18:11:31 VERIFY EKU OK
2021-11-05 18:11:31 VERIFY OK: depth=0, C=SE, ST=Gotaland, O=Amagicom AB, OU=Mullvad, CN=de-fra-201.mullvad.net, emailAddress=security@mullvad.net
2021-11-05 18:11:31 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1557', remote='link-mtu 1558'
2021-11-05 18:11:31 WARNING: 'comp-lzo' is present in remote config but missing in local config, remote='comp-lzo'
2021-11-05 18:11:31 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_CHACHA20_POLY1305_SHA256, peer certificate: 4096 bit RSA, signature: RSA-SHA256
2021-11-05 18:11:31 [de-fra-201.mullvad.net] Peer Connection Initiated with [AF_INET]193.27.14.2:1195
2021-11-05 18:11:32 MANAGEMENT: >STATE:1636132292,GET_CONFIG,,,,,,
2021-11-05 18:11:32 SENT CONTROL [de-fra-201.mullvad.net]: 'PUSH_REQUEST' (status=1)
2021-11-05 18:11:33 PUSH: Received control message: 'PUSH_REPLY,dhcp-option DNS 10.9.0.1,redirect-gateway def1 bypass-dhcp,route-ipv6 0000::/2,route-ipv6 4000::/2,route-ipv6 8000::/2,route-ipv6 C000::/2,comp-lzo no,route-gateway 10.9.0.1,topology subnet,socket-flags TCP_NODELAY,ifconfig-ipv6 fdda:d0d0:cafe:1195::1012/64 fdda:d0d0:cafe:1195::,ifconfig 10.9.0.20 255.255.0.0,peer-id 16,cipher AES-256-GCM'
2021-11-05 18:11:33 OPTIONS IMPORT: compression parms modified
2021-11-05 18:11:33 OPTIONS IMPORT: --socket-flags option modified
2021-11-05 18:11:33 NOTE: setsockopt TCP_NODELAY=1 failed
2021-11-05 18:11:33 OPTIONS IMPORT: --ifconfig/up options modified
2021-11-05 18:11:33 OPTIONS IMPORT: route options modified
2021-11-05 18:11:33 OPTIONS IMPORT: route-related options modified
2021-11-05 18:11:33 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
2021-11-05 18:11:33 OPTIONS IMPORT: peer-id set
2021-11-05 18:11:33 OPTIONS IMPORT: adjusting link_mtu to 1624
2021-11-05 18:11:33 OPTIONS IMPORT: data channel crypto options modified
2021-11-05 18:11:33 Data Channel: using negotiated cipher 'AES-256-GCM'
2021-11-05 18:11:33 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
2021-11-05 18:11:33 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
2021-11-05 18:11:33 interactive service msg_channel=696
2021-11-05 18:11:33 GDG6: remote_host_ipv6=n/a
2021-11-05 18:11:33 NOTE: GetBestInterfaceEx returned error: Element nicht gefunden.   (code=1168)
2021-11-05 18:11:33 open_tun
2021-11-05 18:11:33 tap-windows6 device [LAN-Verbindung] opened
2021-11-05 18:11:33 TAP-Windows Driver Version 9.24 
2021-11-05 18:11:33 Set TAP-Windows TUN subnet mode network/local/netmask = 10.9.0.0/10.9.0.20/255.255.0.0 [SUCCEEDED]
2021-11-05 18:11:33 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.9.0.20/255.255.0.0 on interface {8E1D3DD6-E2B8-4D5B-B610-CF075506533E} [DHCP-serv: 10.9.255.254, lease-time: 31536000]
2021-11-05 18:11:33 Successful ARP Flush on interface [9] {8E1D3DD6-E2B8-4D5B-B610-CF075506533E}
2021-11-05 18:11:33 MANAGEMENT: >STATE:1636132293,ASSIGN_IP,,10.9.0.20,,,,,fdda:d0d0:cafe:1195::1012
2021-11-05 18:11:33 IPv4 MTU set to 1500 on interface 9 using service
2021-11-05 18:11:33 INET6 address service: add fdda:d0d0:cafe:1195::1012/128
2021-11-05 18:11:33 add_route_ipv6(fdda:d0d0:cafe:1195::/64 -> fdda:d0d0:cafe:1195::1012 metric 0) dev LAN-Verbindung
2021-11-05 18:11:33 IPv6 route addition via service succeeded
2021-11-05 18:11:33 IPv6 MTU set to 1500 on interface 9 using service
2021-11-05 18:11:33 Blocking outside dns using service succeeded.
2021-11-05 18:11:38 TEST ROUTES: 3/3 succeeded len=2 ret=1 a=0 u/d=up
2021-11-05 18:11:38 C:\WINDOWS\system32\route.exe ADD 193.27.14.2 MASK 255.255.255.255 192.168.178.1
2021-11-05 18:11:38 Route addition via service succeeded
2021-11-05 18:11:38 C:\WINDOWS\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.9.0.1
2021-11-05 18:11:38 Route addition via service succeeded
2021-11-05 18:11:38 C:\WINDOWS\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 10.9.0.1
2021-11-05 18:11:38 Route addition via service succeeded
2021-11-05 18:11:38 MANAGEMENT: >STATE:1636132298,ADD_ROUTES,,,,,,
2021-11-05 18:11:38 C:\WINDOWS\system32\route.exe ADD 192.168.178.0 MASK 255.255.255.0 192.168.178.1
2021-11-05 18:11:38 Route addition via service succeeded
2021-11-05 18:11:38 C:\WINDOWS\system32\route.exe ADD 127.0.0.1 MASK 255.255.255.255 192.168.178.1
2021-11-05 18:11:38 Route addition via service succeeded
2021-11-05 18:11:38 add_route_ipv6(::/2 -> fdda:d0d0:cafe:1195:: metric -1) dev LAN-Verbindung
2021-11-05 18:11:38 IPv6 route addition via service succeeded
2021-11-05 18:11:38 add_route_ipv6(4000::/2 -> fdda:d0d0:cafe:1195:: metric -1) dev LAN-Verbindung
2021-11-05 18:11:38 IPv6 route addition via service succeeded
2021-11-05 18:11:38 add_route_ipv6(8000::/2 -> fdda:d0d0:cafe:1195:: metric -1) dev LAN-Verbindung
2021-11-05 18:11:38 IPv6 route addition via service succeeded
2021-11-05 18:11:38 add_route_ipv6(c000::/2 -> fdda:d0d0:cafe:1195:: metric -1) dev LAN-Verbindung
2021-11-05 18:11:38 IPv6 route addition via service succeeded
2021-11-05 18:11:38 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
2021-11-05 18:11:38 Initialization Sequence Completed
2021-11-05 18:11:38 MANAGEMENT: >STATE:1636132298,CONNECTED,SUCCESS,10.9.0.20,193.27.14.2,1195,,,fdda:d0d0:cafe:1195::1012

TinCanTech

StrikeAgainst wrote 2021-11-05 18:11:32 SENT CONTROL [de-fra-201.mullvad.net]: 'PUSH_REQUEST' (status=1)
2021-11-05 18:11:33 PUSH: Received control message: 'PUSH_REPLY,dhcp-option DNS 10.9.0.1,redirect-gateway def1 bypass-dhcp,route-ipv6 0000::/2,route-ipv6 4000::/2,route-ipv6 8000::/2,route-ipv6 C000::/2,comp-lzo no,route-gateway 10.9.0.1,topology subnet,socket-flags TCP_NODELAY,ifconfig-ipv6 fdda:d0d0:cafe:1195::1012/64 fdda:d0d0:cafe:1195::,ifconfig 10.9.0.20 255.255.0.0,peer-id 16,cipher AES-256-GCM'

--block-outside-dns is not being pushed.

StrikeAgainst wrote 2021-11-05 18:11:33 Blocking outside dns using service succeeded.

???

StrikeAgainst wrote 2021-11-05 18:11:38 Initialization Sequence Completed

Maybe you have the wrong config ?

StrikeAgainst

Ohh well... I screwed up. I've been using a template by my provider and I didn't post the authentication part of the config here because I obviously didn't want to leak any sensitive data and I thought it would be irrelevant anyway. Turns out that the block-outside-dns option was tucked in there as well. Should have checked the config more diligently. My bad!

Anyway, it works now, so this issue is resolved 😃
Thank you still!