Hi, I am setting up a new OpenVPN server and encountered problems pushing DNS configurations to the Windows client (OpenVPN GUI). The network is up, NAT is good. The server is trying to push DNS 8.8.8.8 to the client.
However, the client would still use its previous DNS advertised by physical network. No DNS server record is registered on the VPN interface of the client. Doing "nslookup google.com" would show querying through the client's physical DNS and eventually times out (yep, both google.com and 8.8.8.8 are blocked at the client's physical network). Doing "nslookup google.com 8.8.8.8" shows desired outcome, querying through the given DNS server and the response comes through the VPN network.
The interesting thing is, from the client's log, there is indeed DNS information and DNS configuration attempt.
Tue Feb 22 11:23:28 2022 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,route 8.8.8.8 255.255.255.255 vpn_gateway,dhcp-option DNS 8.8.8.8,route-gateway 10.123.1.1,topology subnet,ping 20,ping-restart 60,ifconfig 10.123.1.2 255.255.255.0,peer-id 0,cipher AES-256-CBC'
Tue Feb 22 11:23:28 2022 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.123.1.2/255.255.255.0 on interface {F1EA0788-D7E6-45A1-8B88-45188D62350C} [DHCP-serv: 10.123.1.0, lease-time: 31536000]
Tue Feb 22 11:23:28 2022 DHCP option string: 06080808 08080808 0808
I tried to search for possible cause, and find some posts about DNS issues, yet it seems that none is appliable here.
https://forums.openvpn.net/viewtopic.php?t=27817
https://forums.openvpn.net/viewtopic.php?t=32904
https://forums.openvpn.net/viewtopic.php?t=28008
More initialization log:
Tue Feb 22 11:23:28 2022 [vpn-server] Peer Connection Initiated with [AF_INET]<server's IP address>:1234
Tue Feb 22 11:23:28 2022 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,route 8.8.8.8 255.255.255.255 vpn_gateway,dhcp-option DNS 8.8.8.8,route-gateway 10.123.1.1,topology subnet,ping 20,ping-restart 60,ifconfig 10.123.1.2 255.255.255.0,peer-id 0,cipher AES-256-CBC'
Tue Feb 22 11:23:28 2022 OPTIONS IMPORT: timers and/or timeouts modified
Tue Feb 22 11:23:28 2022 OPTIONS IMPORT: --ifconfig/up options modified
Tue Feb 22 11:23:28 2022 OPTIONS IMPORT: route options modified
Tue Feb 22 11:23:28 2022 OPTIONS IMPORT: route-related options modified
Tue Feb 22 11:23:28 2022 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Tue Feb 22 11:23:28 2022 OPTIONS IMPORT: peer-id set
Tue Feb 22 11:23:28 2022 OPTIONS IMPORT: adjusting link_mtu to 1625
Tue Feb 22 11:23:28 2022 OPTIONS IMPORT: data channel crypto options modified
Tue Feb 22 11:23:28 2022 Data Channel: using negotiated cipher 'AES-256-CBC'
Tue Feb 22 11:23:28 2022 Data Channel MTU parms [ L:1605 D:1450 EF:105 EB:406 ET:0 EL:3 ]
Tue Feb 22 11:23:28 2022 Outgoing Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
Tue Feb 22 11:23:28 2022 Outgoing Data Channel: Using 512 bit message hash 'SHA512' for HMAC authentication
Tue Feb 22 11:23:28 2022 Incoming Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
Tue Feb 22 11:23:28 2022 Incoming Data Channel: Using 512 bit message hash 'SHA512' for HMAC authentication
Tue Feb 22 11:23:28 2022 interactive service msg_channel=784
Tue Feb 22 11:23:28 2022 open_tun
Tue Feb 22 11:23:28 2022 tap-windows6 device [OpenVPN TAP-Windows6] opened
Tue Feb 22 11:23:28 2022 TAP-Windows Driver Version 9.24
Tue Feb 22 11:23:28 2022 TAP-Windows MTU=1500
Tue Feb 22 11:23:28 2022 Set TAP-Windows TUN subnet mode network/local/netmask = 10.123.1.0/10.123.1.2/255.255.255.0 [SUCCEEDED]
Tue Feb 22 11:23:28 2022 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.123.1.2/255.255.255.0 on interface {F1EA0788-D7E6-45A1-8B88-45188D62350C} [DHCP-serv: 10.123.1.0, lease-time: 31536000]
Tue Feb 22 11:23:28 2022 DHCP option string: 06080808 08080808 0808
Tue Feb 22 11:23:28 2022 Successful ARP Flush on interface [110] {F1EA0788-D7E6-45A1-8B88-45188D62350C}
Tue Feb 22 11:23:28 2022 do_ifconfig, ipv4=1, ipv6=0
Tue Feb 22 11:23:28 2022 MANAGEMENT: >STATE:1645500208,ASSIGN_IP,,10.123.1.2,,,,
Tue Feb 22 11:23:28 2022 IPv4 MTU set to 1500 on interface 110 using service
Tue Feb 22 11:23:33 2022 TEST ROUTES: 3/3 succeeded len=2 ret=1 a=0 u/d=up
Tue Feb 22 11:23:33 2022 C:\WINDOWS\system32\route.exe ADD <server's IP address> MASK 255.255.255.255 10.112.0.1
Tue Feb 22 11:23:33 2022 Route addition via service succeeded
Tue Feb 22 11:23:33 2022 C:\WINDOWS\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.123.1.1
Tue Feb 22 11:23:33 2022 Route addition via service succeeded
Tue Feb 22 11:23:33 2022 C:\WINDOWS\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 10.123.1.1
Tue Feb 22 11:23:33 2022 Route addition via service succeeded
Tue Feb 22 11:23:33 2022 MANAGEMENT: >STATE:1645500213,ADD_ROUTES,,,,,,
Tue Feb 22 11:23:33 2022 C:\WINDOWS\system32\route.exe ADD <server's IP address> MASK 255.255.255.255 10.112.0.1
Tue Feb 22 11:23:33 2022 Route addition via service succeeded
Tue Feb 22 11:23:33 2022 C:\WINDOWS\system32\route.exe ADD 8.8.8.8 MASK 255.255.255.255 10.123.1.1
Tue Feb 22 11:23:33 2022 Route addition via service succeeded
Tue Feb 22 11:23:33 2022 Initialization Sequence Completed
server: OpenVPN 2.5.5 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Dec 15 2021 / OpenVPN Repo / Ubuntu 20.04 LTS
client: OpenVPN GUI v11.26.0.0 / OpenVPN Community Download / Windows 11
Server Configuration:
# OpenVPN Port, Protocol, and the Tun
port 1234
proto udp
proto udp6
dev tun
topology subnet
user nobody
group nogroup
# OpenVPN Server Certificate - CA, server key and certificate
ca /etc/openvpn/server/ca.crt
cert /etc/openvpn/server/vpn-server.crt
key /etc/openvpn/server/vpn-server.key
#DH and CRL key
dh /etc/openvpn/server/dh.pem
crl-verify /etc/openvpn/server/crl.pem
# Network Configuration - Internal network
# Redirect all Connection through OpenVPN Server
server 10.123.1.0 255.255.255.0
ifconfig-pool-persist ipp.txt
#ifconfig 10.123.1.1 10.123.1.6
push "redirect-gateway def1"
push "route 8.8.8.8 255.255.255.255 vpn_gateway"
push "dhcp-option DNS 8.8.8.8"
# Using the DNS from
https://dns.watch
#push "dhcp-option DNS 84.200.69.80"
#push "dhcp-option DNS 84.200.70.40"
#Enable multiple clients to connect with the same certificate key
duplicate-cn
# TLS Security
data-ciphers AES-256-CBC
tls-version-min 1.2
tls-cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384:TLS-DHE-RSA-WITH-AES-256-CBC-SHA256:TLS-DHE-RSA-WITH-AES-128-GCM-SHA256:TLS-DHE-RSA-WITH-AES-128-CBC-SHA256
auth SHA512
auth-nocache
# Other Configuration
keepalive 20 60
persist-key
persist-tun
compress lz4
daemon
user nobody
group nogroup
# OpenVPN Log
log-append /var/log/openvpn.log
verb 3
Client configuration:
client
dev tun
proto udp
remote <server's IP address> 1234
resolv-retry infinite
nobind
persist-key
persist-tun
ca "C:\\program files\\OpenVPN\\config\\vpn\\ca.crt"
cert "C:\\program files\\OpenVPN\\config\\vpn\\client01.crt"
key "C:\\program files\\OpenVPN\\config\\vpn\\client01.key"
data-ciphers AES-256-CBC
auth SHA512
auth-nocache
tls-version-min 1.2
tls-cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384:TLS-DHE-RSA-WITH-AES-256-CBC-SHA256:TLS-DHE-RSA-WITH-AES-128-GCM-SHA256:TLS-DHE-RSA-WITH-AES-128-CBC-SHA256
keepalive 3 20
verb 4
mute 20
compress lz4
dhcp-option DNS 8.8.8.8 # even forced DNS at the client's side, still not working
route <server's IP address> 255.255.255.255 net_gateway
