OpenVPN client doesn't create NRPT rule from "dhcp-option DOMAIN my.lan"

Business solution to host your own OpenVPN server with web management interface and bundled clients.
Post Reply
bavism
OpenVpn Newbie
Posts: 3
Joined: Tue Feb 11, 2020 2:20 am

OpenVPN client doesn't create NRPT rule from "dhcp-option DOMAIN my.lan"

Post by bavism » Tue Feb 11, 2020 3:01 am

Hi, I have my Access Server setup with a DNS Resolution Zone that looks something like "my.lan", which is the local suffix for the DNS provided by the router on the host network. This pushes a dhcp-option that I believe is supposed to setup an NRPT rule for split-dns on Windows clients. This works on one of my Windows 10 Home machines, where I can see the rule created (via PowerShell) after connecting, but not on another Window 10 Pro machine, where PowerShell and the group policy editor both confirm there are no additional NRPT rules. Any particular reason why this option wouldn't work on that machine? (Verified with both OpenVPN Connect and the OpenVPN GUI drivers).

User avatar
Pippin
Forum Team
Posts: 1201
Joined: Wed Jul 01, 2015 8:03 am
Location: irc://irc.libera.chat:6697/openvpn

Re: OpenVPN client doesn't create NRPT rule from "dhcp-option DOMAIN my.lan"

Post by Pippin » Tue Feb 11, 2020 2:54 pm

Is this Access Server or Community version?
I gloomily came to the ironic conclusion that if you take a highly intelligent person and give them the best possible, elite education, then you will most likely wind up with an academic who is completely impervious to reality.
Halton Arp

bavism
OpenVpn Newbie
Posts: 3
Joined: Tue Feb 11, 2020 2:20 am

Re: OpenVPN client doesn't create NRPT rule from "dhcp-option DOMAIN my.lan"

Post by bavism » Tue Feb 11, 2020 3:20 pm

This is Access Server 2.7.5 on the free license, running in Docker on an unRaid distro (SlackWare base).

bavism
OpenVpn Newbie
Posts: 3
Joined: Tue Feb 11, 2020 2:20 am

Re: OpenVPN client doesn't create NRPT rule from "dhcp-option DOMAIN my.lan"

Post by bavism » Wed Feb 12, 2020 3:45 am

I think I've discovered what's going on here. Process Monitor is suggesting that OpenVPN GUI (or OpenVPN Connect for Windows) are attempting to set the NRPT by writing to `HKLM\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient\DnsPolicyConfig`, but this key doesn't exist on my system (actually `DNSClient` doesn't even exist). When I add NRPT entries through powershell or the group policy editor, they get written to `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\dnscache`. I'm having a hard time figuring out what these 2 different registry trees are used for, but possibly this is older behaviour in the VPN client? Does anybody know what I can do to resolve this issue?

P.S. I'm not sure which sub-forum this post should be in... I guess it was moved to OpenVPN-Access Server since that's what I'm using as my server, but I believe this may be a client bug (which I couldn't find a forum for).

Post Reply