Page 1 of 1
OpenVPN client doesn't create NRPT rule from "dhcp-option DOMAIN my.lan"
Posted: Tue Feb 11, 2020 3:01 am
by bavism
Hi, I have my Access Server setup with a DNS Resolution Zone that looks something like "my.lan", which is the local suffix for the DNS provided by the router on the host network. This pushes a dhcp-option that I believe is supposed to setup an NRPT rule for split-dns on Windows clients. This works on one of my Windows 10 Home machines, where I can see the rule created (via PowerShell) after connecting, but not on another Window 10 Pro machine, where PowerShell and the group policy editor both confirm there are no additional NRPT rules. Any particular reason why this option wouldn't work on that machine? (Verified with both OpenVPN Connect and the OpenVPN GUI drivers).
Re: OpenVPN client doesn't create NRPT rule from "dhcp-option DOMAIN my.lan"
Posted: Tue Feb 11, 2020 2:54 pm
by Pippin
Is this Access Server or Community version?
Re: OpenVPN client doesn't create NRPT rule from "dhcp-option DOMAIN my.lan"
Posted: Tue Feb 11, 2020 3:20 pm
by bavism
This is Access Server 2.7.5 on the free license, running in Docker on an unRaid distro (SlackWare base).
Re: OpenVPN client doesn't create NRPT rule from "dhcp-option DOMAIN my.lan"
Posted: Wed Feb 12, 2020 3:45 am
by bavism
I think I've discovered what's going on here. Process Monitor is suggesting that OpenVPN GUI (or OpenVPN Connect for Windows) are attempting to set the NRPT by writing to `HKLM\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient\DnsPolicyConfig`, but this key doesn't exist on my system (actually `DNSClient` doesn't even exist). When I add NRPT entries through powershell or the group policy editor, they get written to `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\dnscache`. I'm having a hard time figuring out what these 2 different registry trees are used for, but possibly this is older behaviour in the VPN client? Does anybody know what I can do to resolve this issue?
P.S. I'm not sure which sub-forum this post should be in... I guess it was moved to OpenVPN-Access Server since that's what I'm using as my server, but I believe this may be a client bug (which I couldn't find a forum for).