Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have defined an ubnound DNS server on my VPS and it appears to work. I need to use the DNS server instead of Public DNS IPs because some ISPs have blocked public DNS IPs. My openvpn.conf file is:

    dev tun
    proto tcp

    # Notice: here I set the listening port to be 80 to avoid possible port blockage
    port 80

    ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt
    cert /etc/openvpn/easy-rsa/2.0/keys/server.crt
    key /etc/openvpn/easy-rsa/2.0/keys/server.key
    dh /etc/openvpn/easy-rsa/2.0/keys/dh1024.pem

    user nobody
    group nogroup
    server 10.8.0.0 255.255.255.0

    persist-key
    persist-tun

    #status openvpn-status.log
    #verb 3
    client-to-client

    push "redirect-gateway def1"

    #pushing public DNS IPs

    push "dhcp-option DNS 208.67.222.222"
    push "dhcp-option DNS 208.67.222.220"

    comp-lzo

As it is suggested here, I tried to use my server's IPs (say 11.22.33.44). So instead of

    push "dhcp-option DNS 208.67.222.222"
    push "dhcp-option DNS 208.67.222.220"

I just put

push "dhcp-option DNS 11.22.33.44"

In openvpn.conf above. However, after restarting openvpn, I see that my client can still connect to the OpenVPN server but no pages can be rendered anymore.

What can be wrong here? How can I solve this problem?

share|improve this question
add comment

2 Answers

You say that the "it appears to work." How did you verify this? Are you basing it on the fact the server started without any errors or did you actually perform some queries against it?

First thing I would do is use nslookup or dig to connect to the unbound server and perform some queries. I know dig is more in fashion these days but I know nslookup better.


$ nslookup
> server 11.22.33.44
Default server: 11.22.33.44
Address: 11.22.33.44#53
> set type=A
> www.google.com
Server:     11.22.33.44
Address:    11.22.33.44#53

Non-authoritative answer:
www.google.com  canonical name = www.l.google.com.
Name:   www.l.google.com
Address: 74.125.225.52
Name:   www.l.google.com
Address: 74.125.225.48
Name:   www.l.google.com
Address: 74.125.225.49
Name:   www.l.google.com
Address: 74.125.225.50
Name:   www.l.google.com
Address: 74.125.225.51

If this does not work then you have to look back at the DNS configuration again.

Is this a primary DNS server or a caching DNS server? Are you trying to query local resources or internet resources? Does it work as expected if you do not push your DNS server to the client?

If you pass all your traffic through your OpenVPN server you should not need to worry about your ISP blocking public DNS servers anymore since as far as your ISP is concerned you are only generating traffic to your VPS; unless the VPS is behind the same ISP.

share|improve this answer
    
Well ubound could pass all the tests that you mentioned and some more so I'm pretty sure that it is not the problem. As for why I need to use my own DNS server, I have experienced that when I use public DNS as above, the clients in Iran (where millions of sites are blocked) can not get any page through their openvpn connection, despite the fact that they can connect to the openvpn server. Hence the effort. Thanks –  hbp Oct 5 '11 at 18:14
    
Have you confirmed that they can get a webpage via IP address once they are connected? This would just make sure it really is DNS problem and not a routing issue. Its very common when setting up OpenVPN to be able to connect to the server but not get any traffic back due to a missing return route. –  digitaladdictions Oct 5 '11 at 20:14
add comment

I had a similar issue where my own DNS server was not working correctly when routing all traffic through OpenVPN. The steps outlined in the following article resolved the issue for me:

http://forums.openvpn.net/topic7410.html

share|improve this answer
1  
Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference. –  Scott Pack Oct 21 '12 at 2:56
2  
Nice link you have there. Too bad its dead. –  Ishmael Aug 20 '13 at 14:09
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.