Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We're primarily an Ubuntu shop, but have recently configured an OpenVPN network to allow senior management to connect to our servers from their home PCs.

One of the problems we're seeing is a large increase in the number of DNS lookups coming down through the OpenVPN pipes into our DNS server for home web traffic that should be going to their ISP's DNS server and not forwarding through our private DNS server.

That traffic IS successfully stopped at the DNS server, but are there options in XP/Vista/Win7 that will allow us to restrict DNS lookup requests to certain domain names and not send those requests down the OpenVPN pipes?

share|improve this question
    
Thanks guys. Much appreciated. –  Magellan Dec 5 '11 at 20:54
add comment

3 Answers

up vote 1 down vote accepted

but are there options in XP/Vista/Win7 that will allow us to restrict DNS lookup requests to certain domain names and not send those requests down the OpenVPN pipes?

I am going to go with "No".

Even with split tunneling, I don't think there is a way to make Windows pick and choose a DNS sever based on the asking domain name.

The only thing you could do is have a local DNS server that would do this for you. This local DNS server could be packaged and configured with the VPN client and would refer the client to the correct DNS server. It's possible that such a solution currently exists.

Honestly, I wonder, why do you care about a few extra dns requests?

share|improve this answer
    
Thanks. Mostly as a privacy issue. Bunch of the managers freak out about confidentiality and privacy anyway, and the less personal stuff on the corporate network the better. –  Magellan Dec 5 '11 at 20:51
    
@AdrianK Tell them to stop looking at porn when connected remotely and reconnect when they're done. –  MDMarra Dec 5 '11 at 21:08
    
Ya know, I kinda LIKE my job and like the paycheck even better... –  Magellan Dec 5 '11 at 23:22
add comment

I'm going to go with user606723, surely he cant be making that many DNS requests that hes taxing your resources, unless its WHAT those reqests are for that you dont want in company logs, in any case, if your that worried about it you could set him up with his own DNS server in a VM and have that one only sync the records from your main server that you want. (internal lan I preseume) I do something similar on one of my servers because of a need to remap our internal LAN's IP addresses for remote clients.

EDIT: Also, depending on how technically savvy he is, you could just have him use IP addresses and not bother even setting up DNS for OpenVPN.

share|improve this answer
    
Thanks. I was fiddling with this particular solution last night and my OpenVPN config last night. –  Magellan Dec 7 '11 at 21:35
add comment

You're looking for Split Tunneling - though I have no idea how to configure it on OpenVPN. It's fairly easy using Cisco gear, from whence I am familiar with it.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.