Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I currently have a debian server that is running an openvpn server. I also have a dns server (bind9) that I would like give allow access to by the connected openvpn clients, but I am unsure as of how to do this, I already known how to send dns options to the clients using

push "dhcp-option DNS x.x.x.x"

but I am just unsure how give the clients access to the dns server that is located on the same machine as the vpn server, so if anyone could point me in the right direction I would really appreciate it. Also in case this would have anything to do with adding rules to iptables, this is my current configuration for iptables

# Generated by iptables-save v1.4.14 on Thu Oct 18 22:05:33 2012
:PREROUTING ACCEPT [3831842:462225238]
:INPUT ACCEPT [3820049:461550908]
:OUTPUT ACCEPT [1885011:139487044]
:POSTROUTING ACCEPT [1883834:139415168]
# Completed on Thu Oct 18 22:05:33 2012
# Generated by iptables-save v1.4.14 on Thu Oct 18 22:05:33 2012
:INPUT ACCEPT [45799:10669929]
:OUTPUT ACCEPT [45747:10335026]
:fail2ban-apache - [0:0]
:fail2ban-apache-myadmin - [0:0]
:fail2ban-apache-noscript - [0:0]
:fail2ban-ssh - [0:0]
:fail2ban-ssh-ddos - [0:0]
:fail2ban-webserver-w00tw00t - [0:0]
-A INPUT -p tcp -m multiport --dports 80,443 -j fail2ban-apache-myadmin
-A INPUT -p tcp -m multiport --dports 80,443 -j fail2ban-webserver-w00tw00t
-A INPUT -p tcp -m multiport --dports 80,443 -j fail2ban-apache-noscript
-A INPUT -p tcp -m multiport --dports 80,443 -j fail2ban-apache
-A INPUT -p tcp -m multiport --dports 22 -j fail2ban-ssh-ddos
-A INPUT -p tcp -m multiport --dports 22 -j fail2ban-ssh
-A INPUT -i tun+ -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 3306 -j ACCEPT
-A FORWARD -i tun+ -j ACCEPT
-A fail2ban-apache -j RETURN
-A fail2ban-apache-myadmin -s -j DROP
-A fail2ban-apache-myadmin -s -j DROP
-A fail2ban-apache-myadmin -j RETURN
-A fail2ban-apache-noscript -j RETURN
-A fail2ban-ssh -s -j DROP
-A fail2ban-ssh -s -j DROP
-A fail2ban-ssh -s -j DROP
-A fail2ban-ssh -s -j DROP
-A fail2ban-ssh -j RETURN
-A fail2ban-ssh-ddos -j RETURN
-A fail2ban-webserver-w00tw00t -s -j DROP
-A fail2ban-webserver-w00tw00t -s -j DROP
-A fail2ban-webserver-w00tw00t -j RETURN
# Completed on Thu Oct 18 22:05:33 2012

also here is my openvpn server configuration

port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh1024.pem
ifconfig-pool-persist ipp.txt
keepalive 10 120
user nobody
group users
status /var/log/openvpn/openvpn-status.log
verb 3
push "redirect-gateway def1"
push "dhcp-option DNS"
push "dhcp-option DNS"
push "dhcp-option DNS"
share|improve this question
also ipv4 forwarding is enabled – lacrosse1991 Oct 19 '12 at 1:50
You hand out dhcp leases over VPN? How does that work? – tink Oct 19 '12 at 3:25
@tink I would be using bind as a master server to hand resolve names to vpn client ip's, so I could type in user1.vpn or something of the sort, and have that automatically point to a ip that is on the vpn, so for instance user1.vpn would point to – lacrosse1991 Oct 19 '12 at 3:33
up vote 0 down vote accepted

I just had to tell bind9 to list on an ip address that was part of the openvpn subnet

share|improve this answer
my main problem was getting the clients in the vpn to actually communicate with the dns server in the first place, and apparently I had just needed to configure bind9 to listen to a ip that was on the vpn's subnet ( was the ip that I had used), after which the clients were able to connect to it without any issues. pretty much answered my own question, just took some digging around to find out what was going on :) – lacrosse1991 Oct 26 '12 at 0:25

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.