1

We're primarily an Ubuntu shop, but have recently configured an OpenVPN network to allow senior management to connect to our servers from their home PCs.

One of the problems we're seeing is a large increase in the number of DNS lookups coming down through the OpenVPN pipes into our DNS server for home web traffic that should be going to their ISP's DNS server and not forwarding through our private DNS server.

That traffic IS successfully stopped at the DNS server, but are there options in XP/Vista/Win7 that will allow us to restrict DNS lookup requests to certain domain names and not send those requests down the OpenVPN pipes?

Improve this question
0

3 Answers 3

Reset to default
1

but are there options in XP/Vista/Win7 that will allow us to restrict DNS lookup requests to certain domain names and not send those requests down the OpenVPN pipes?

I am going to go with "No".

Even with split tunneling, I don't think there is a way to make Windows pick and choose a DNS sever based on the asking domain name.

The only thing you could do is have a local DNS server that would do this for you. This local DNS server could be packaged and configured with the VPN client and would refer the client to the correct DNS server. It's possible that such a solution currently exists.

Honestly, I wonder, why do you care about a few extra dns requests?

Improve this answer
3
  • Thanks. Mostly as a privacy issue. Bunch of the managers freak out about confidentiality and privacy anyway, and the less personal stuff on the corporate network the better.
    – Magellan
    Dec 5, 2011 at 20:51
  • @AdrianK Tell them to stop looking at porn when connected remotely and reconnect when they're done.
    – MDMarra
    Dec 5, 2011 at 21:08
  • Ya know, I kinda LIKE my job and like the paycheck even better...
    – Magellan
    Dec 5, 2011 at 23:22
1

I'm going to go with user606723, surely he cant be making that many DNS requests that hes taxing your resources, unless its WHAT those reqests are for that you dont want in company logs, in any case, if your that worried about it you could set him up with his own DNS server in a VM and have that one only sync the records from your main server that you want. (internal lan I preseume) I do something similar on one of my servers because of a need to remap our internal LAN's IP addresses for remote clients.

EDIT: Also, depending on how technically savvy he is, you could just have him use IP addresses and not bother even setting up DNS for OpenVPN.

Improve this answer
1
  • Thanks. I was fiddling with this particular solution last night and my OpenVPN config last night.
    – Magellan
    Dec 7, 2011 at 21:35
0

You're looking for Split Tunneling - though I have no idea how to configure it on OpenVPN. It's fairly easy using Cisco gear, from whence I am familiar with it.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .