0

I'm trying to create a split tunnel with OpenVPN community edition.

I want to do this on the server instead of the client so I can easily add and remove routes as needed. This is on Ubuntu 20.04

My current (non-split tunnel config) works fine:

port 1194
proto udp
dev tun
user nobody
group nogroup
persist-key
persist-tun
keepalive 10 120
topology subnet
server 10.8.0.0 255.255.0.0
ifconfig-pool-persist ipp.txt
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
push "redirect-gateway def1 bypass-dhcp"
dh none
ecdh-curve prime256v1
tls-crypt tls-crypt.key
crl-verify crl.pem
ca ca.crt
cert server_sdafasdf.crt
key server_sdafasdf.key
auth SHA256
cipher AES-128-GCM
ncp-ciphers AES-128-GCM
tls-server
tls-version-min 1.2
tls-cipher TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256
client-config-dir /etc/openvpn/ccd
status /var/log/openvpn/status.log
log-append /var/log/openvpn/auth.log
plugin /usr/lib/openvpn/openvpn-auth-ldap.so /etc/openvpn/auth-ldap.conf
verify-client-cert optional
verb 3

Here's my split tunnel config that doesn't work. EDIT: I can ping 8.8.8.8 but it seems like DNS doesn't work with this config.

port 1194
proto udp
dev tun
user nobody
group nogroup
persist-key
persist-tun
keepalive 10 120
topology subnet
server 10.8.0.0 255.255.0.0
ifconfig-pool-persist ipp.txt
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
#push "redirect-gateway def1 bypass-dhcp"
push "route XX.XX.XX.0 255.255.255.0" #anonymized
dh none
ecdh-curve prime256v1
tls-crypt tls-crypt.key
crl-verify crl.pem
ca ca.crt
cert server_sdafasdf.crt
key server_sdafasdf.key
auth SHA256
cipher AES-128-GCM
ncp-ciphers AES-128-GCM
tls-server
tls-version-min 1.2
tls-cipher TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256
client-config-dir /etc/openvpn/ccd
status /var/log/openvpn/status.log
log-append /var/log/openvpn/auth.log
plugin /usr/lib/openvpn/openvpn-auth-ldap.so /etc/openvpn/auth-ldap.conf
verify-client-cert optional
verb 3

Client config:

client
proto udp
explicit-exit-notify
remote XX.XX.XX.XX 1194 #anonymized
dev tun
resolv-retry infinite
pull
nobind
persist-key
persist-tun
remote-cert-tls server
verify-x509-name server_sdafasdf name
auth SHA256
auth-nocache
cipher AES-128-GCM
tls-client
tls-version-min 1.2
tls-cipher TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256
ignore-unknown-option block-outside-dns
setenv opt block-outside-dns # Prevent Windows 10 DNS leak
verb 3
register-dns
auth-user-pass
0

2 Answers 2

1

I solved this.

I needed to push the dns routes.

push "route 8.8.4.4 255.255.255.255"

This is because of

setenv opt block-outside-dns 

On Windows, block-outside-dns will do just that. So a route is required.

0

Your config varies insignificantly from mine and everything works correctly with heavy "route push" in my config both public and provate IPs. Could it be something else in your network topology/configuration (firewalls, routes etc) prevents you from accessing the routes you specify?

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .