0

So to the best of my understanding, I have all the pieces, namely, DNSmasq and OpenVPN working fine, although independently. What I've done?

  • Installed OpenVPN using this: https://github.com/Nyr/openvpn-install
    • After install, I'm able to connect client (PC, phone), works. No issue.
  • I've installed DNSmasq and also appears to be running and working as expected
    • I've blocked one or two sites i.e pointed them to 0.0.0.0 in the /etc/hosts file, and when I do nslookup thatdomain.com, I get the 0.0.0.0 response

This is currently my /etc/openvpn/server/server.conf

local 134.122.60.252
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh.pem
auth SHA512
tls-crypt tc.key
topology subnet
server 10.8.0.0 255.255.255.0
push "redirect-gateway def1 bypass-dhcp"
ifconfig-pool-persist ipp.txt
push "dhcp-option DNS 10.8.0.1"
keepalive 10 120
cipher AES-256-CBC
user nobody
group nogroup
persist-key
persist-tun
verb 3
crl-verify crl.pem
explicit-exit-notify
duplicate-cn

And the only change I've made to the default /etc/dnsmasq.conf file is uncommenting and indicating the interface this line:

interface=tun0

Where I need help?

How to make OpenVPN use DNSmasq for all DNS requests. I just can't seem to find a definite answer on how to achieve that, which of the files to change, and what to add.

Am I missing any steps?

Edit: With the above conf, when I ssh into the openvpn server (the dnsmasq runs also on same server), and I do

nslookup google.com 10.8.0.1, it resolve correctly

When I do nslookup blockthis.com 10.8.0.1 it resolves correct to 0.0.0.0 as expected, as per outlined in the /etc/hosts file.

Problem is, when I connect from client to the openvpn, somehow the openvpn isn't handing over the dns resolution to dnsmasq, yet the line interface=tun0 is enabled in the dnsmasq, and a netstat -plunt indicates port 53 is up and running, listened by dnsmasq.

8
  • 1
    What are 94.140.14.14 and 94.140.15.15? If you are running dnsmasq on the same host as the openvpn server, you should probably use push "dhcp-option DNS 10.8.0.1" instead. (It does not guarantee that all the clients can / will only use it as the DNS server though, for that you probably need some port-based traffic redirection.)
    – Tom Yan
    Sep 12 at 5:44
  • The 94.140.14.14 is DNS IP address for AdGuard. Yes, I'm running Dnsmasq on the same host with the OpenVPN server. They both on a single VPS.
    – KhoPhi
    Sep 12 at 8:12
  • You should configure dnsmasq to use them as its upstream servers.
    – Tom Yan
    Sep 12 at 9:04
  • @TomYan I think I have already. When I run sudo service dnsmasq status, I get one of the lines saying, using nameserver 94.140.14.14. Yet when I connect to the VPN, no request works, and DNS resolution doesn't work
    – KhoPhi
    Sep 12 at 10:09
  • Then update your question, with the current configuration
    – djdomi
    Sep 12 at 12:28
0

Okay, got it resolved. Needed to open Firewall.

ufw allow out on tun0

ufw allow in on tun0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.