I have an OpenVPN server set up and working on an AWS Debian instance. It works as it should but I want to push DNS queries to Linux clients from BIND 9 which is on the same server as OpenVPN. All seems to look good when I connect to the server. I have the appropriate lines in the client.opvn file e.g.:

script-security 2
up /etc/openvpn/update-resolv-conf
down /etc/openvpn/update-resolv-conf

When I check resolve.conf on the client machine machine the DNS server address is what I think it should be. E.g. to the IP address of tun0 on the OpenVPN server

The DNS lookup works on the server when using this address. But on the client machine it will not.

My named.conf.options file looks like this:

acl goodclients {;;;

options {
        directory "/var/cache/bind";

        recursion yes;
        allow-query { goodclients; };

        forwarders {
        forward only;

        dnssec-validation auto;

        auth-nxdomain no;    # conform to RFC1035
        listen-on-v6 { any; };

My OpenVPN server.conf is as follows:

port 1194
proto udp
dev tun

keepalive 10 120

user nobody
group nogroup

chroot /etc/openvpn/easy-rsa/keys/crl.jail
crl-verify crl.pem

ca /etc/openvpn/easy-rsa/keys/ca.crt
dh /etc/openvpn/easy-rsa/keys/dh1024.pem
tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0
key /etc/openvpn/easy-rsa/keys/server.key
cert /etc/openvpn/easy-rsa/keys/server.crt

ifconfig-pool-persist /var/lib/openvpn/server.ipp
client-config-dir /etc/openvpn/server.ccd
status /var/log/openvpn/server.log
verb 4

# virtual subnet unique for openvpn to draw client addresses from
# the server will be configured with x.x.x.1
# important: must not be used on your network

# configure clients to route all their traffic through the vpn
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS"
#push "redirect-gateway def1"

log-append  openvpn.log
verb 5

So on the server I can issue this command with success:

dig @ google.com

; <<>> DiG 9.8.4-rpz2+rl005.12-P1 <<>> @ google.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 35943
;; flags: qr rd ra; QUERY: 1, ANSWER: 11, AUTHORITY: 0, ADDITIONAL: 0

;google.com.            IN  A

google.com.     251 IN  A
google.com.     251 IN  A
google.com.     251 IN  A
google.com.     251 IN  A
google.com.     251 IN  A
google.com.     251 IN  A
google.com.     251 IN  A
google.com.     251 IN  A
google.com.     251 IN  A
google.com.     251 IN  A
google.com.     251 IN  A

;; Query time: 130 msec
;; WHEN: Fri Nov  7 00:50:59 2014
;; MSG SIZE  rcvd: 204

But on the client machine it will not work when connected to the VPN server.

Can anyone tell me where I am stumbling here, and what am I missing?

  • I forgot to mention, I can ping on the client machine without any issues. – user346310 Nov 7 '14 at 1:19
  • Can you include the dig output from a client where it does not work? – Håkan Lindqvist Nov 7 '14 at 6:35
  • When I do "dig @ Google.com" I get a time out on the client. When I do "dig Google.com" I get the following output. pastebin.com/cdY4TWqw – user346310 Nov 7 '14 at 9:23
  • Routing table from ec2 can be found here pastebin.com/VkMMUDjM and rooting table from client when connected to vpn can be found here pastebin.com/Ej7tBqgy – user346310 Nov 7 '14 at 10:11
  • Make sure your bind server is listening on the tunnel interface (should be tun0 in your case). – Marco Nov 25 '14 at 11:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.