I am using OpenVPN server (on an Ubuntu server 14.04) with Mac OS X Yosemite client (using TunnelBlick v 3.50 build 4265). It works well except for the DNS server from the VPN server which although it is being set on the client, it is only resolving the DNS queries for the local intranet and not being forwarded to the resolver for internet lookups. The same DNS server (bind) works fine in the local intranet and on the OpenVPN server.

Here is one dig output once the vpn is connected.

$ dig -x www.google.com

; <<>> DiG 9.8.3-P1 <<>> -x www.google.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 12157
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
;; WARNING: recursion requested but not available

;com.google.www.in-addr.arpa.   IN  PTR

;; Query time: 1884 msec
;; WHEN: Fri May  8 10:32:22 2015
;; MSG SIZE  rcvd: 45

Another solution, add recursion to net, by adding this line in /etc/bind/named.conf.options, as follow:

allow-recursion {; };

Solutions (from comments) add allow-recursion in the bind (which was changed from the default permissive settings around bind 9.4)

Possible solution:

  • Try using public DNS server like google famous
  • Push route of IP to VPN client by adding this line in your server.conf:

push "route"

Another alternative: add/allow dns recursion for VPN IP on bind config.

I hope it worked.

  • I am already using google forwarders (both 8.8 and 4.4) and pushing the following route: push "route"
    – eskhool
    May 8 '15 at 15:09
  • So the problem could be your DNS/Bind/Named setting. From your dig result it can be seen that your DNS server ( didn't resolve google.com domain correctly.
    – Juraganet
    May 9 '15 at 15:31
  • That's what I'd like to know. This same server resolves google.com without any trouble from the 10.0.0.x network but not on the 10.1.0.x VPN network.
    – eskhool
    May 10 '15 at 16:23
  • Have you added allow recursion from 10.1.0.x net?
    – Juraganet
    May 12 '15 at 0:23
  • Will try tonight and confirm ...though I think this must be it ...didn't know bind changed something (and if I'm not wrong this used to work a long time ago)...can you make this a part of answer
    – eskhool
    May 13 '15 at 10:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.