1

I am using OpenVPN server (on an Ubuntu server 14.04) with Mac OS X Yosemite client (using TunnelBlick v 3.50 build 4265). It works well except for the DNS server from the VPN server which although it is being set on the client, it is only resolving the DNS queries for the local intranet and not being forwarded to the resolver for internet lookups. The same DNS server (bind) works fine in the local intranet and on the OpenVPN server.

Here is one dig output once the vpn is connected.

$ dig -x www.google.com

; <<>> DiG 9.8.3-P1 <<>> -x www.google.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 12157
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
;; WARNING: recursion requested but not available

;; QUESTION SECTION:
;com.google.www.in-addr.arpa.   IN  PTR

;; Query time: 1884 msec
;; SERVER: 10.0.0.9#53(10.0.0.9)
;; WHEN: Fri May  8 10:32:22 2015
;; MSG SIZE  rcvd: 45
1

Another solution, add recursion to 10.1.0.0/24 net, by adding this line in /etc/bind/named.conf.options, as follow:

allow-recursion { 10.1.0.0/24; };
| improve this answer | |
0

Solutions (from comments) add allow-recursion in the bind (which was changed from the default permissive settings around bind 9.4)

Possible solution:

  • Try using public DNS server like google famous 8.8.8.8/8.8.4.4.
  • Push route of 10.0.0.9 IP to VPN client by adding this line in your server.conf:

push "route 10.0.0.9 255.255.255.255"

Another alternative: add/allow dns recursion for VPN IP on bind config.

I hope it worked.

| improve this answer | |
  • I am already using google forwarders (both 8.8 and 4.4) and pushing the following route: push "route 10.0.0.0 255.255.255.0" – eskhool May 8 '15 at 15:09
  • So the problem could be your DNS/Bind/Named setting. From your dig result it can be seen that your DNS server (10.0.0.9) didn't resolve google.com domain correctly. – Juraganet May 9 '15 at 15:31
  • That's what I'd like to know. This same server resolves google.com without any trouble from the 10.0.0.x network but not on the 10.1.0.x VPN network. – eskhool May 10 '15 at 16:23
  • Have you added allow recursion from 10.1.0.x net? – Juraganet May 12 '15 at 0:23
  • Will try tonight and confirm ...though I think this must be it ...didn't know bind changed something (and if I'm not wrong this used to work a long time ago)...can you make this a part of answer – eskhool May 13 '15 at 10:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.