0

background

Our client has a dev environment behind a firewall. They want us to be able to access resources in the dev environment, but don't want to grant us vpn access. Instead they have whitelisted an ip we control. On the machine at that ip address I've installed openVPN so that all our traffic to their dev machines will come from that one ip address. However, DNS is still failing, as their dev subdomain is not registered on nameserves outside the dev environment. So my plan is to have the VPN box also function as a DNS server.

Client has said we should CNAME from id.dev.client.com to id.client.edgekey.net to make DNS work. So I've installed bind9 on the same machine running openVPN and created the following files:

/etc/bind/named.conf.options

options {
        directory "/var/cache/bind";

        forwarders {
                185.121.177.177;
         };

        dnssec-validation auto;

        auth-nxdomain no;    # conform to RFC1035
        listen-on-v6 { any; };
};

/etc/bind/named.conf

include "/etc/bind/named.conf.options";
include "/etc/bind/named.conf.local";
include "/etc/bind/named.conf.default-zones";

/etc/bind/named.conf.local

zone "dev.client.com" {
  type master;
  file "/etc/bind/zones/dev.client.com";
};

/etc/bind/zones/dev.client.com

id.dev.client.com.     IN      SOA     my.dns.server.com.  admin.example.com.(
        2019041103
        28800
        3600
        604800
        38400
)

id.dev.client.com.      IN      CNAME   id.client.edgekey.net.

the problem

If I ssh into the vpn box and do an nslookup, specifying the box's own name as the nameserver, this appears to produce the desired result. nslookup id.dev.client.com my.dns.server.com produces the following:

Server:     my.dns.server.com
Address:    123.45.67.10#53

id.dev.client.com   canonical name = id.client.edgekey.net.
id.client.edgekey.net   canonical name = e5555.x.akamaiedge.net.
Name:   e5555.x.akamaiedge.net
Address: 55.55.55.55

However, if don't specify the nameserver and just run nslookup id.dev.client.com I get the result:

Server:     127.0.0.53
Address:    127.0.0.53#53

** server can't find id.dev.client.com: NXDOMAIN

and attempts to curl sites in the dev environment fail.

I've allowed incoming and outgoing traffic on port 53, and added the machine's own ip to the nameservers section of the netplan configuration, so it should be using itself for dns right?. What else do I need to do to make DNS function correctly on this machine?

migrated from stackoverflow.com Apr 23 at 17:08

This question came from our site for professional and enthusiast programmers.

  • "[They] don't want to grant us vpn access. Instead they have whitelisted an ip we control. On the machine at that ip address I've installed openVPN." These seem to conflict. Where is the VPN tunnel terminating? – Mark Wagner Apr 23 at 17:44
  • @MarkWagner the VPN tunnel terminates at the machine with the whitelisted IP. Really it's just functioning as a proxy so that traffic to the dev environment all appears to come from the whitelisted IP. – duggulous Apr 23 at 19:13
0

From what I can tell, all that is missing is that you need to push the DNS option down to the VPN clients with a PUSH option. This should be added to the server configuration:

push "dhcp-option DNS <local IP of the OpenVPN IP>"

The local IP can be found with ifconfig or similar - you are looking for the IP of the tun interface.

This will ensure that the DNS is being hosted by the correct server and that DNS is being called through the VPN.

  • As I understand it, that line tells the vpn clients to use the specified ip as their dns server while they are connected to the vpn. That's definitely part of the plan, but right now, I can't even resolve domains properly from the vpn host itself. I've manually added the machine's ip to the dns settings of both host and client machines, but neither is able to successfully resolve. – duggulous Apr 23 at 19:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.