Goal: be able to route all the trafic through the OpenVPN server and being able to communicate with the remote DNS ( and the remote LAN (12x.x.x.x)

I have added to the OpenVPN client config file redirect-gateway def1.

As decribed here, I have added the three rules to iptables (in case the post is deleted):

iptables -I FORWARD -i tun0 -o eth0 \
     -s -m conntrack --ctstate NEW -j ACCEPT

iptables -I FORWARD -m conntrack --ctstate RELATED,ESTABLISHED \
     -j ACCEPT

iptables -t nat -I POSTROUTING -o eth0 \
      -s -j MASQUERADE

Which works great except that I cannot resolve hosts on my private DNS. I might be due to the first FORWARD rule which forward all trafic from tun0 to eth0.

How can I do so the trafic to the remote DNS and LAN does not go away?

  • If you're going to change IP addresses, then just replce the first byte with 10. 127/8 is the loopback network and won't get routed. The first rule doesn't do the forwarding, it allows the forwarding; subtle difference. – wurtel May 9 '19 at 6:43
  • I missed your comment. Thanks for the clarification on routing. I don't understand the byte change. Could you explain? – Kaymaz Jun 8 '19 at 17:39
  • You've hidden the real IP address of your DNS server and used 127.*.*.* (otherwise known as 127/8) is NOT routed out of your system. So if you want to hide the real IP address, replace the first number a.k.a. byte with 10 (and not 127), so that it still makes some sense. – wurtel Jun 11 '19 at 11:46

It seems you are not using the remote dns server. You can use openvpn to set the dns server too. Then the name resolution for your private network should work.

 push "dhcp-option DNS"

See here: https://openvpn.net/community-resources/pushing-dhcp-options-to-clients/

  • I am already pushing dns, sorry, it's not explicit in my post. – Kaymaz May 9 '19 at 7:04
  • @Kaymaz, does it also get set in client interface? You can check it with ipconfig. You may also try adding domain name too push dhcp-option DOMAIN example.local. Apart from that, what client are you using? – Diamond May 9 '19 at 7:11
  • I'm pushing DNS through the client config. I'm using OpenVPN GUI for Windows. – Kaymaz May 9 '19 at 7:13
  • @Kaymaz, first thing to check would be to see if it gets assigned correctly. Can you see it using ipconfig? – Diamond May 9 '19 at 10:52
  • Yes I do. In fact the configuration client/server works well (DNS access, remote LAN, internet access). I lose DNS and remote LAN access only when I send all my internet traffic through OpenVPN – Kaymaz May 9 '19 at 12:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.