0

I have recently set up an AWS VPN Client. I can successfully connect to the AWS VPC defined from my office, and through setting up the split-tunnel option, I can see that the default internet path is kept as per my office configuration, however, I cannot browser the internet. I have checked and ping works ok to external addresses, the problem lays with the DNS resolution.

I have tried setting public DNS such as 8.8.8.8 (correctly pushed to my office config as per what I can see in the ipconfig and routing) and have also tried to disable DNS config pushing altogether, but no matter what I try, the second I connect the vpn, dns resolution stops working altogether.

Anyone experience that? AWS VPN Client is OpenVPN, but I don't have access to backend and therefore can't really do much with server-side config other than what AWS interface provides.

My LAN adapter has the following config:

   Link-local IPv6 Address . . . . . : fe80::61dd:e38c:8f56:6914%33(Preferred)
   IPv4 Address. . . . . . . . . . . : 192.168.1.46(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 192.168.1.1
   DHCP Server . . . . . . . . . . . : 192.168.1.1
   DNS Servers . . . . . . . . . . . : 80.58.61.250
                                       80.58.61.254

My route table before connecting to vpn is:

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      192.168.1.1     192.168.1.46     35
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    331
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    331
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    331
      192.168.1.0    255.255.255.0         On-link      192.168.1.46    291
     192.168.1.46  255.255.255.255         On-link      192.168.1.46    291
    192.168.1.255  255.255.255.255         On-link      192.168.1.46    291
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    331
        224.0.0.0        240.0.0.0         On-link      192.168.1.46    291
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    331
  255.255.255.255  255.255.255.255         On-link      192.168.1.46    291
===========================================================================

After I connect the VPN, my vpn network config is:

Ethernet adapter Ethernet 4:
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : TAP-Windows Adapter V9 for OpenVPN Connect
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
   Link-local IPv6 Address . . . . . : fe80::9525:f089:27af:591c%11(Preferred)
   IPv4 Address. . . . . . . . . . . : 10.10.1.194(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.224
   Default Gateway . . . . . . . . . :
   DNS Servers . . . . . . . . . . . : 8.8.8.8
                                       205.251.192.0
   NetBIOS over Tcpip. . . . . . . . : Enabled

And my route table just adds the routes to the destination networks

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      192.168.1.1     192.168.1.46     35
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    331
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    331
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    331
        10.10.0.0      255.255.0.0      10.10.1.193      10.10.1.194    257
      10.10.1.192  255.255.255.224         On-link       10.10.1.194    257
      10.10.1.194  255.255.255.255         On-link       10.10.1.194    257
      10.10.1.223  255.255.255.255         On-link       10.10.1.194    257
        10.20.0.0      255.255.0.0      10.20.1.193      10.10.1.194    257
      192.168.1.0    255.255.255.0         On-link      192.168.1.46    291
     192.168.1.46  255.255.255.255         On-link      192.168.1.46    291
    192.168.1.255  255.255.255.255         On-link      192.168.1.46    291
  192.168.228.224  255.255.255.240         On-link   192.168.228.225   5256
  192.168.228.225  255.255.255.255         On-link   192.168.228.225   5256
  192.168.228.239  255.255.255.255         On-link   192.168.228.225   5256
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    331
        224.0.0.0        240.0.0.0         On-link      192.168.1.46    291
        224.0.0.0        240.0.0.0         On-link      172.17.1.194    257
        224.0.0.0        240.0.0.0         On-link   192.168.228.225   5256
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    331
  255.255.255.255  255.255.255.255         On-link      192.168.1.46    291
  255.255.255.255  255.255.255.255         On-link       10.10.1.194    257
  255.255.255.255  255.255.255.255         On-link   192.168.228.225   5256
===========================================================================

At this point, I can successfully connect to any 10.10.x or 10.20.x VM, but I lose access to internet. If I try ping 8.8.8.8, ping is successful:

c:\Temp>ping 8.8.8.8
Pinging 8.8.8.8 with 32 bytes of data:
Reply from 8.8.8.8: bytes=32 time=13ms TTL=54

But if I try to resolve, it doesn't work:

c:\Temp>ping google.com
Ping request could not find host google.com. Please check the name and try again.

Same with nslookup:

c:\Temp>nslookup google.com
DNS request timed out.
    timeout was 2 seconds.
Server:  UnKnown
Address:  8.8.8.8
DNS request timed out.
    timeout was 2 seconds.
DNS request timed out.
    timeout was 2 seconds.
DNS request timed out.
    timeout was 2 seconds.
DNS request timed out.
    timeout was 2 seconds.
*** Request to UnKnown timed-out

And tracert to 8.8.8.8 correctly shows that it's going to office gateway:

C:\Users\Me>tracert 8.8.8.8

Tracing route to 8.8.8.8 over a maximum of 30 hops

  1     3 ms     3 ms     3 ms  192.168.1.1
  2    73 ms     6 ms    34 ms  81.46.38.134
  3    11 ms    12 ms    11 ms  81.46.34.21
  4    41 ms    12 ms    11 ms  81.46.34.137
  5    11 ms    11 ms    13 ms  80.58.106.1
  6    11 ms    11 ms    12 ms  176.52.253.93
  7    54 ms    12 ms    12 ms  209.85.149.88
  8     *        *        *     Request timed out.
  9    29 ms    12 ms    11 ms  8.8.8.8

Trace complete.

Any help would be appreciated..

Thanks!

Nissy

2
  • Can you show the output of whatever commands you are running that you claim demonstrates that your routing is correctly set up? Sounds very much like your DNS queries are being routed to the AWS VPN which doesn't have an Internet Gateway configured. – Garreth McDaid Jan 13 '20 at 13:39
  • Added the troubleshooting information – Nissy A.W. Jan 15 '20 at 9:32
0

To me, it looks like you issue in in the VPN Subnet NACls in the AWS VPN you are using. When connected to VPN, all your traffic is flowing to the AWS subnet. ICMP traffic appears to be permitted, but specific application protocols like HTTP (80, 443) and DNS (53) appear to be blocked on either Ingress or Egress.

Have a look at the NACLs (Network Access Control Lists) in AWS to see what way they are set up.

Also, do a tracert to 8.8.8.8 and see what way that traffic is flowing. tracert will also use ICMP so it will give you some extra information.

4
  • Subnet NACls were set to all allowed for testing purposes, it is not blocking 80 nor 443 nor UDP or port 53. Tracert shows gateway to be the internal office gateway, not AWS. Still, no internet, with DNS errors. Once the VPN is up you maintain ping to external ip addresses correctly split, but no DNS resolution. Added the tracing in the main thread – Nissy A.W. Jan 22 '20 at 11:07
  • Something is blocking UDP/TCP 53. Does HTTP work without DNS (ie access a http server using its ip address)? – Garreth McDaid Jan 22 '20 at 11:39
  • I have tried by setting up hosts file resolution and the websites listed in there work ok with the VPN up and running. Not clear on why only resolution fails, shouldn't it go through default gateway? – Nissy A.W. Jan 22 '20 at 11:54
  • Sounds like the VPN client is interfering in your client DNS function. – Garreth McDaid Jan 22 '20 at 12:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.