Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #198053 > unrolled thread

OpenVPN dhcp

Back to article view | Back to linux.debian.user

Contents

  OpenVPN dhcp Jim Popovitch <jim@k4vqc.com> - 2018-07-27 20:40 +0200
    Re: OpenVPN dhcp Roberto C. Sánchez <roberto@debian.org> - 2018-07-27 21:00 +0200
      Re: OpenVPN dhcp Jim Popovitch <jim@k4vqc.com> - 2018-07-28 18:50 +0200
        Re: OpenVPN dhcp Erwan David <erwan@rail.eu.org> - 2018-07-28 19:40 +0200
          Re: OpenVPN dhcp Jim Popovitch <jim@k4vqc.com> - 2018-07-28 20:10 +0200
            Re: OpenVPN dhcp Roberto C. Sánchez <roberto@debian.org> - 2018-07-28 22:00 +0200

#198053 — OpenVPN dhcp

Hello,

Is there a way to have an OpenVPN server push dhcp-options to the
clients that completely replace any existing entries in
/etc/resolv.conf?  

Using these OpenVPN settings on the server:

  push "dhcp-option DNS 10.8.0.1"
  push "dhcp-option DNS fd00:10:8::1"
  push "dhcp-option DOMAIN debian.org"

VPN'ed clients see this in /etc/resolv.conf

  # Dynamic resolv.conf(5) file for glibc resolver(3) generated by
    resolvconf(8)
  #     DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE
    OVERWRITTEN
  nameserver 10.8.0.1
  nameserver fd00:10:8::1
  nameserver 8.8.8.8
  search debian.org some-isp.tld

Note the ISP supplied "8.8.8.8" and "some-isp.tld" entries that remain
in /etc/resolv.conf after connecting to the VPN.

tia,

-Jim P.

[toc] | [next] | [standalone]

#198055

On Fri, Jul 27, 2018 at 02:38:37PM -0400, Jim Popovitch wrote:
> Hello,
> 
> Is there a way to have an OpenVPN server push dhcp-options to the
> clients that completely replace any existing entries in
> /etc/resolv.conf?  
> 
The short answer is, "as long as you use NetworkManager, no."

I no longer have the link, but some time ago I found a page that
explains it very clearly.

Search terms: "openvpn networkmanager dns leak"

Effectively, NetworkManager lacks a concept of "replace the active DNS
settings when this connection becomes active."  Instead, what it does is
add the DNS servers to those already listed.  There is supposed to be a
way to specify the IPv4 DNS servers (you can do this in the NM gui),
then you set the IPv4 DNS priority to -1 (meaning clear everything else
out and use these instead) by editing the text configuration file.

The problems with that, though, are the result of the -1 priority
appears to prevent any other connection from having IPv4 DNS servers in
resolv.conf.  That may or may not be a problem for you.  That approach
also prevents you from taking advantage of DHCP push of DNS servers from
the VPN server.

I have seen some bugs requesting that they fix it, and even a commit
that might be what you are asking for.  However, I don't know when it
might make its way into a Debian stable release (or even unstable).

Regards,

-Roberto

-- 
Roberto C. Sánchez

[toc] | [prev] | [next] | [standalone]

#198072

[Multipart message — attachments visible in raw view] — view raw

On Fri, 2018-07-27 at 14:52 -0400, Roberto C. Sánchez wrote:
> The short answer is, "as long as you use NetworkManager, no."
> 
> I no longer have the link, but some time ago I found a page that
> explains it very clearly.
> 
> Search terms: "openvpn networkmanager dns leak"
> 
> Effectively, NetworkManager lacks a concept of "replace the active
> DNS settings when this connection becomes active."  Instead, what it
> does is add the DNS servers to those already listed.  There is
> supposed to be a way to specify the IPv4 DNS servers (you can do this
> in the NM gui), then you set the IPv4 DNS priority to -1 (meaning
> clear everything else out and use these instead) by editing the text
> configuration file.
> 
> The problems with that, though, are the result of the -1 priority
> appears to prevent any other connection from having IPv4 DNS servers
> in resolv.conf.  That may or may not be a problem for you.  That
> approach also prevents you from taking advantage of DHCP push of DNS
> servers from the VPN server.
> 
> I have seen some bugs requesting that they fix it, and even a commit
> that might be what you are asking for.  However, I don't know when it
> might make its way into a Debian stable release (or even unstable).
> 

Roberto, thanks for the insight and recommendation, based on your
search suggestion I found the solution here:

https://bugs.launchpad.net/ubuntu/+source/openvpn/+bug/1211110/comments
/92

-Jim P.

[toc] | [prev] | [next] | [standalone]

#198073

[Multipart message — attachments visible in raw view] — view raw

Le 07/28/18 à 18:48, Jim Popovitch a écrit :
> On Fri, 2018-07-27 at 14:52 -0400, Roberto C. Sánchez wrote:
>> The short answer is, "as long as you use NetworkManager, no."
>>
>> I no longer have the link, but some time ago I found a page that
>> explains it very clearly.
>>
>> Search terms: "openvpn networkmanager dns leak"
>>
>> Effectively, NetworkManager lacks a concept of "replace the active
>> DNS settings when this connection becomes active."  Instead, what it
>> does is add the DNS servers to those already listed.  There is
>> supposed to be a way to specify the IPv4 DNS servers (you can do this
>> in the NM gui), then you set the IPv4 DNS priority to -1 (meaning
>> clear everything else out and use these instead) by editing the text
>> configuration file.
>>
>> The problems with that, though, are the result of the -1 priority
>> appears to prevent any other connection from having IPv4 DNS servers
>> in resolv.conf.  That may or may not be a problem for you.  That
>> approach also prevents you from taking advantage of DHCP push of DNS
>> servers from the VPN server.
>>
>> I have seen some bugs requesting that they fix it, and even a commit
>> that might be what you are asking for.  However, I don't know when it
>> might make its way into a Debian stable release (or even unstable).
>>
> Roberto, thanks for the insight and recommendation, based on your
> search suggestion I found the solution here:
>
> https://bugs.launchpad.net/ubuntu/+source/openvpn/+bug/1211110/comments
> /92
>
> -Jim P.
>
>
Does not seem to work for DNS pushed by the VPN server...

[toc] | [prev] | [next] | [standalone]

#198074

[Multipart message — attachments visible in raw view] — view raw

On Sat, 2018-07-28 at 19:31 +0200, Erwan David wrote:
> 
> 
> Does not seem to work for DNS pushed by the VPN server...
> 

A less pertinent bit was on another page that said you also need to add
the following lines to your client.ovpn before importing into
NetworkManager.

  script-security 2
  up /etc/openvpn/update-resolv-conf
  down /etc/openvpn/update-resolv-conf


So, delete your VPN profile, re-import the new client.ovpn, edit
/etc/NetworkManager/system-connections/<vpn_name>, run the nmcli
command, toggle VPN.

Apparently all of this is fixed in future versions of NetworkManager
scripts that just haven't made it downstream yet.  Heck, it took NM
something like 7 years to fix the flood of wifi events that hit
.xsession-errors and filled up /home partitions, so don't hold your
breath on this issue being resolved before Sid hits stable.

hth,

-Jim P.

[toc] | [prev] | [next] | [standalone]

#198076

On Sat, Jul 28, 2018 at 02:06:46PM -0400, Jim Popovitch wrote:
> 
> Heck, it took NM
> something like 7 years to fix the flood of wifi events that hit
> .xsession-errors and filled up /home partitions, so don't hold your
> breath on this issue being resolved before Sid hits stable.
> 
That is a comically roundabout away of saying "never" ;-)

Regards,

-Roberto

-- 
Roberto C. Sánchez

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web