Arch Linux

egdceo

Member

Registered: 2020-04-20

Posts: 6

OpenVPN DNS issue

Hi!
I am trying to connect to a VPN but I *believe* that there's something wrong related to DNS. I believe this because I had the same issue when I was using Manjaro, and when I type in the IP-addresses that openvpn adds routes for I can connect to them. Does that make sense? I don't know this stuff.
I have installed networkmanager, networkmanager-openvpn and network-manager-applet.
I followed the steps (I believe) in https://wiki.archlinux.org/index.php/OpenVPN#DNS
in that I updated client.ovpn with

script-security 2
up /usr/share/openvpn/contrib/pull-resolv-conf/client.up
down /usr/share/openvpn/contrib/pull-resolv-conf/client.down

and made sure that both client.up and client.down was executable. I also tried moving them to

/etc/openvpn

and pointing up and down to there, but still no dice.

Running

sudo openvpn --config client.ovpn

gives

Tue Apr 28 20:54:34 2020 WARNING: file 'myname.key' is group or others accessible
Tue Apr 28 20:54:34 2020 OpenVPN 2.4.9 [git:makepkg/9b0dafca6c50b8bb+] x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Apr 20 2020
Tue Apr 28 20:54:34 2020 library versions: OpenSSL 1.1.1g  21 Apr 2020, LZO 2.10
Tue Apr 28 20:54:34 2020 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Tue Apr 28 20:54:34 2020 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Tue Apr 28 20:54:34 2020 PLUGIN_INIT: POST /usr/lib/openvpn/plugins/openvpn-plugin-down-root.so '[/usr/lib/openvpn/plugins/openvpn-plugin-down-root.so] [/usr/share/openvpn/contrib/pull-resolv-conf/client.down] [tun0]' intercepted=PLUGIN_UP|PLUGIN_DOWN
Enter Private Key Password: ********
Tue Apr 28 20:54:36 2020 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Tue Apr 28 20:54:36 2020 TCP/UDP: Preserving recently used remote address: [AF_INET]<ip:port>
Tue Apr 28 20:54:36 2020 Socket Buffers: R=[212992->212992] S=[212992->212992]
Tue Apr 28 20:54:36 2020 UDP link local: (not bound)
Tue Apr 28 20:54:36 2020 UDP link remote: [AF_INET]<ip:port>
Tue Apr 28 20:54:36 2020 TLS: Initial packet from [AF_INET]<ip:port>, sid=f765ff84 6b1f0010
Tue Apr 28 20:54:36 2020 VERIFY OK: depth=1, C=SE, ST=<cityname>, L=<cityname>, O=COMPANYNAME AB, OU=VPN-CA, CN=company-vpn, name=COMPANYNAME VPN, emailAddress=info@company.com
Tue Apr 28 20:54:36 2020 VERIFY OK: depth=0, C=SE, ST=<cityname>, L=<cityname>, O=COMPANYNAME AB, OU=VPN-Server, CN=vpnserver, name=VPN Server, emailAddress=info@company.com
Tue Apr 28 20:54:36 2020 Control Channel: TLSv1, cipher SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Tue Apr 28 20:54:36 2020 [vpnserver] Peer Connection Initiated with [AF_INET]217.115.62.50:1194
Tue Apr 28 20:54:37 2020 SENT CONTROL [vpnserver]: 'PUSH_REQUEST' (status=1)
Tue Apr 28 20:54:37 2020 PUSH: Received control message: 'PUSH_REPLY,dhcp-option DNS <ip>,route <ip> 255.255.0.0 <ip> 1,route <ip> 255.255.255.255 <ip> 1... and so on
Tue Apr 28 20:54:37 2020 OPTIONS IMPORT: timers and/or timeouts modified
Tue Apr 28 20:54:37 2020 OPTIONS IMPORT: --ifconfig/up options modified
Tue Apr 28 20:54:37 2020 OPTIONS IMPORT: route options modified
Tue Apr 28 20:54:37 2020 OPTIONS IMPORT: route-related options modified
Tue Apr 28 20:54:37 2020 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Tue Apr 28 20:54:37 2020 Outgoing Data Channel: Cipher 'BF-CBC' initialized with 128 bit key
Tue Apr 28 20:54:37 2020 WARNING: INSECURE cipher with block size less than 128 bit (64 bit).  This allows attacks like SWEET32.  Mitigate by using a --cipher with a larger block size (e.g. AES-256-CBC).
Tue Apr 28 20:54:37 2020 Outgoing Data Channel: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Apr 28 20:54:37 2020 Incoming Data Channel: Cipher 'BF-CBC' initialized with 128 bit key
Tue Apr 28 20:54:37 2020 WARNING: INSECURE cipher with block size less than 128 bit (64 bit).  This allows attacks like SWEET32.  Mitigate by using a --cipher with a larger block size (e.g. AES-256-CBC).
Tue Apr 28 20:54:37 2020 Incoming Data Channel: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Apr 28 20:54:37 2020 WARNING: cipher with small block size in use, reducing reneg-bytes to 64MB to mitigate SWEET32 attacks.
Tue Apr 28 20:54:37 2020 ROUTE_GATEWAY x.x.x.x/255.255.255.0 IFACE=enp6s0 HWADDR=04:92:26:59:ca:e0
Tue Apr 28 20:54:37 2020 TUN/TAP device tap0 opened
Tue Apr 28 20:54:37 2020 TUN/TAP TX queue length set to 100
Tue Apr 28 20:54:37 2020 /usr/bin/ip link set dev tap0 up mtu 1500
Tue Apr 28 20:54:37 2020 /usr/bin/ip addr add dev tap0 <ip>/23 broadcast <ip>
Tue Apr 28 20:54:37 2020 PLUGIN_CALL: POST /usr/lib/openvpn/plugins/openvpn-plugin-down-root.so/PLUGIN_UP status=0
Tue Apr 28 20:54:37 2020 /usr/share/openvpn/contrib/pull-resolv-conf/client.up tap0 1500 1573 <ip> 255.255.254.0 init
Tue Apr 28 20:54:37 2020 /usr/bin/ip route add x.x.x.x/16 metric 1 via x.x.x.x
Tue Apr 28 20:54:37 2020 /usr/bin/ip route add x.x.x.x/16 metric 1 via x.x.x.x
Tue Apr 28 20:54:37 2020 /usr/bin/ip route add x.x.x.x/16 metric 1 via x.x.x.x
Tue Apr 28 20:54:37 2020 /usr/bin/ip route add x.x.x.x/16 metric 1 via x.x.x.x
Tue Apr 28 20:54:37 2020 Initialization Sequence Completed

At this point, openvpn appears to be running but I can not open company websites. I have debugged this for many hours now, and any suggestions for what I could try would be greatly appreciated.

kalix

Member

Registered: 2020-03-06

Posts: 19

Re: OpenVPN DNS issue

Can you ping www.google.com?  Or can you communicate with other devices on the network?

egdceo

Member

Registered: 2020-04-20

Posts: 6

Re: OpenVPN DNS issue

Can you ping www.google.com?  Or can you communicate with other devices on the network?

I can ping google! It's just the company websites that don't work. I don't have a way to try to reach some other device at the moment, but I assume it should work if I can ping the IP of the websites?

Last edited by egdceo (2020-04-28 18:43:01)

ratcheer

Member

Registered: 2011-10-09

Posts: 924

Re: OpenVPN DNS issue

Does /etc/resolv.conf have your normal DNS, or the DNS of your VPN when the VPN is active?

egdceo

Member

Registered: 2020-04-20

Posts: 6

Re: OpenVPN DNS issue

Does /etc/resolv.conf have your normal DNS, or the DNS of your VPN when the VPN is active?

Not activated

# Generated by resolvconf
domain lan
nameserver <ipaddr1>

Activated by using nm-applet

# Generated by NetworkManager
search lan
nameserver <ipaddr2>
nameserver <ipaddr1>

activated with openvpn command

>sudo openvpn --config client.ovpn
>cat /etc/resolv.conf
# Generated by resolvconf
domain lan
nameserver <ipaddr1>

So it seems that running from nm-applet accomplishes more?
Thanks!

Last edited by egdceo (2020-04-28 20:57:33)