Error in add block dns filters openvpn

OpenVPN Support Forum

Community Support Forum

[SOLVED] DNS resolution fails with «block-ouside-dns» on Windows client

[SOLVED] DNS resolution fails with «block-ouside-dns» on Windows client

Post by sebelk » Sun Mar 29, 2020 9:16 pm

My problem is that Linux clients work but Windows 10 Pro ones don’t.

My server configuration is:

For client that I’m testing I have /etc/openvpn/ccd/oneclient with this content:

The problem is dns resolution does not work, however I can ping beyond of tunnel, If I comment block-outside-tunnel, however, everything works fine.

I’ve read a lot of posts about such as viewtopic.php?t=25827 , I’ve tried even disabling smart multi-homed name resolution and windows firewall, didn’t work either. by the way in Windows using OpenVPN GUI 11.14.0.0

Any idea? Is a openvpn misconfiguration?

Thanks in advance!

Re: DNS resolution fails with «block-ouside-dns» on Windows client

Post by Pippin » Sun Mar 29, 2020 9:25 pm

Re: DNS resolution fails with «block-ouside-dns» on Windows client

Post by TinCanTech » Sun Mar 29, 2020 9:26 pm

Re: DNS resolution fails with «block-ouside-dns» on Windows client

Post by Pippin » Sun Mar 29, 2020 9:27 pm

I will move myself to Doh!

Edit:
No wait, it’s possible those Linux clients do not set DNS.

Re: DNS resolution fails with «block-ouside-dns» on Windows client

Post by sebelk » Sun Mar 29, 2020 10:05 pm

Finally I’ve found this one https://community.openvpn.net/openvpn/ticket/882 that helped to fix it!

The solution is

And so for every IP DNS Server you want to push

Re: DNS resolution fails with «block-ouside-dns» on Windows client

Post by TinCanTech » Sun Mar 29, 2020 10:17 pm

Finally I’ve found this one https://community.openvpn.net/openvpn/ticket/882 that helped to fix it!

The solution is

And so for every IP DNS Server you want to push

Re: DNS resolution fails with «block-ouside-dns» on Windows client

Post by Pippin » Sun Mar 29, 2020 10:19 pm

Re: DNS resolution fails with «block-ouside-dns» on Windows client

Post by sebelk » Sun Mar 29, 2020 10:33 pm

Thanks Pippin, I’ve just fixed and delete the typo «/32»

If you wish the post can be marked as «solved»

Re: DNS resolution fails with «block-ouside-dns» on Windows client

Post by sebelk » Sun Mar 29, 2020 10:35 pm

Finally I’ve found this one https://community.openvpn.net/openvpn/ticket/882 that helped to fix it!

The solution is

And so for every IP DNS Server you want to push

Источник

OpenVPN Support Forum

Community Support Forum

Openvpn and vpnbook and —block-outside-dns

Openvpn and vpnbook and —block-outside-dns

Post by elboppo » Sun Jan 24, 2016 2:50 am

As the subject line says I am trying to get openvpn and vpnbook to stop the dns leak so my question is as follows:

where do I put the «—block-outside-dns»??

any help would be greatly appreciated

Re: Openvpn and —block-outside-dns

Post by phousen » Sun Mar 27, 2016 7:29 am

Me too, I would like some help with this.

I have upgraded openvpn to version 2.3.10 on my ubuntu server and on my win10 client.
When I add —block-outside-dns or block-outside-dns to the config file on the ubuntu server and restart the openvpn service, it fails. So since I cannot push that option to the client, I tried configuring it on the client.

When I add —block-outside-dns or block-outside-dns to the configuration file on the client, it has no effect. The tunnel interface has google DNS set, but nslookup still uses my ISPs DNS.

Here are the configs that I have tried:
# Certain Windows-specific network settings
# can be pushed to clients, such as DNS
# or WINS server addresses. CAVEAT:
# http://openvpn.net/faq.html#dhcpcaveats
# The addresses below refer to the public
# DNS servers provided by opendns.com.
push «dhcp-option DNS 8.8.8.8»
push «dhcp-option DNS 8.8.4.4»
block-outside-dns

on the client:
client
dev tun
tun-ipv6
proto udp
remote x.x.x
pull
block-outside-dns

Re: Openvpn and vpnbook and —block-outside-dns

Post by rseiler » Mon Mar 28, 2016 12:47 am

That’s interesting, since adding it to the opvn on the Win10 client here (I have no control over the server) definitely has an effect: no DNS at all, so the connection is basically useless.

My theory is that another change needs to be made to the file beyond just that addition.

Re: Openvpn and vpnbook and —block-outside-dns

Post by phousen » Tue Apr 05, 2016 5:31 am

Re: Openvpn and vpnbook and —block-outside-dns

Post by agbelang » Tue Jul 26, 2016 12:05 am

Is this thread still alive?
My experience is that Win10 clients are still not working. The block-outside-dns command does stop all traffic because the DNS leak is plugged and there is no default gateway assigned on the VPN tunnel. I have tried everything I can think of to assign the gateway but nothing works. I have run the openvpn GUI as administrator, tried pushing various commands from the server, running those same various commands directly on the client; but everything results in no default gateway assigned.

I have read that win10 doesn’t like to accept manually assigned gateways. Is there another way to do this in openvpn? Maybe through DHCP or something?

Re: Openvpn and vpnbook and —block-outside-dns

Post by TinCanTech » Tue Jul 26, 2016 4:08 pm

This thread was for using —block-outside-dns with vpnbook.

Please post your problem, with the correct details, in this forum:
viewforum.php?f=6

Please see the Forum rules (top of that page)

Источник

OpenVPN Support Forum

Community Support Forum

block-outside-dns in Advanced VPN settings

block-outside-dns in Advanced VPN settings

Post by csmithhelena » Wed Apr 27, 2016 11:48 pm

Re: block-outside-dns in Advanced VPN settings

Post by Traffic » Thu Apr 28, 2016 11:06 am

Re: block-outside-dns in Advanced VPN settings

Post by Pippin » Thu Apr 28, 2016 11:47 am

Re: block-outside-dns in Advanced VPN settings

Post by csmithhelena » Thu Apr 28, 2016 7:23 pm

Re: block-outside-dns in Advanced VPN settings

Post by csmithhelena » Fri Apr 29, 2016 7:23 am

OK, I have not tried the Config directives box yet. But I did try the standalone 2.3.10 client and used the «—block-outside-dns» parameter and it didn’t seem to do anything when connecting from home to our OpenVPN Access Server 2.0.25 at work. The problem that I am trying to fix is that on most Windows 10 PCs (but not all? Maybe always 10 Pro but not 10 Home? I am not sure) that it always uses my local DNS server resolution instead of the one pushed by the VPN server (we have the setting enabled to tell clients to use certain DNS servers).

The only around it that I know of so far without setting the actual DNS servers on my local network adapters when connected to the VPN was to disable my Wi-Fi and do the netsh thing for both IPv4 and IPv6, e.g. (what I actually did):

netsh int ipv4 set int «Ethernet» metric=110
netsh int ipv6 set int «Ethernet» metric=110

And that worked beautifully.

But, I should say that I am on Time Warner Roadrunner and my computer is plugged directly into the cable modem and I wonder if there is something strange there. The only VPN I use is OpenVPN but my internet seems fine.

The beginning of the post here discusses my same problem: https://community.openvpn.net/openvpn/ticket/605

I don’t think «block-outside-dns» is going to fix my problem. So I still need help?

Источник

OpenVPN Support Forum

Community Support Forum

[Solved] block-outside-dns and cannot resolve host address issue

[Solved] block-outside-dns and cannot resolve host address issue

Post by SGWW » Thu May 26, 2016 2:28 pm

I’ve noticed an unpleasant issue which is caused by block-outside-dns and realy need advice how to overcome it.

The issue occurs on the latest 2.3.11 daemon on windows OS when block-outside-dns is used in server config
and remote dns name (not IP address) is used in client config.

As it write in documentation —block-outside-dns prevents Windows from accessing TCP or UDP port 53 except one inside the tunnel. However, when the reconnection occurs (because of bad link or —resolv-retry 3600) the windows client software fails to resolve the hostname of vpn server obviously because of —block-outside-dns.

I can not to disable —block-outside-dns cause want to have a protection against DNS-leak.
The only «solution» I found is —resolv-retry 0 which unfortunatly force user to initiate connection from scrach and to provide it’s credentials again.

Might be someone can give a good recomendation how to fix this behaviour?

Thanks in advanced

Re: block-outside-dns and cannot resolve host address issue

Post by Traffic » Thu May 26, 2016 7:41 pm

Re: block-outside-dns and cannot resolve host address issue

Post by SGWW » Fri May 27, 2016 9:04 am

Thank you for the reply.

Sure, static IP is a fix, however we need DNS round-robin and the ability to change servers’s IPs (don’t want to resend client’s configs every time this happen).

PS I am not a professional developer but this issue looks like a software feature or bug. The simple solution is just to keep the remote IP (after the first success dns query) in some variable and then uses it when need to reconnect. Is it worth to create a bug/feature request?

Re: block-outside-dns and cannot resolve host address issue

Post by Traffic » Fri May 27, 2016 5:54 pm

The filters that block external dns are removed at reconnect, so this
should not happen — provided the client detects the connection drop and
restarts (by say ping-restart).

Need to look at the logs to see what the real issue is.

Re: block-outside-dns and cannot resolve host address issue

Post by SGWW » Sun May 29, 2016 9:13 am

System DNS does not work too until the current openvpn connection manyally close.

Источник

OpenVPN Support Forum

Community Support Forum

[Solved] Windows 10 — block-outside-dns — wpad issues

[Solved] Windows 10 — block-outside-dns — wpad issues

Post by lexios » Wed Jun 20, 2018 6:30 am

Hello to the community.

Using Windows 10 1803 (and 1709) and trying to make OpenVPN work properly as a client.
I imported «setenv opt block-outside-dns» on the client configs and the results are as expted, thus, the OpenVPN interface is automatically set to InterfaceMetric = 3 and DNS queries on other interfaces is blocked.

Up to this point everything works as expected, the clients connect to the BSD OpenVPN server fine.

BUT, this setup works properly only when connecting over the Wifi interface.
If we connect via Ethernet, again the client properly connects and routing works fine.

1. I can ping internal and external hosts
2. I can nslookup properly any hostname

But what I can’t do is to browse the Internet via Edge or IE or PS Invoke-WebRequest.

* IE
When opened, it remains in an «opening state» where we see the IE window but nothing is loaded.
In addition, we can’t even get to IE menus as the browser seems not be fully loaded.

* Edge
Opens up and nothing is loading. When entering any hostname,IP the browser doesn’t even try to load the page.
It’s like it just stays there.

* Invoke-WebRequest -uri xxx.xxx.xx
Huings without erroring out

* Firefox
WORKS FINE

All of the above will never timeout and will just stay in that state indefinitely.

At that point, if I kill the OpenVPN client service, everything is waken up and functions properly.

Now the above behavior does not happen if I don’t use the block-outside-dns

At that point, I tried to disable the wpad script on IE (that would affect the OS as well) and the issue was resolved.

Summarizing when the issue occurs:
1. When connected to Ethernet only AND
2. When using the native software (not Firefox) AND
3. When wpad script is in use AND
4. When block-outside-dns is used

I know this is a possible scenario for many enterprises (using a wpad script) and also -block-outside-dns is avoiding DNS leakage which is also necessary from a security perspective.

It seems like the problem has something to do with resolving something on DNS (dnscache ?) and not being able to do so.
Since the wpad script is the first DNS lookup a browser will do in Windows there could be an issue where this lookup is killed by block-outside-dns.

I have noticed that there is a strange lookup being made repeatedly when the browsers open for the first time after a reboot

What I am thinking of trying is to disable Multi-Homed DNS resolution.

Anyone else has faced this strange issue?
—
Alex

Источник

Also this:
http://clip2net.com/s/3KOUHWv
"Unable to start OpenVPN Interactive Service on local computer: Error 1075: parent service does not exist or has been marked as removed".
This is on fresh installation.

And this:

Error in add_block_dns_filters(): FwpEngineOpen: open fwp session failed : В системе отображения конечных точек не осталось доступных конечных точек.   [status=0x6d9]
Tue May 30 02:28:26 2017 Blocking DNS failed!

"open fwp session failed : There are no more endpoints available from the endpoint mapper."


On 04.06.2017 07:11, Selva Nair wrote:
>
> On Sat, Jun 3, 2017 at 4:13 PM, ValdikSS <valdi...@gm... <mailto:valdi...@gm...>> wrote:
>
> I did not find any related to failure to remove WFP filters. That specific comment link reads
>
> <quote>
> Sun May 28 18:07:25 2017 Block_DNS: WFP engine opened
> Sun May 28 18:07:25 2017 Error in add_block_dns_filters(): add_sublayer: failed to add persistent sublayer : Отказано в доступе. [status=0x5]
> Sun May 28 18:07:25 2017 Blocking DNS failed!
> Sun May 28 18:07:25 2017 Exiting due to fatal error
> </quote>
>
> Obviously "access denied" due to not running as admin and service not in use.
>
> Selva
>
>
>
>
> ------------------------------------------------------------------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
>
>
> _______________________________________________
> Openvpn-devel mailing list
> Openv...@li...
> https://lists.sourceforge.net/lists/listinfo/openvpn-devel

Hey guys, I am trying to setup OpenVPN with a NordVPN account. I did everything described here https://support.nordvpn.com/Connectivity/Windows/1047409832/How-to-set-up-manual-connection-on-Windows-7-and-above.htm

I also added the line block-outside-dns but it is still leaking my DNS. I tried and added the line at the top, at the bottom and in between. Does it matter where I add it?

The log says: Wed Feb 03 11:54:08 2021 Block_DNS: WFP engine opened Wed Feb 03 11:54:08 2021 Block_DNS: Using existing sublayer Wed Feb 03 11:54:08 2021 Block_DNS: Added permit filters for exe_path Wed Feb 03 11:54:08 2021 Block_DNS: Added block filters for all interfaces Wed Feb 03 11:54:08 2021 Block_DNS: Added permit filters for TAP interface

What else can I do to make that work? It feels OpenVPN is a lot faster than the NordVPN and would love to use it, but I of course don’t want any DNS leaks. I am on the latest Windows 10, and the latest OpenVPN client (OpenVPN GUI 11.15.0.0). I gave OpenVPN full access on my Windows 10 Firewall Control.