search

JonathanxD / openaws-vpn-client

Unofficial open-source AWS VPN Client GUI for Linux
Other
59 stars 13 forks source link

DNS Resolution #3

Open yangchoo opened 1 year ago

yangchoo commented 1 year ago

Posting here for visibility in case it helps anyone who runs into a similar issue or has a better solution.

Ran into an issue where the AWS configured DNS server was not being utilized, resulting in internal addresses not being able to be resolved. I'm unsure how the VPN client automatically handles this and I don't see any references in the exported OVPN file.

Option 1 - resolv.conf

Overwrite /etc/resolv.conf directly to use the new DNS server

nameserver xxx.xxx.xxx.xxx

This overrides ALL traffic to go through the AWS DNS server. If the gateway is properly configured (e.g. with split tunneling) and load/performance isn't an issue, this is the simplest.

Option 2 - dnsmasq

Use dnsmasq for more granular control of which nameservers to use for address ranges.

Overwrite /etc/resolv.conf to point to internal dnsmasq address, defaults to 127.0.0.1

nameserver 127.0.0.1

Uncomment no-dhcp-interface and add in default nameserver and nameservers for specific internal domains 

server=xx.xx.xx.xx
server=/mydomain.com/yy.yy.yy.yy

Option 3 - route gateway config

This is the most advanced option. Note that I couldn't get this to work for my usecase, but this would be the most portable as the configuration should be encapsulated within the ovpn file.

This should be some combination of

route-gateway xx.xx.xx.xx
push "route-gateway xx.xx.xx.xx"
push "route yy.yy.0.0 255.255.0.0 xx.xxx.xx.xx 1"

The exact combination of addresses and gateway will depend on your route list.

JonathanxD commented 1 year ago

Hmm, I need to look how AWS Client does this, but I'm pretty sure it's possible to do since we do this on our VPN (not AWS tho, so I need to setup my own in order to test).

outergod commented 1 year ago

The "right" way to do it is to utilize systemd-resolved on most modern systems, which can be configured through DBus calls. https://github.com/jonathanio/update-systemd-resolved provides a solution for this.

Overwriting /etc/resolv.conf is a subpar idea these days, as modern distros often supply local DNS servers configured as sole DNS, that should be configured, instead.

outergod commented 1 year ago

For the record, NetworkManager's OpenVPN integration parses the OpenVPN output directly to set routes and DNS, but that's obviously not an option with a custom GUI.

FelipeLema commented 1 year ago

For the record, NetworkManager's OpenVPN integration parses the OpenVPN output directly to set routes and DNS, but that's obviously not an option with a custom GUI.

I don't see why not... aren't we capturing the openvpn output already?