Не получается настроить на клиенте openvpn dns так, чтобы клиент работал только через dns сервер (unbound), выдаваемый openvpn. Часть запросов идет через dns , выдаваемый провайдером клиента.
Сервер - ubuntu 20.04, OpenVPN 2.4.7
Клиент - ubuntu 20.04, OpenVPN 2.4.9
Вот пример вывода tcpdump на внешнем интерфейсе сервера
10.142.0.2 - адрес сервера с openvpn Первый запрос-ответ - на dns сервер провайдера клиента (94.140.14.14) Второй - на 1.1.1.1 , прописанный как форвард в unbound
В основном запросы на днс провайдера идут после перезапуска openvpn, Потом реже.
tcpdump -n -i ens4 port 53
14:18:02.020305 IP 10.142.0.2.48799 > 94.140.14.14.53: 16563+ [1au] AAAA? connectivity-check.ubuntu.com. (58)
14:18:02.082427 IP 94.140.14.14.53 > 10.142.0.2.48799: 16563 0/1/1 (119)
14:18:13.520614 IP 10.142.0.2.44218 > 1.1.1.1.53: 41509+ [1au] A? WwW.TunE-IT.ru. (43)
14:18:13.592899 IP 10.142.0.2.41787 > 1.1.1.1.53: 7978+ [1au] A? wWW.TUNe-it.ru. (43)
конфиг сервера unbound
server:
include: "/etc/unbound/unbound.conf.d/*.conf"
port: 53
username: unbound
interface: 127.0.0.1
interface: 10.8.0.1
outgoing-interface: 10.142.0.2
access-control: 127.0.0.0/8 allow_snoop
access-control: 10.8.0.0/8 allow_snoop # Service VPN
do-ip4: yes
do-ip6: no
do-udp: yes
do-tcp: yes
num-threads: 1
cache-min-ttl: 3600
cache-max-ttl: 86400
prefetch: yes
qname-minimisation: yes
rrset-roundrobin: yes
use-caps-for-id: yes
use-syslog: no
do-not-query-localhost: no
forward-zone:
name: "."
forward-addr: 1.1.1.1 # Cloudflare
remote-control:
control-enable: yes
control-interface: 127.0.0.1
control-port: 8953
server-key-file: "unbound_server.key"
server-cert-file: "unbound_server.pem"
control-key-file: "unbound_control.key"
control-cert-file: "unbound_control.pem"
Конфиг сервера openvpn
port 443
port-share 127.0.0.1 4443
proto tcp-server
dev tun
ca ca.crt
cert san-vps.crt
dh dh.pem
tls-auth ta.key 0
cipher AES-256-CBC
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist /var/log/openvpn/ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "block-outside-dns"
push "dhcp-option DNS 10.8.0.1"
keepalive 10 120
persist-key
persist-tun
status /var/log/openvpn/openvpn-status.log
log /var/log/openvpn/openvpn.log
Конфиг клиента openvpn
client
dev tun
proto tcp-client
remote 11.22.33.44 443
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
cipher AES-256-CBC
verb 3
script-security 2
up /etc/openvpn/update-resolv-conf
down /etc/openvpn/update-resolv-conf
вывод systemd-resolve --status клиента
Global
LLMNR setting: no
MulticastDNS setting: no
DNSOverTLS setting: no
DNSSEC setting: no
DNSSEC supported: no
Current DNS Server: 10.8.0.1
DNS Servers: 10.8.0.1
Link 2 (wlp2s0)
Current Scopes: DNS
DefaultRoute setting: yes
LLMNR setting: yes
MulticastDNS setting: no
DNSOverTLS setting: no
DNSSEC setting: no
DNSSEC supported: no
Current DNS Server: 94.140.14.14
DNS Servers: 94.140.14.14
DNS Domain: ~.
Link 9 (tun0)
Current Scopes: none
DefaultRoute setting: no
LLMNR setting: yes
MulticastDNS setting: no
DNSOverTLS setting: no
DNSSEC setting: no
DNSSEC supported: no
resolv.conf клиента
nameserver 10.8.0.1
nameserver 127.0.0.53
