Multiple domain search for Windows clients

[1]

Hi,

We are successfully running the OpenVPN server in pfSense for over 2 years. This has always been an issue but not something we looked into closely until now. Our VPN clients are using Ubuntu/Debian, MacOS and Windows. We have 3 subdomains in our internal network which should be reachable via domain-search when connected to the VPN. For this we added a custom config for OpenVPN:

push "dhcp-option DOMAIN test.company.com";
push "dhcp-option DOMAIN ads.company.com";
push "dhcp-option DOMAIN mc.company.com";

push "dhcp-option DOMAIN-SEARCH mc.company.com";
push "dhcp-option DOMAIN-SEARCH ads.company.com";
push "dhcp-option DOMAIN-SEARCH test.company.com";

The DOMAIN-SEARCH options work fine for Ubuntu/Debian and MacOS. All hostnames are reachable using the short hostname. For Windows however, DOMAIN-SEARCH does not work at all, therefore there we are using DOMAIN. The problem with this, on Windows, is that only the last line of the DOMAIN it used. Only short hostnames in mc.company.com are reachable.

We are looking to find a solution to this and it seems Windows would support the following format:

push "dhcp-option DOMAIN mc.company.com;ads.company.com;test.company.com";

Source: https://serverfault.com/questions/376963/multiple-dns-suffix-search-base-on-windows-dhcp/376970#376970

However, I am unable to test this scenario because pfSense uses the semi-colon as an EOL delimiter, therefore it splits this line in 3 separate lines in server.conf. I did try to escape the semi-colons with no success.

That being said, I have 2 questions:

1. Does anyone know a good way of specifying multiple search domains for Windows with OpenVPN?
2. Any idea how the semi-colons could be escaped so that pfSense doesn't split the line?

Thanks!

[1]

No else here using OpenVPN on Linux and Windows clients has seen this issue?

[johnpoz]

So are these windows machines part of your domain?  If so that is where you would push out the search domains via gpo..

[Rico]

Same issue here and searching for some solution.

-Rico

[IT_Dept]

under the OpenVPN Server configuration section, the pfSense GUI allows you to specify a "DNS default domain name" value to be used by the OpenVPN clients, so that they will resolve hostnames appending that domain name as a primary DNS suffix. On the GUI you can specify additional DNS domain names as well. The "DNS default domain name" field on the GUI translates to the DHCP option 15 and will appear under ISC dhcpd's config as "option domain-name", and the remaining DNS domain names specified on the GUI translate to the DHCP option 119 and will appear under ISC dhcpd's config as "option domain-search".

The DHCP client of MS Windows (at least up to Windows 7, included) do not implement the DHCP option 119, so they'll ignore any DNS domain name specified on the pfSense GUI other than the one specified on the "DNS default domain name" field. It's a limitation of the Windows DHCP client. That OS itself has no such limitation, because you can specify multiple DNS search suffixes on Windows clients joined to an AD using GPO's. Take a look at this link,

https://blogs.msmvps.com/acefekay/2011/02/12/configuring-dns-search-suffixes/

Regards