• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

Multiple domain search for Windows clients

Scheduled Pinned Locked Moved OpenVPN
7 Posts 5 Posters 10.4k Views 3 Watching
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • 1 Offline
    1
    last edited by Jun 29, 2017, 9:16 AM

    Hi,

    We are successfully running the OpenVPN server in pfSense for over 2 years. This has always been an issue but not something we looked into closely until now. Our VPN clients are using Ubuntu/Debian, MacOS and Windows. We have 3 subdomains in our internal network which should be reachable via domain-search when connected to the VPN. For this we added a custom config for OpenVPN:

    
    push "dhcp-option DOMAIN test.company.com";
    push "dhcp-option DOMAIN ads.company.com";
    push "dhcp-option DOMAIN mc.company.com";
    
    push "dhcp-option DOMAIN-SEARCH mc.company.com";
    push "dhcp-option DOMAIN-SEARCH ads.company.com";
    push "dhcp-option DOMAIN-SEARCH test.company.com";
    
    

    The DOMAIN-SEARCH options work fine for Ubuntu/Debian and MacOS. All hostnames are reachable using the short hostname. For Windows however, DOMAIN-SEARCH does not work at all, therefore there we are using DOMAIN. The problem with this, on Windows, is that only the last line of the DOMAIN it used. Only short hostnames in mc.company.com are reachable.

    We are looking to find a solution to this and it seems Windows would support the following format:

    
    push "dhcp-option DOMAIN mc.company.com;ads.company.com;test.company.com";
    
    

    Source: https://serverfault.com/questions/376963/multiple-dns-suffix-search-base-on-windows-dhcp/376970#376970

    However, I am unable to test this scenario because pfSense uses the semi-colon as an EOL delimiter, therefore it splits this line in 3 separate lines in server.conf. I did try to escape the semi-colons with no success.

    That being said, I have 2 questions:

    1. Does anyone know a good way of specifying multiple search domains for Windows with OpenVPN?
    2. Any idea how the semi-colons could be escaped so that pfSense doesn't split the line?

    Thanks!

    1 Reply Last reply Reply Quote 0
    • 1 Offline
      1
      last edited by Oct 18, 2017, 8:29 AM

      No else here using OpenVPN on Linux and Windows clients has seen this issue?

      1 Reply Last reply Reply Quote 0
      • J Offline
        johnpoz LAYER 8 Global Moderator
        last edited by Oct 18, 2017, 8:55 AM

        So are these windows machines part of your domain?  If so that is where you would push out the search domains via gpo..

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.8, 25.07

        1 Reply Last reply Reply Quote 0
        • R Offline
          Rico LAYER 8 Rebel Alliance
          last edited by Oct 23, 2018, 12:59 PM

          Same issue here and searching for some solution.

          -Rico

          1 Reply Last reply Reply Quote 0
          • I Offline
            IT_Dept
            last edited by IT_Dept Sep 5, 2020, 9:47 AM Oct 27, 2018, 12:53 PM

            under the OpenVPN Server configuration section, the pfSense GUI allows you to specify a "DNS default domain" value to be used by the OpenVPN clients, so that they will resolve hostnames appending that domain name as a primary DNS suffix. This field on the GUI translates to the DHCP option 15.

            The DHCP option that allows to specify a domain search list (that is, one or more domains) is the option 119. The DHCP client of MS Windows (at least up to Windows 7, included) implements the DHCP option 15 but does not implement the DHCP option 119, so it will only accept the (single) domain specified in the "DNS default domain" field. It's a limitation of the Windows DHCP client. That OS itself has no such limitation, because you can specify multiple DNS search suffixes on Windows clients joined to an AD using GPO's. Take a look at this link,

            https://blogs.msmvps.com/acefekay/2011/02/12/configuring-dns-search-suffixes/

            Regards

            1 Reply Last reply Reply Quote 1
            • M Offline
              mrtumnus
              last edited by Aug 31, 2020, 3:50 PM

              Sorry for necro-posting, but wanted to add some information here since this is a thread that came up as a search result.

              Windows 10 has added support for DHCP option 119 at least as of the April 2018 build (1803). However, I had to use the OpenVPN Connect application on Windows in order to take advantage of this. I am now able to consistently resolve two connection-specific domains via a single OpenVPN session.

              1 Reply Last reply Reply Quote 0
              • I Offline
                IT_Dept
                last edited by Sep 5, 2020, 10:00 AM

                thanks for your update. OpenVPN 2.5 will allow to pass a domain search list to Windows clients, see

                https://github.com/OpenVPN/openvpn/blob/release/2.5/Changes.rst (search "Support setting DHCP search domain")
                https://community.openvpn.net/openvpn/ticket/1209

                1 Reply Last reply Reply Quote 0
                • First post
                  Last post
                Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                  This community forum collects and processes your personal information.
                  consent.not_received