Registering OpenVPN clients in the DNS

JamesVA

I have openVPN (pfsense 2.3.3) giving out client addresses to 10.0.101.0/24. The LAN subnet is 10.0.100.0/24 with pfsense running on .1 openVPN SSL clients are able to resolve addresses assigned by DHCP on 10.0.100.0/24. However any OpenVPN SSL clients are not registering in the DNS, therefore when I try to resolve a hostname of a client that's connected over OpenVPN, it can't resolve.

I've tried adding 'register-dns' to the client openvpn config, but they're still not registering in the DNS (pfsense DNS forwarder mode). Message in the event viewer on the client is:

	The system failed to register host (A or AAAA) resource records for network adapter
with settings:

           Adapter Name : XXXXXXXXXXXXXXXXX
           Host Name : XXXXXXXXXXXXXXX
           Primary Domain Suffix : XXXXXXXXXXXXXXXXXX
           DNS server list :
             	10.0.100.1
           Sent update to server : 
           IP Address(es) :
             10.0.101.6

Either the DNS server does not support the DNS dynamic update protocol or the authoritative zone for the specified DNS domain name does not accept dynamic updates.

To register the DNS host (A or AAAA) resource records using the specific DNS domain

Client config (OpenVPN 2.3.10 x86_64-w64-mingw32 [SSL (OpenSSL)]):

dev tun
persist-tun
persist-key
cipher AES-128-CBC
tls-client
client
resolv-retry infinite
remote XXXXXXXXXXXXXXXXX 1194 udp
tls-remote VPN Server Cert
auth-user-pass
pkcs12 "XXXXXXXXXXXXXXXXXXXXXXXXX"
tls-auth "XXXXXXXXXXXXXXXXXXXXXXXXX" 1
ns-cert-type server
comp-lzo
register-dns

Any way to get hosts connected via OpenVPN to resolve?

Thanks.

JamesVA

Hmm, 0 replies… is this not possible because of pfsense using unbound, or am I asking in the wrong forum section? Find it hard to believe that no one has run into the same issue....

benmaca

Hello,
very interested in this topic. facing the same issue

johnpoz

So you want your windows machine to register their dns in unbound? AFAIK that is not possible.. You should tell the client to register itself with your AD dns..

How many clients are you talking? Might be just easier to just give each client a specific IP and then have a entry in your dns for that openvpn client.

benmaca

hello,
thanks for your interest.

not willing to hijack this topic, but as i have some attention, i abuse it :)
We don't work in domain mode. all machines are stand-alone.
these are 150 unattended PC's running since 2 years for which we need more control.
these PC's are on 75 different sites and we need some tunnels to remotely execute some powershell scripts.
the kiosks connect to our PFSense/OpenVPN server, we can powershell remotely, but we would need to address them by their name rather than seach for their IP.
my option at the moment would be to create 150 "client specific overrides" with a per-kiosk "ifconfig-push", but this is a pain in the a**
any lead to a better and easier solution are more than welcome.

thanks for reading.

johnpoz

"We don't work in domain mode. all machines are stand-alone."

That is pretty stupid if you ask me, managing 150 windows machines becomes much easier when they are part of domain.. My suggestion to you would be to put that at the top of your list.. ;)

benmaca

hello,
i understand your remark, and i totally agree, but sometimes you just can't…
we don't own the PC's, we can't ask any change on the network they are connected to, and many other factors impeaching (or making hard to run) a domain enrollment of these machines.
we are fine with winRM for what we need to do, it works fine based on the IP's of the machines, DNS registering would be just nice to have.

johnpoz

Well you would need to allow them to register to a windows dns (even if not domain) or run bind that allows for it. Unbound does not allow for such stuff AFAIK.. Unbound is not really designed to be an authoritative name server..

benmaca

hello,
just some feedback to thank you for your time johnpoz.
we (my colleague) found a way to update our dns server with the help of learn-address. it pushes CN and IP to a bind/named and works like a charm.

johnpoz

"it pushes CN and IP to a bind/named and works like a charm"

Yeah bind can do that ;) There is not such functionality in unbound that I am aware of.