Registering OpenVPN clients in the DNS



  • I have openVPN (pfsense 2.3.3) giving out client addresses to 10.0.101.0/24.  The LAN subnet is 10.0.100.0/24 with pfsense running on .1  openVPN SSL clients are able to resolve addresses assigned by DHCP on 10.0.100.0/24.  However any OpenVPN SSL clients are not registering in the DNS, therefore when I try to resolve a hostname of a client that's connected over OpenVPN, it can't resolve.

    I've tried adding 'register-dns' to the client openvpn config, but they're still not registering in the DNS (pfsense DNS forwarder mode).  Message in the event viewer on the client is:

    	The system failed to register host (A or AAAA) resource records for network adapter
    with settings:
    
               Adapter Name : XXXXXXXXXXXXXXXXX
               Host Name : XXXXXXXXXXXXXXX
               Primary Domain Suffix : XXXXXXXXXXXXXXXXXX
               DNS server list :
                 	10.0.100.1
               Sent update to server : 
               IP Address(es) :
                 10.0.101.6
    
    Either the DNS server does not support the DNS dynamic update protocol or the authoritative zone for the specified DNS domain name does not accept dynamic updates.
    
    To register the DNS host (A or AAAA) resource records using the specific DNS domain 
    

    Client config (OpenVPN 2.3.10 x86_64-w64-mingw32 [SSL (OpenSSL)]):

    dev tun
    persist-tun
    persist-key
    cipher AES-128-CBC
    tls-client
    client
    resolv-retry infinite
    remote XXXXXXXXXXXXXXXXX 1194 udp
    tls-remote VPN Server Cert
    auth-user-pass
    pkcs12 "XXXXXXXXXXXXXXXXXXXXXXXXX"
    tls-auth "XXXXXXXXXXXXXXXXXXXXXXXXX" 1
    ns-cert-type server
    comp-lzo
    register-dns
    

    Any way to get hosts connected via OpenVPN to resolve?

    Thanks.



  • Hmm, 0 replies… is this not possible because of pfsense using unbound, or am I asking in the wrong forum section?  Find it hard to believe that no one has run into the same issue....



  • Hello,
    very interested in this topic. facing the same issue


  • LAYER 8 Global Moderator

    So you want your windows machine to register their dns in unbound?  AFAIK that is not possible.. You should tell the client to register itself with your AD dns..

    How many clients are you talking?  Might be just easier to just give each client a specific IP and then have a entry in your dns for that openvpn client.



  • hello,
    thanks for your interest.

    not willing to hijack this topic, but as i have some attention, i abuse it :)
    We don't work in domain mode. all machines are stand-alone.
    these are 150 unattended PC's running since 2 years for which we need more control.
    these PC's are on 75 different sites and we need some tunnels to remotely execute some powershell scripts.
    the kiosks connect to our PFSense/OpenVPN server, we can powershell remotely, but we would need to address them by their name rather than seach for their IP.
    my option at the moment would be to create 150 "client specific overrides" with a per-kiosk "ifconfig-push", but this is a pain in the a**
    any lead to a better and easier solution are more than welcome.

    thanks for reading.


  • LAYER 8 Global Moderator

    "We don't work in domain mode. all machines are stand-alone."

    That is pretty stupid if you ask me, managing 150 windows machines becomes much easier when they are part of domain..  My suggestion to you would be to put that at the top of your list.. ;)



  • hello,
    i understand your remark, and i totally agree, but sometimes you just can't…
    we don't own the PC's, we can't ask any change on the network they are connected to, and many other factors impeaching (or making hard to run) a domain enrollment of these machines.
    we are fine with winRM for what we need to do, it works fine based on the IP's of the machines, DNS registering would be just nice to have.


  • LAYER 8 Global Moderator

    Well you would need to allow them to register to a windows dns (even if not domain) or run bind that allows for it.  Unbound does not allow for such stuff AFAIK..  Unbound is not really designed to be an authoritative name server..



  • hello,
    just some feedback to thank you for your time johnpoz.
    we (my colleague) found a way to update our dns server with the help of learn-address. it pushes CN and IP to a bind/named and works like a charm.


  • LAYER 8 Global Moderator

    "it pushes CN and IP to a bind/named and works like a charm"

    Yeah bind can do that ;)  There is not such functionality in unbound that I am aware of.


Log in to reply