Login/Register
VPN clients to resolve private DNS hostnames in AWS [closed]
Asked Answered
Solved amazon-web-servicesdnsopenvpnaws-vpc
S

1

10

I've recently setup OpenVPN server on an AWS EC2 instance in order to connect my office to the AWS VPC environment.

I'm using TunnelBlick as the VPN client and all is good! I can ssh to the private IPs in the VPC. However, resolving the DNS VPC names from my office hosts( which I could if i'd run it from an EC2 instance in the VPC ) is NOT working.

My current solution is to setup a DNS forwarder using Unbound on an EC2 instance ( which happens to be my instance that is running the OpenVPN server as well ) - but its not working for some reason. How would you enable your VPN clients, once connected to the VPN server to able to resolve private hostnames in the VPC ?

I'm quite lost, so if you have any other ideas, or can figure out according to my current setup whats wrong i'd be eternally grateful :)

OpenVPN server config

port 1194 #- change the port you want

proto udp #- protocol can be tcp or udp

dev tun

tun-mtu 1500

tun-mtu-extra 32

mssfix 1450

ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt

cert /etc/openvpn/easy-rsa/2.0/keys/server.crt

key /etc/openvpn/easy-rsa/2.0/keys/server.key

dh /etc/openvpn/easy-rsa/2.0/keys/dh2048.pem

server 10.8.0.0 255.255.255.0

push "redirect-gateway def1 bypass-dhcp"

push "dhcp-option DNS 8.8.8.8"

push "dhcp-option DNS 8.8.4.4"

push "dhcp-option DNS <PUBLIC_IP_OF_THE_SERVER_RUNNING_OPENVPN_AND_UNBOUND>"

keepalive 5 30

comp-lzo

persist-key

persist-tun

status server-tcp.log

verb 3

Unbound server config

172.31.0.2 is the VPC DNS server 

server:
        interface: 0.0.0.0
        access-control: 0.0.0.0/0 allow
remote-control:
forward-zone:
        name: "."
        forward-addr: 172.31.0.2

VPN Client config

##############################################
# Client-side OpenVPN 2.0 config file #
# for connecting to multi-client server.     #
#                                            #
# This configuration can be used by multiple #
# clients, however each client should have   #
# its own cert and key files.                #
#                                            #
# On Windows, you might want to rename this  #
# file so it has a .ovpn extension           #
##############################################

# Specify that we are a client and that we
# will be pulling certain config file directives
# from the server.
client

# Use the same setting as you are using on
# the server.
# On most systems, the VPN will not function
# unless you partially or fully disable
# the firewall for the TUN/TAP interface.
;dev tap
dev tun

# Windows needs the TAP-Win32 adapter name
# from the Network Connections panel
# if you have more than one.  On XP SP2,
# you may need to disable the firewall
# for the TAP adapter.
;dev-node MyTap

# Are we connecting to a TCP or
# UDP server?  Use the same setting as
# on the server.
;proto tcp
proto udp

# The hostname/IP and port of the server.
# You can have multiple remote entries
# to load balance between the servers.
remote <PUBLIC_IP_OF_THE_SERVER_RUNNING_OPENVPN_AND_UNBOUND> 1194
;remote my-server-2 1194

# Choose a random host from the remote
# list for load-balancing.  Otherwise
# try hosts in the order specified.
;remote-random

# Keep trying indefinitely to resolve the
# host name of the OpenVPN server.  Very useful
# on machines which are not permanently connected
# to the internet such as laptops.
resolv-retry infinite

# Most clients don't need to bind to
# a specific local port number.
nobind

# Downgrade privileges after initialization (non-Windows only)
;user nobody
;group nobody

# Try to preserve some state across restarts.
persist-key
persist-tun

# If you are connecting through an
# HTTP proxy to reach the actual OpenVPN
# server, put the proxy server/IP and
# port number here.  See the man page
# if your proxy server requires
# authentication.
;http-proxy-retry # retry on connection failures
;http-proxy [proxy server] [proxy port #]

# Wireless networks often produce a lot
# of duplicate packets.  Set this flag
# to silence duplicate packet warnings.
;mute-replay-warnings

# SSL/TLS parms.
# See the server config file for more
# description.  It's best to use
# a separate .crt/.key file pair
# for each client.  A single ca
# file can be used for all clients.
ca /Users/antoniogomez/ca.crt
cert /Users/antoniogomez/client.crt
key /Users/antoniogomez/client.key

# Verify server certificate by checking
# that the certicate has the nsCertType
# field set to "server".  This is an
# important precaution to protect against
# a potential attack discussed here:
#  http://openvpn.net/howto.html#mitm
#
# To use this feature, you will need to generate
# your server certificates with the nsCertType
# field set to "server".  The build-key-server
# script in the easy-rsa folder will do this.
;ns-cert-type server

# If a tls-auth key is used on the server
# then every client must also have the key.
;tls-auth ta.key 1

# Select a cryptographic cipher.
# If the cipher option is used on the server
# then you must also specify it here.
;cipher x
# Enable compression on the VPN link.
# Don't enable this unless it is also
# enabled in the server config file.
comp-lzo
# Set log file verbosity.
verb 3
# Silence repeating messages
;mute 20

# This updates the resolvconf with dns settings
setenv PATH /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
script-security 2
up /etc/openvpn/update-resolv-conf.sh
down /etc/openvpn/update-resolv-conf.sh
down-pre

Now, once i'm connected to the VPN my resolv.conf (client side) looks like this:

nameserver 8.8.8.8
nameserver 8.8.8.4
nameserver PUBLIC_IP_OF_THE_SERVER_RUNNING_OPENVPN_AND_UNBOUND

Telnet from client to the DNS server works ( AWS security groups applied properly )

[antoniogomez:~]$ telnet PUBLIC_IP_OF_THE_SERVER_RUNNING_OPENVPN_AND_UNBOUND 53
Trying PUBLIC_IP_OF_THE_SERVER_RUNNING_OPENVPN_AND_UNBOUND...
Connected to ec2-instance.us-west-1.compute.amazonaws.com.
Escape character is '^]'.

Many thanks in advance for all of you out there for helping out,

Antonio

Snuffy answered 30/12, 2017 at 10:1 Comment(0)
S
10

So this is how I made it work! First of all, I moved to work with Bind instead of Unbound ( inspired by this video here

Bind Server config

//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//    

options {
    directory           "/var/named";
    dump-file           "/var/named/data/cache_dump.db";
    statistics-file     "/var/named/data/named_stats.txt";
    memstatistics-file  "/var/named/data/named_mem_stats.txt";
    dnssec-enable no;
    dnssec-validation no;
    allow-query     { any;};
    allow-recursion { any;};
    forward only;
    forwarders { 172.31.0.2; }; # This is my VPC internal DNS Server
};

logging {
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };
};

zone "." IN {
    type hint;
    file "named.ca";
};

include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";

Now make sure to push to your VPN clients the IP of the DNS server you installed ( in this case its the Bind server )

OpenVPN Server config

port 1194 #- change the port you want

proto udp #- protocol can be tcp or udp

dev tun

tun-mtu 1500

tun-mtu-extra 32

mssfix 1450

ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt

cert /etc/openvpn/easy-rsa/2.0/keys/server.crt

key /etc/openvpn/easy-rsa/2.0/keys/server.key

dh /etc/openvpn/easy-rsa/2.0/keys/dh2048.pem

server 10.8.0.0 255.255.255.0
   
push "redirect-gateway def1"

push "dhcp-option DNS <IP_OF_SERVER_RUNNING_BOTH_OPENVPN_AND_BIND>" # This line push your DNS server to be used by the VPN clients

keepalive 5 30

comp-lzo

persist-key

persist-tun

status server-tcp.log

verb 3

Apparently, VPN clients running on top of linux need "some help" putting the "new" DNS server into use with the following config (see the last lines in the config, get the scripts from here):

VPN Client config

##############################################
# Client-side OpenVPN 2.0 config file #
# for connecting to multi-client server.     #
#                                            #
# This configuration can be used by multiple #
# clients, however each client should have   #
# its own cert and key files.                #
#                                            #
# On Windows, you might want to rename this  #
# file so it has a .ovpn extension           #
##############################################

# Specify that we are a client and that we
# will be pulling certain config file directives
# from the server.
client

# Use the same setting as you are using on
# the server.
# On most systems, the VPN will not function
# unless you partially or fully disable
# the firewall for the TUN/TAP interface.
;dev tap
dev tun

# Windows needs the TAP-Win32 adapter name
# from the Network Connections panel
# if you have more than one.  On XP SP2,
# you may need to disable the firewall
# for the TAP adapter.
;dev-node MyTap

# Are we connecting to a TCP or
# UDP server?  Use the same setting as
# on the server.
;proto tcp
proto udp

# The hostname/IP and port of the server.
# You can have multiple remote entries
# to load balance between the servers.
remote <IP_OF_SERVER_RUNNING_BOTH_OPENVPN_AND_BIND> 1194
;remote my-server-2 1194

# Choose a random host from the remote
# list for load-balancing.  Otherwise
# try hosts in the order specified.
;remote-random

# Keep trying indefinitely to resolve the
# host name of the OpenVPN server.  Very useful
# on machines which are not permanently connected
# to the internet such as laptops.
resolv-retry infinite

# Most clients don't need to bind to
# a specific local port number.
nobind

# Downgrade privileges after initialization (non-Windows only)
;user nobody
;group nobody

# Try to preserve some state across restarts.
persist-key
persist-tun

# If you are connecting through an
# HTTP proxy to reach the actual OpenVPN
# server, put the proxy server/IP and
# port number here.  See the man page
# if your proxy server requires
# authentication.
;http-proxy-retry # retry on connection failures
;http-proxy [proxy server] [proxy port #]

# Wireless networks often produce a lot
# of duplicate packets.  Set this flag
# to silence duplicate packet warnings.
;mute-replay-warnings

# SSL/TLS parms.
# See the server config file for more
# description.  It's best to use
# a separate .crt/.key file pair
# for each client.  A single ca
# file can be used for all clients.
ca /Users/myusername/name_of_my_ca.crt
cert /Users/myusername/name_of_my_client.crt
key /Users/myusername/name_of_my_client.key

# Verify server certificate by checking
# that the certicate has the nsCertType
# field set to "server".  This is an
# important precaution to protect against
# a potential attack discussed here:
#  http://openvpn.net/howto.html#mitm
#
# To use this feature, you will need to generate
# your server certificates with the nsCertType
# field set to "server".  The build-key-server
# script in the easy-rsa folder will do this.
;ns-cert-type server

# If a tls-auth key is used on the server
# then every client must also have the key.
;tls-auth ta.key 1

# Select a cryptographic cipher.
# If the cipher option is used on the server
# then you must also specify it here.
;cipher x
# Enable compression on the VPN link.
# Don't enable this unless it is also
# enabled in the server config file.
comp-lzo
# Set log file verbosity.
verb 3
# Silence repeating messages
;mute 20

# This updates the resolvconf with dns settings
setenv PATH /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
script-security 2
up /etc/openvpn/update-resolv-conf.sh
down /etc/openvpn/update-resolv-conf.sh
down-pre

Now once your VPN server and Bind server are properly set up with the above your VPN clients ( your private mac/office computers on-premise etc ) , while connected to the VPN server, are capable not only to ssh private IPs but also resolve internal AWS hostnames in the VPC e.g ip-172-31-0-63.us-west-1.compute.internal

EDIT: The following helps to create a single file to setup a VPN client, useful for mobile devices.

All-in-one VPN Client config

client
dev tun
proto udp
remote PUBLIC_IP 1194
tls-version-min 1.2
tls-cipher <CIPHERS>
cipher AES-256-CBC
auth SHA512
resolv-retry infinite
auth-retry none
nobind
persist-key
persist-tun
remote-cert-tls server
comp-lzo
verb 3
tls-client
<ca>
...
</ca>
<cert>
...
</cert>
<key>
...
</key>
<tls-auth>
...
</tls-auth>
Snuffy answered 31/12, 2017 at 10:43 Comment(2)
Did you manage to get working this client config on the android/ios clients? – Switchboard
@Switchboard today we are using an all-in-one config, which has the credentials and the client configs in one file. Yes its working on mobile clients as well see my edit – Snuffy

© 2022 - 2024 — McMap. All rights reserved.