OpenVPN --allow-pull-fqdn Not Working

Below are the base settings of the client.ovpn file, being run on Windows 10 via OpenVPN GUI.

client
dev tun
proto udp
remote <vpn_address> <vpn_port>
resolv-retry infinite
nobind
persist-key
persist-tun
key-direction 1
remote-cert-tls server
tls-version-min 1.2
verify-x509-name server name
cipher AES-256-CBC
auth SHA256
comp-lzo
verb 1

I am attempting to configure this client so that only one, single address is routed over the VPN.

Doing this via IP address works like a charm:

[CASE 1]

route-nopull
route 192.168.1.123 255.255.255.255

However, changing the settings to:

[CASE 2]

route-nopull
allow-pull-fqdn
route user2426679.service 255.255.255.255

Fails with:

Thu Sep 27 14:28:33 2018 RESOLVE: Cannot resolve host address: user2426679.service: (No such host is known. )
Thu Sep 27 14:28:33 2018 OpenVPN ROUTE: failed to parse/resolve route for host/network: user2426679.service

The curious part is that I can connect to user2426679.service just fine over the VPN with these settings:

[CASE 3]

route-nopull
allow-pull-fqdn
route user2426679.service 255.255.255.255
dhcp-option DNS 192.168.1.1
redirect-gateway def1

Note: I still get the error message/log entry of Cannot resolve host address ... and failed to parse ...

But, when I actually hit user2426679.service in my application, it is successful.

What gives? For some reason, the config load of route user2426679.service 255.255.255.255 does not succeed in making the DNS request, but the DNS is resolved without problem over the same VPN connection later on (when using VPN for all DNS requests in [CASE 3], which is not the desired scenario of [CASE 2], which doesn't work at all).

The man page says that allow-pull-fqdn will "Allow client to pull DNS names from server" for route, but this does not appear to be happening.

1 Reset to default

Know someone who can answer? Share a link to this question via email, Twitter, or Facebook.

Your Answer

Sign up or log in

Sign up using Google Sign up using Facebook Sign up using Email and Password

Post as a guest

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

You Might Also Like