Cloud DNS with OpenVPN not resolving on client
I'm trying to use Google Cloud Platform's Cloud DNS to resolve internal IPs of Compute Engine instances by DNS from my local machine. I was able to setup an OpenVPN server on an instance by following this guide: https://www.digitalocean.com/community/tutorials/how-to-set-up-an-openvpn-server-on-ubuntu-16-04
My VPN configuration successfully connects to the OpenVPN server, and allows me to ping internal IPs of my GCE instances. The instance hosting my OpenVPN server is able to resolve and ping cloud DNS entries, but my client local machine is unable to do the same.
Here's the content of my /etc/resolve.conf file after connecting to the VPN server.
search openvpn
nameserver 169.254.169.254
What additional configuration do I need to do to allow my local machine to resolve Cloud DNS addresses?
dns
google-cloud-platform vpn openvpn 
google-cloud-dns asked Nov 20 at 16:33
Jacob Smith
14
add a comment |
I'm trying to use Google Cloud Platform's Cloud DNS to resolve internal IPs of Compute Engine instances by DNS from my local machine. I was able to setup an OpenVPN server on an instance by following this guide: https://www.digitalocean.com/community/tutorials/how-to-set-up-an-openvpn-server-on-ubuntu-16-04
My VPN configuration successfully connects to the OpenVPN server, and allows me to ping internal IPs of my GCE instances. The instance hosting my OpenVPN server is able to resolve and ping cloud DNS entries, but my client local machine is unable to do the same.
Here's the content of my /etc/resolve.conf file after connecting to the VPN server.
search openvpn
nameserver 169.254.169.254
What additional configuration do I need to do to allow my local machine to resolve Cloud DNS addresses?
dns
google-cloud-platform vpn openvpn google-cloud-dns asked Nov 20 at 16:33
Jacob Smith
14
I have not verified this but I do not believe that you can reach the internal DNS server from outside the VPC. What you are trying to configure is split-brain DNS resolution. From you desktop:dig www.google.com 169.254.169.254ornslookup www.google.com 169.254.169.254. If this fails that my assumption is correct. In that case you would need to setup a DNS server inside your VPC and then point your nameserver to that server's IP.
– John Hanley
Nov 20 at 17:50
Tip: I run into this situation often with customers. I wrote a simple python program that dumps the internal DNS server's entries to a file. I then use that file for my local machine's host configuration. Not good for production use but does the job for my local machine's VPN connection.
– John Hanley
Nov 20 at 17:54
add a comment |
I'm trying to use Google Cloud Platform's Cloud DNS to resolve internal IPs of Compute Engine instances by DNS from my local machine. I was able to setup an OpenVPN server on an instance by following this guide: https://www.digitalocean.com/community/tutorials/how-to-set-up-an-openvpn-server-on-ubuntu-16-04
My VPN configuration successfully connects to the OpenVPN server, and allows me to ping internal IPs of my GCE instances. The instance hosting my OpenVPN server is able to resolve and ping cloud DNS entries, but my client local machine is unable to do the same.
Here's the content of my /etc/resolve.conf file after connecting to the VPN server.
search openvpn
nameserver 169.254.169.254
What additional configuration do I need to do to allow my local machine to resolve Cloud DNS addresses?
dns
google-cloud-platform vpn openvpn google-cloud-dns asked Nov 20 at 16:33
Jacob Smith
14
I'm trying to use Google Cloud Platform's Cloud DNS to resolve internal IPs of Compute Engine instances by DNS from my local machine. I was able to setup an OpenVPN server on an instance by following this guide: https://www.digitalocean.com/community/tutorials/how-to-set-up-an-openvpn-server-on-ubuntu-16-04
My VPN configuration successfully connects to the OpenVPN server, and allows me to ping internal IPs of my GCE instances. The instance hosting my OpenVPN server is able to resolve and ping cloud DNS entries, but my client local machine is unable to do the same.
Here's the content of my /etc/resolve.conf file after connecting to the VPN server.
search openvpn
nameserver 169.254.169.254
What additional configuration do I need to do to allow my local machine to resolve Cloud DNS addresses?
dns
google-cloud-platform vpn openvpn google-cloud-dns dns
google-cloud-platform vpn openvpn google-cloud-dns asked Nov 20 at 16:33
Jacob Smith
14
asked Nov 20 at 16:33
Jacob Smith
14
asked Nov 20 at 16:33
Jacob Smith
14
asked Nov 20 at 16:33
Jacob Smith
14
asked Nov 20 at 16:33
Jacob Smith
14
14
I have not verified this but I do not believe that you can reach the internal DNS server from outside the VPC. What you are trying to configure is split-brain DNS resolution. From you desktop:dig www.google.com 169.254.169.254ornslookup www.google.com 169.254.169.254. If this fails that my assumption is correct. In that case you would need to setup a DNS server inside your VPC and then point your nameserver to that server's IP.
– John Hanley
Nov 20 at 17:50
Tip: I run into this situation often with customers. I wrote a simple python program that dumps the internal DNS server's entries to a file. I then use that file for my local machine's host configuration. Not good for production use but does the job for my local machine's VPN connection.
– John Hanley
Nov 20 at 17:54
add a comment |
I have not verified this but I do not believe that you can reach the internal DNS server from outside the VPC. What you are trying to configure is split-brain DNS resolution. From you desktop:dig www.google.com 169.254.169.254ornslookup www.google.com 169.254.169.254. If this fails that my assumption is correct. In that case you would need to setup a DNS server inside your VPC and then point your nameserver to that server's IP.
– John Hanley
Nov 20 at 17:50
Tip: I run into this situation often with customers. I wrote a simple python program that dumps the internal DNS server's entries to a file. I then use that file for my local machine's host configuration. Not good for production use but does the job for my local machine's VPN connection.
– John Hanley
Nov 20 at 17:54
I have not verified this but I do not believe that you can reach the internal DNS server from outside the VPC. What you are trying to configure is split-brain DNS resolution. From you desktop:
dig www.google.com 169.254.169.254 or nslookup www.google.com 169.254.169.254. If this fails that my assumption is correct. In that case you would need to setup a DNS server inside your VPC and then point your nameserver to that server's IP.– John Hanley
Nov 20 at 17:50
I have not verified this but I do not believe that you can reach the internal DNS server from outside the VPC. What you are trying to configure is split-brain DNS resolution. From you desktop:
dig www.google.com 169.254.169.254 or nslookup www.google.com 169.254.169.254. If this fails that my assumption is correct. In that case you would need to setup a DNS server inside your VPC and then point your nameserver to that server's IP.– John Hanley
Nov 20 at 17:50
Tip: I run into this situation often with customers. I wrote a simple python program that dumps the internal DNS server's entries to a file. I then use that file for my local machine's host configuration. Not good for production use but does the job for my local machine's VPN connection.
– John Hanley
Nov 20 at 17:54
Tip: I run into this situation often with customers. I wrote a simple python program that dumps the internal DNS server's entries to a file. I then use that file for my local machine's host configuration. Not good for production use but does the job for my local machine's VPN connection.
– John Hanley
Nov 20 at 17:54
add a comment |
1 Answer
1
active
oldest
votes
In Compute Engine, DNS resolution is performed against the metadata server, which always has IP 169.254.169.254. The issue arises from the fact that this IP is link-local and is non-routable, thus will not work over VPN/IPSEC.
There are a few solutions/workarounds for it:
You could map all internal GCE instances IPs in the hosts files of the servers in your private network - the drawback is that the process is manual and time-consuming depending on how many instances you have.
The second option would be an internal GCE server (internal resolver) running a DNS server which could cross networks. More information on this is available in this documentation.
answered Nov 21 at 22:01
Md Zubayer
1096
add a comment |
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53397483%2fcloud-dns-with-openvpn-not-resolving-on-client%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
In Compute Engine, DNS resolution is performed against the metadata server, which always has IP 169.254.169.254. The issue arises from the fact that this IP is link-local and is non-routable, thus will not work over VPN/IPSEC.
There are a few solutions/workarounds for it:
You could map all internal GCE instances IPs in the hosts files of the servers in your private network - the drawback is that the process is manual and time-consuming depending on how many instances you have.
The second option would be an internal GCE server (internal resolver) running a DNS server which could cross networks. More information on this is available in this documentation.
answered Nov 21 at 22:01
Md Zubayer
1096
add a comment |
In Compute Engine, DNS resolution is performed against the metadata server, which always has IP 169.254.169.254. The issue arises from the fact that this IP is link-local and is non-routable, thus will not work over VPN/IPSEC.
There are a few solutions/workarounds for it:
You could map all internal GCE instances IPs in the hosts files of the servers in your private network - the drawback is that the process is manual and time-consuming depending on how many instances you have.
The second option would be an internal GCE server (internal resolver) running a DNS server which could cross networks. More information on this is available in this documentation.
answered Nov 21 at 22:01
Md Zubayer
1096
add a comment |
In Compute Engine, DNS resolution is performed against the metadata server, which always has IP 169.254.169.254. The issue arises from the fact that this IP is link-local and is non-routable, thus will not work over VPN/IPSEC.
There are a few solutions/workarounds for it:
You could map all internal GCE instances IPs in the hosts files of the servers in your private network - the drawback is that the process is manual and time-consuming depending on how many instances you have.
The second option would be an internal GCE server (internal resolver) running a DNS server which could cross networks. More information on this is available in this documentation.
answered Nov 21 at 22:01
Md Zubayer
1096
In Compute Engine, DNS resolution is performed against the metadata server, which always has IP 169.254.169.254. The issue arises from the fact that this IP is link-local and is non-routable, thus will not work over VPN/IPSEC.
There are a few solutions/workarounds for it:
You could map all internal GCE instances IPs in the hosts files of the servers in your private network - the drawback is that the process is manual and time-consuming depending on how many instances you have.
The second option would be an internal GCE server (internal resolver) running a DNS server which could cross networks. More information on this is available in this documentation.
answered Nov 21 at 22:01
Md Zubayer
1096
answered Nov 21 at 22:01
Md Zubayer
1096
answered Nov 21 at 22:01
Md Zubayer
1096
answered Nov 21 at 22:01
Md Zubayer
1096
1096
add a comment |
add a comment |
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Some of your past answers have not been well-received, and you're in danger of being blocked from answering.
Please pay close attention to the following guidance:
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53397483%2fcloud-dns-with-openvpn-not-resolving-on-client%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
I have not verified this but I do not believe that you can reach the internal DNS server from outside the VPC. What you are trying to configure is split-brain DNS resolution. From you desktop:
dig www.google.com 169.254.169.254ornslookup www.google.com 169.254.169.254. If this fails that my assumption is correct. In that case you would need to setup a DNS server inside your VPC and then point your nameserver to that server's IP.– John Hanley
Nov 20 at 17:50
Tip: I run into this situation often with customers. I wrote a simple python program that dumps the internal DNS server's entries to a file. I then use that file for my local machine's host configuration. Not good for production use but does the job for my local machine's VPN connection.
– John Hanley
Nov 20 at 17:54