0

I have a VPN that I connect to via domain name, not via IP. (with OpenVPN, in Debian)

VPN's IP is dynamic, can change any moment, by design, out of my control. I want my machine's only communication with the internet, on everything except tun0, to be my.vpn.domain.com (via OpenDNS I guess) and nothing else. No leaks.

Right now I manually check for a valid vpn IP from the domain, and I use iptables / ufw to make the appropriate limitations. But I need a fully automatic (re)connecting solution.

I think the only option is to use an Application Layer (layer 7) solution, since iptables (layer 3+4) can't deal with domain resolution. It seems I want something that uses OpenDNS to automatically get the IP for the VPN while also having no other leaks like mentioned up top.

How can we achieve this? I can do this with PFSense, but I can't use PFSense.

  • How do you intend to resolve my.vpn.domain if no DNS requests are allowed (except to my.vpn.domain which doesn't make sense, though)? – Hauke Laging Apr 7 '18 at 23:18
  • I did write in the rest of the question the general intention to obtain an IP from the domain name, via OpenDNS, as it goes when you have a dynamic host. – Spectraljump Apr 8 '18 at 9:32
0

I guess the solution is to have a script which does

  1. the name resolution
  2. the modification of Netfilter / the routing table

and integrate this script in the start procedure of OpenVPN. This may be done

  1. with the OpenVPN-internal scripts (--up)
  2. outside OpenVPN in its start script (e.g. ExecStartPre= in systemd)

I am not sure about the first case but I assume that in both cases it is necessary (ur at least useful) to prevent OpenVPN from retrying to establish the connection after the tunnel broke (or at least limit the time used for retries).

In both cases it is necessary to have openvpn restarted from outside, e.g. with Restart=always in the systemd unit file.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.