OpenVPN DNS doesn't work on 4.2.1

Technical Support for Routers
1

I just upgraded to 4.2.1. on my MT-3000 and the DNS setting no longer are pulled down from the VPN server. I tested on multiple devices and was only able to fix by downgrading back to 4.2.

Anyone else see this problem?

2

What’s your VPN service provider? Could you paste the log? Do you use multiple-wan?

3

I’m using my own server (Asuswrt-Merlin 386.10). Here’s the config minus the certificates:

client
dev tun
proto udp
remote XXXXX
resolv-retry infinite
nobind
float
ncp-ciphers AES-256-GCM:AES-256-CBC:AES-128-GCM:AES-128-CBC
auth SHA256
keepalive 15 60
remote-cert-tls server

server-ipv6 2001:0db8:ee00:abcd::/64
tun-ipv6
push tun-ipv6
ifconfig-ipv6 2001:0db8:ee00:abcd::1 2001:0db8:ee00:abcd::2
push “route-ipv6 2001:0db8:ee00:ee00::2/64”
push “route-ipv6 2000::/3”
auth SHA256
tls-version-min 1.2
cipher AES-256-GCM
push “block-outside-dns”
push “dhcp-option DNS 208.67.222.222”
push “dhcp-option DNS 208.67.222.220”*

5

I have some similar issues. I think this might have to do with the Global Proxy and Auto Detect options, and how the Beryl is handling push options.

1 Like
6

Yes i have this exact issue will go back to the old firmware I guess.

7

I didn’t reproduce the issue. I tested an MT3000 with keep-setting sysupgrade from version 4.1.3 to 4.2.0 to 4.2.1.

Could you guys describe the configurations you made?
If use the version 4.2.1 setup from scratch, will it work?

8

Yes.

My OpenVPN server configuration has these lines:




push "route 192.168.50.0 255.255.255.0 vpn_gateway 500"
push "dhcp-option DOMAIN Workgroup"
push "dhcp-option DNS 192.168.50.1"
push "redirect-gateway def1"

In order, these tell the Beryl to route traffic to my server’s local lan through the tunnel; advertise my server’s dns server to the Beryl, and redirect the gateway to the server.

When the Beryl connects using “Auto Detect”, these server messages are logged:




BerylAX/ip.ip.ip.ip:35163 SENT CONTROL [BerylAX]: 'PUSH_REPLY,route 192.168.50.0 255.255.255.0 vpn_gateway 500,dhcp-option DOMAIN Workgroup,dhcp-option DNS 192.168.50.1,redirect-gateway def1,sndbuf 512000,rcvbuf 512000,route-gateway 10.16.0.1,topology subnet,ping 15,ping-restart 60,ifconfig 10.16.0.3 255.255.255.0,peer-id 1,cipher AES-256-GCM' (status=1)

BerylAX/ip.ip.ip.ip:35163 PUSH: Received control message: 'PUSH_REQUEST'

 BerylAX/ip.ip.ip.ip:48987 [BerylAX] Inactivity timeout (--ping-restart), restarting

I don’t have access at the moment to the Beryl log, but on its side I get three error messages about “no such program”. No traffic flows over the tunnel, all DNS and internet traffic go outside the tunnel.

If I use the same configurations and connect using “Global Proxy”, I do not get these error messages and traffic is directed over the tunnel. However, if on the Beryl side I include a “pull filter ignore” command, that is ignored.

I conclude that Global Proxy is inserting its own version of the pushed options, and that Auto Detect, instead of following the push options and the pull filter options, is not reading them. I cannot tell at the moment if it is processing the other pushed options, like sndbuf.

Hope that helps.

1 Like
9

I installed 4.2.1 from scratch and the DNS is working again!

10

It turns out a bug related to keep-setting sysupgrade:
run this command in the router terminal

cp /rom/etc/openvpn/scripts/ovpnclient-up /etc/openvpn/scripts/ovpnclient-up

and toggle the OpenVPN client for a temporary workaround.
Thank yo all for the feedback and info provided.

11

any news on a proper fix?

12

This issue has already been fixed in release 4.2.2 (mt3000) and release 4.2.1 (axt1800/ax1800).