Filtering out pushed options

Starting with OpenVPN 2.4, it is now possible to filter out options pushed from the OpenVPN server to the client. This allows users to have more control over the network routes and addresses that are pushed from the server.

This recipe will show how this new feature of OpenVPN works.

Getting ready

We will use the following network layout:

Getting ready

Set up the client and server certificates using the first recipe from Chapter 2Client-server IP-only Networks. For this recipe, the server computer was running CentOS 6 Linux and OpenVPN 2.3.12. The client was running Windows 7 64 bit and OpenVPN 2.4_alpha2. For the server, keep the configuration file, example9-2-server.conf, from the Linux - using pull-resolv-conf recipe, from Chapter 9OS Integration at hand. For the client, keep the configuration file, basic-udp-client.ovpn, from the Using an ifconfig-pool block recipe from Chapter 2Client-server IP-only Networks.

How to do it...

  1. Start the server:
    [root@server]# openvpn --config example9-2-server.conf
    
  2. Append the following line to the client configuration file, basic-udp-client.ovpn, and save it as example10-11.ovpn:
            pull-filter ignore "dhcp-option DNS" 
    
  3. Start the client:
    How to do it...
  4. View the client log file by selecting View Log in the OpenVPN GUI. The log file will contain lines similar to the following:
            PUSH: Received control message: 'PUSH_REPLY,dhcp-option DNS
            192.168.3.1,route-gateway 10.200.0.1,topology subnet,ping 
            10,ping-restart 60,ifconfig 10.200.0.2 255.255.255.0' 
            Pushed option removed by filter: 'dhcp-option DNS 192.168.3.1' 
    
  5. Verify that the DNS settings on the client have not been altered using a tool such as ipconfig /all.

How it works...

The pull-filter directive accepts several parameters:

  • accept t: Accepts the pushed option t from the server
  • ignore t: Ignores the pushed option t from the server, but doesn't abort the connection
  • reject t: Rejects the pushed option t from the server and abort the VPN connection

Each option can be specified multiple times, with the last occurrence overriding earlier lines.

By adding the line pull-filter ignore "dhcp-option DNS" to the client configuration file, we ignore any pushed line that starts with dhcp-option DNS. Therefore, no DNS settings are accepted from the VPN server. This option can be applied to all options that are pushed from the server.

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset
3.141.7.186