[feature request] OpenVPN: register assigned client IPs on an DNS server

[AngusMcGyver]

Important notices

Before you add a new report, we ask you kindly to acknowledge the following:

• I have read the contributing guidelines at https://github.com/opnsense/core/blob/master/CONTRIBUTING.md
• I am convinced that my issue is new after having checked both open and closed issues at https://github.com/opnsense/core/issues?q=is%3Aissue

Is your feature request related to a problem? Please describe.

I’m using OPNsense as my firewall/router and want remote OpenVPN clients to have their dynamic assigned IP addresses automatically registered in my internal DNS server, so i can access them via name. For example to run backup from server side.

Describe the solution you like

Add a script which sends DNS update massages to a specified DNS server when client diss-/connects.
Add config options to the OpenVPN instance menu.

Describe alternatives you considered

Install OpenVPN on an extra device and run scripts there to do this.

[Monviech]

I would recommend using Client Specific Overrides for clients that should always get the same IP address assigned.

Then you can create static A records inside your Nameserver.

Problem solved, nice and clean.

[AngusMcGyver]

Hi thanks for response,

I already considered that and came to the conclusion it is not feasible for my situation and doesn't scale.
Maybe i should have to write a bit more context. Guess thats my fault, sorry for that.

We have ~100 users which are using VPN gateway on multiple entrypoints within the company (each office). If i have to assign a dedicated IP address to every device on every entrypoint this is to much work. Additionally not everyone who onborads new devices in company will have access to the opnsense configuration for obvious reasons.

Another problem, these devices are from time to time also in internal LAN without VPN and they get an address from DHCP here. Which means a static A record would not point to the correct address anymore.

Any other dynamic scalable suggestions to deal with this situation?

Again, thanks for help.

[Monviech]

So the main issue you have is that there are clients that run some sort of backup agent, and your backup server needs a target (in this case a hostname) to trigger backup jobs consistently regardless in which network the client currently is?

[AngusMcGyver]

Thats only one example, why name resolution is a good idea. There are more use cases.

• We use NFS4 mounts with Kerberos authentication. This needs reverse resolution of the IP address to verify tickets.
• We also use Ansible to manage clients, which uses name resolution to access them.
• If someone needs support on his device its way more easier to ask for a device name on phone then asking for an ip address, especially ipv6.

[Monviech]

The way you are currently hooking into learn-address and also implementing essentially a custom RFC2136 client feels pretty fragile too. We just implemented the whole Kea DDNS server and it had quite a bunch of edge cases, and that is supported by a larger company who maintains it.

It feels like there should be a simpler solution.

Did you think about always enforcing an OpenVPN connection (always-on VPN) regardless of the current network for the ressources that should be accessed?

You could then also create a workflow, e.g. an external on boarding script, that uses the API of OPNsense and of your authoritative nameserver to create a CSO and a static A-Record, and during offboarding removing them.

What you essentially need is a consistent network identity.

[AngusMcGyver]

The way you are currently hooking into learn-address and also implementing essentially a custom RFC2136 client feels pretty fragile too

I can see the point. My thought process here was not to use 3rd party python libs or CLI tools like nsupdate, which are not on opnsense already. If thats no problem, changes can be made.
I want to avoid patching my own instances after every update with this basic DHCP feature, which I'm currently doing. OpenVPN acts as a DHCP server here.

Another idea i found in forum https://forum.opnsense.org/index.php?topic=49541.msg251516#msg251516 but without response.
I worked with Cisco VPN in the past. They have an option to use DHCP relay and forward the IP finding process of the client to a DHCP server. The DHCP will register the IP at the DNS server and everything is fine. Is that possible for OpenVPN?

Did you think about always enforcing an OpenVPN connection (always-on VPN) regardless of the current network for the ressources that should be accessed?

This doesn't solve the multiple entrypoint situation, where clients have multiple static A records then. It also creates an additional risk to people in office. If something goes wrong with openvpn, at least only roadwarriors are affected by this.

[Monviech]

Using KEA would definitely be the best possible outcome since it already provides all primitives that you need, e.g. fully maintained DDNS support by core.

I don't know if OpenVPN supports a DHCP relay, best check the official docs.

I know from past experiences that some used TAP instead of TUN to use DHCP, but TAP shouldn't be used anymore since its deprecated by OpenVPN themselves and already removed from the most modern of their clients.

[AngusMcGyver]

I did a bit more research in OpenVPN documentation and github issues. DHCP relay seems to not exist.

For pushing the IP address to DNS, they recommend using custom script via learn-address, which is exactly that what I'm trying to do here.
It is reasonable that you don't want to keep maintaining a script from a random guy in the internet. I may disagree with the opinion that a static A/AAAA record is better the an DHCP update. And i see this as a feature others will use as well, but hey its your project, i can respect that. Thanks for your time and great work.

Would you consider accepting a pull request, to update the ovpn_event.py, so it will also run custom scripts under, lets say /var/etc/openvpn/learn-address.d/ or /var/etc/openvpn/learn-address-{instance-id}.d/ instead?
This way you are not responsible for scripts users put there and the OpenVPN feature to run custom scripts will be implemented too.

[Monviech]

I will tag @AdSchellevis to answer if such an include folder is viable or not.

[AdSchellevis]

Currently not very excited to add a hook there as learn-address is rather fragile, which is also why we had to debounce events in #9843

You can always just query the api periodically and use the output offered from there or try to use a tap interface to run openvpn in L2 mode. But realistically this doesn't fit community support scope.

[AngusMcGyver]

I can't see whats fragile on the official OpenVPN way to run custom scripts on client connection, but you guys have more inside then me. As said before, I'm running this for a while now with no problems.

The intention here was to just get ride of the manual patching process after every system update and offer a useful feature for everyone. If you don't want it, fine for me. I'm sure I will find a way to auto patch it.

Thanks again for time and help.

[AdSchellevis]

I can't see whats fragile on the official OpenVPN way to run custom scripts on client connection, but you guys have more inside then me. As said before, I'm running this for a while now with no problems.

It has locking behavior on other sessions