Openvpn and unbound combined break dig command

• when doing DNS lookup against remote unbound server over OpenVPN connection
• results not coming back, or say "reply from unexpected source" 
• ping and ssh work fine

• fix unbound.conf 
• "interface" parameter -> local ip instead of "0.0.0.0"
• replies will have the local ip and not the OpenVPN ip now

Sample reply when still broken:

;; reply from unexpected source: 192.168.30.1#53, expected 172.30.1.54#53

OpenVPN version 2.3.2: using new easyrsa mechanism for multiple users

1. Server setup
1. ./easyrsa init-pki
1. don't do this twice!
2. ./easyrsa build-ca
2. User key and cert signing request on complete separate machine
1. ./easyrsa init-pki
1. don't do this twice!
2. ./easyrsa gen-req myuser
3. Server signs user cert req
1. ./easyrsa import-req myuser.req myuser
2. ./easyrsa sign-req client myuser

Generate your server key and cert in a similar manner to a user.

Any client with a signed cert may connect to the server. There is no record of the client cert on the server itself; since the server signed the user cert, that is authority enough to validate the user cert.

Only if a user cert needs to be revoked, is a "revocation file" created on the server; this revocation file disallows that user from connecting. If no users need to be revoked, nothing needs to be done, nothing needs to exist about users on the server-side.

https://community.openvpn.net/openvpn/wiki/EasyRSA3-OpenVPN-Howto

OpenVPN: push all LAN traffic through an OpenVPN client to the other side

1. Local variables for this post, adjust to fit your setup:
1. OpenVPN client server IP
1. 192.168.1.200
2. Remote network
1. 172.16.1.0/24

1. Add this to the client server that is using OpenVPN to connect to the remote server:
1. sudo iptables -A POSTROUTING -o tun0 -j MASQUERADE
2. as root user, do
1. echo 1 > /proc/sys/net/ipv4/ip_forward
2. Add this to your local computer 
1. Linux: 
1. ip route add 172.16.1.0/24 via 192.168.1.200
2. Mac:
1. route -n add 172.16.1.0/24 192.168.1.200

Now, you should be able to ping from your local computer, through the client machine, and to a server in the remote network. Once that works, try ssh.

NOTE: take a look at /etc/sysctl.conf if you want the ip_forward to last through reboots of client server: net.ipv4.ip_forward=1

OpenVPN on EC2/AWS

EC2 Instance

1. Allow UDP to port 1194 under the instance's security group
1. to the world 
2. or just your IP network

Install and configure OpenVPN instance/server

1. apt-get install openvpn
2. cd /etc/openvpn
3. openvpn --genkey --secret my.key
4. Put code below into /etc/openvpn/server.conf
5. Run: openvpn --config /etc/openvpn/server.conf
1. Leave running while taking remaining steps
6. Allow NAT
1. modprobe iptable_nat
2. echo 1 | sudo tee /proc/sys/net/ipv4/ip_forward
3. iptables -t nat -A POSTROUTING -s 192.168.2.0/24 -o eth0 -j MASQUERADE
7. Checks for the paranoid
1. lsof -nP -i
2. lsof -c openvpn

port 1194
proto udp
dev tun
secret /etc/openvpn/my.key
ifconfig 192.168.2.1 192.168.2.2
keepalive 10 120
comp-lzo
persist-key
persist-tun
status server-tcp.log
verb 3

1. If on Mac, use tunnelblick to open a file like myopenvpn.ovpn with below code
1. Replace hostname with yours
2. You'll need the my.key file in the same directory as the myopenvpn.ovpn file
2. On Linux
1. Put below in /etc/openvpn/client.conf
2. Put my.key in /etc/openvpn as well
3. Run: openvpn --config /etc/openvpn/client.conf
4. Leave running
3. For all operating systems
1. When/if you see this in the client connection logs/messages, you've made it
1. "Initialization Sequence Completed"
4. Confirm
1. You can ping 192.168.2.1, the openvpn server/instance via the ssh tunnel
2. You can ssh into the openvpn server/instance via 192.168.2.1
3. You have a new network interface with 192.168.2.2 defined on it
4. Goto: http://ipaddr.me
1. Does it look like your IP?
2. If uncertain, use "whois" command to find out

dev tun

proto udp

remote ec2-xxx-xxx-xxx-xxx.compute-1.amazonaws.com 1194

resolv-retry infinite

nobind

secret my.key

ifconfig 192.168.2.2 192.168.2.1

comp-lzo

verb 3

dhcp-option DNS 172.16.0.23

redirect-gateway def1