Connection Logs in the Client

Oct 13, 2025 by wbrum.org 117 views

Introduction

In this article, we will explore a peculiar issue where a custom DNS is recognized and added successfully in iOS, but not used for routing traffic. This problem is particularly relevant for users who rely on custom DNS configurations for their VPN connections.

Describe the Bug

When connecting to a VPN with a configuration file that defines a custom DNS on a MacBook, everything works great. All traffic goes through the DNS. However, on iOS using the same configuration file, the DNS is recognized and NSLOOKUP's show the desired records, but the gateway used seems to be different.

To Reproduce

To reproduce this issue, we will use the OpenVPN config files from Mullvad intended to be used with Tunnelblick. The relevant details are provided in the additional context below.

Expected Behavior

On iOS, the traffic should be routed through the recognized DNS with the record.

Version Information

OS: iOS 18.3.1
OpenVPN version: 2.5.1 (6211)

Additional Context

Relevant lines of configuration file:

client
dev tun
resolv-retry infinite
nobind
persist-key
persist-tun
verb 3
remote-cert-tls server
ping 10
ping-restart 60
sndbuf 524288
rcvbuf 524288
cipher AES-256-GCM
tls-cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384
proto udp
auth-user-pass # modified to no longer point to a file
script-security 2
fast-io
remote-random
remote 193.32.127.81 1195 # ch-zrh-ovpn-001
remote 81.17.16.66 1195 # ch-zrh-ovpn-202
remote 193.32.127.82 1195 # ch-zrh-ovpn-002
remote 146.70.134.162 1195 # ch-zrh-ovpn-502
remote 146.70.134.130 1195 # ch-zrh-ovpn-501
remote 193.32.127.83 1195 # ch-zrh-ovpn-003
remote 46.19.140.194 1195 # ch-zrh-ovpn-201
# all of the above is from mullvad, with one exception (noted)

# this is my DNS, I want it to use a local DNS I run Pi-Hole on
dhcp-option DNS 192.168.1.35

<ca>
-----BEGIN CERTIFICATE-----
<mycert>
-----END CERTIFICATE-----
</ca>

Connection Logs in the Client

The connection logs in the client are provided below:

[Mar 13, 2025, 00:13:58] START CONNECTION

[Mar 13, 2025, 00:13:58] ----- OpenVPN Start -----
OpenVPN core 3.10.5 ios arm64 64-bit

[Mar 13, 2025, 00:13:58] OpenVPN core 3.10.5 ios arm64 64-bit

[Mar 13, 2025, 00:13:58] Frame=512/2112/512 mssfix-ctrl=1250

[Mar 13, 2025, 00:13:58] NOTE: This configuration contains options that were not used:

[Mar 13, 2025, 00:13:58] Unsupported option (ignored)

[Mar 13, 2025, 00:13:58] 0 [resolv-retry] [infinite]

[Mar 13, 2025, 00:13:58] 1 [persist-key]

[Mar 13, 2025, 00:13:58] 2 [persist-tun]

[Mar 13, 2025, 00:13:58] EVENT: RESOLVE

[Mar 13, 2025, 00:13:58] Contacting 146.70.134.162:1195 via UDP

[Mar 13, 2025, 00:13:58] EVENT: WAIT

[Mar 13, 2025, 00:13:58] Connecting to [146.70.134.162]:1195 (146.70.134.162) via UDP

[Mar 13, 2025, 00:13:58] EVENT: CONNECTING

[Mar 13, 2025, 00:13:58] Tunnel Options:V4,dev-type tun,link-mtu 1521,tun-mtu 1500,proto UDPv4,cipher AES-256-GCM,auth [null-digest],keysize 256,key-method 2,tls-client

[Mar 13, 2025, 00:13:58] Creds: Username/Password

[Mar 13, 2025, 00:13:58] Sending Peer Info:
IV_VER=3.10.5
IV_PLAT=ios
IV_NCP=2
IV_TCPNL=1
IV_PROTO=2974
IV_MTU=1600
IV_CIPHERS=AES-128-CBC:AES-192-CBC:AES-256-CBC:AES-128-GCM:AES-192-GCM:AES-256-GCM:CHACHA20-POLY1305
IV_SSO=webauth,crtext


[Mar 13, 2025, 00:13:58] VERIFY OK: depth=2, /C=SE/ST=Gotaland/L=Gothenburg/O=Amagicom AB/OU=Mullvad/CN=Mullvad Root CA v2/emailAddress=security@mullvad.net, signature: RSA-SHA256

[Mar 13, 2025, 00:13:58] VERIFY OK: depth=1, /C=SE/ST=Gotaland/O=Amagicom AB/OU=Mullvad/CN=Mullvad Intermediate CA v7/emailAddress=security@mullvad.net, signature: RSA-SHA256

[Mar 13, 2025, 00:13:58] VERIFY OK: depth=0, /C=SE/ST=Gotaland/O=Amagicom AB/OU=Mullvad/CN=ch-zrh-ovpn-502.mullvad.net/emailAddress=security@mullvad.net, signature: RSA-SHA256

[Mar 13, 2025, 00:13:58] SSL Handshake: peer certificate: CN=ch-zrh-ovpn-502.mullvad.net, 4096 bit RSA, cipher: TLS_CHACHA20_POLY1305_SHA256   TLSv1.3 Kx=any      Au=any   Enc=CHACHA20/POLY1305(256) Mac=AEAD


[Mar 13, 2025, 00:13:58] Session is ACTIVE

[Mar 13, 2025, 00:13:58] EVENT: GET_CONFIG

[Mar 13, 2025, 00:13:58] Sending PUSH_REQUEST to server...

[Mar 13, 2025, 00:13:59] Sending PUSH_REQUEST to server...

[Mar 13, 2025, 00:13:59] OPTIONS:
0 [redirect-gateway] [def1] [bypass-dhcp] [bypass-dns] [autolocal]
1 [dhcp-option] [DNS] [192.168.1.35]
2 [dhcp-option] [DNS] [10.9.0.1]
3 [redirect-gateway] [def1] [bypass-dhcp]
4 [route-ipv6] [0000::/2]
5 [route-ipv6] [4000::/2]
6 [route-ipv6] [8000::/2]
7 [route-ipv6] [C000::/2]
8 [route-gateway] [10.9.0.1]
9 [topology] [subnet]
10 [socket-flags] [TCP_NODELAY]
11 [ifconfig-ipv6] [fdda:d0d0:cafe:1195::100b/64] [fdda:d0d0:cafe:1195::]
12 [ifconfig] [10.9.0.13] [255.255.0.0]
13 [peer-id] [11]
14 [cipher] [AES-256-GCM]
15 [protocol-flags] [cc-exit] [tls-ekm] [dyn-tls-crypt]
16 [tun-mtu] [1500]


[Mar 13, 2025, 00:13:59] PROTOCOL OPTIONS:
  cipher: AES-256-GCM
  digest: none
  key-derivation: TLS Keying Material Exporter [RFC5705]
  compress: NONE
  peer ID: 11
  control channel: dynamic tls-crypt enabled


[Mar 13, 2025, 00:13:59] EVENT: ASSIGN_IP

[Mar 13, 2025, 00:13:59] NIP: preparing TUN network settings

[Mar 13, 2025, 00:13:59] NIP: init TUN network settings with endpoint: 146.70.134.<br/>
**DNS Adds Successfully but Not Used in iOS: Q&A**
=====================================================

**Q: What is the issue with the custom DNS configuration in iOS?**
----------------------------------------------------------------

A: The issue is that the custom DNS configuration is recognized and added successfully in iOS, but not used for routing traffic. This means that even though the DNS is available, it is not being used to resolve domain names.

**Q: What are the symptoms of this issue?**
--------------------------------------------

A: The symptoms of this issue include:

* The custom DNS configuration is recognized and added successfully in iOS.
* NSLOOKUP's show the desired records, but the gateway used seems to be different.
* The first visit in the route while on VPN is the VPN's gateway (10.9.0.1), whereas off the VPN it just directly uses the IP address of the DNS (192.168.1.35).

**Q: What are the possible causes of this issue?**
------------------------------------------------

A: The possible causes of this issue include:

* **Incorrect configuration**: The configuration file may be incorrect or incomplete, which can prevent the custom DNS from being used.
* **iOS limitations**: iOS may have limitations or restrictions that prevent the custom DNS from being used.
* **VPN configuration**: The VPN configuration may be incorrect or incomplete, which can prevent the custom DNS from being used.

**Q: How can I troubleshoot this issue?**
--------------------------------------------

A: To troubleshoot this issue, you can try the following:

* **Check the configuration file**: Verify that the configuration file is correct and complete.
* **Check the VPN configuration**: Verify that the VPN configuration is correct and complete.
* **Check iOS settings**: Verify that the iOS settings are correct and complete.
* **Check the DNS settings**: Verify that the DNS settings are correct and complete.

**Q: How can I resolve this issue?**
--------------------------------------

A: To resolve this issue, you can try the following:

* **Update the configuration file**: Update the configuration file to include the correct DNS settings.
* **Update the VPN configuration**: Update the VPN configuration to include the correct DNS settings.
* **Update iOS settings**: Update the iOS settings to include the correct DNS settings.
* **Reset the DNS settings**: Reset the DNS settings to their default values.

**Q: What are the best practices for configuring custom DNS in iOS?**
-------------------------------------------------------------------

A: The best practices for configuring custom DNS in iOS include:

* **Use a reliable DNS provider**: Use a reliable DNS provider that is known for its accuracy and speed.
* **Use a secure DNS protocol**: Use a secure DNS protocol such as DNS over HTTPS (DoH) or DNS over TLS (DoT).
* **Verify the DNS settings**: Verify the DNS settings to ensure that they are correct and complete.
* **Test the DNS settings**: Test the DNS settings to ensure that they are working correctly.

**Q: What are the common mistakes to avoid when configuring custom DNS in iOS?**
-------------------------------------------------------------------------

A: The common mistakes to avoid when configuring custom DNS in iOS include:

* **Incorrect DNS settings**: Incorrect DNS settings can prevent the custom DNS from being used.
* **Incomplete DNS settings**: Incomplete DNS settings can prevent the custom DNS from being used.
* **Incorrect VPN configuration**: Incorrect VPN configuration can prevent the custom DNS from being used.
* **Incorrect iOS settings**: Incorrect iOS settings can prevent the custom DNS from being used.