OpeVPN is a great tool to implement secure point to point connections.

But, often a single wrong step during the setup can break the connection and result in errors.

One such error in OpenVPN is “cannot resolve host address“.

At Bobcares, we help users resolve OpenVPN connection errors as part of our Managed VPN services.

Today, we’ll discuss the top 4 reasons for the error cannot resolve host address in OpenVPN and how we fix them.

Cannot resolve host address in OpenVPN – What this means?

Customers usually face this error when trying to make an OpenVPN connection. This error means that the DNS servers refused to resolve the hostname. Here, our Support Engineers check the server logs and detailed error looks like this:

2019-01-21 20:19:01 MANAGEMENT: >STATE:1489260308,RESOLVE,,,
2019-01-21 20:19:01 RESOLVE: Cannot resolve host address: vpn.xx.xx.xx.xx.com: nodename nor servname provided, or not known

Cannot resolve host address in OpenVPN – Causes & Fixes

Now, let’s see the main reasons for this error and how our Dedicated Engineers fix them.

1) Firewall restrictions

One of the common reasons for this error is customer’s local firewall blocking the connection to the OpenVPN server. Additionally, firewall rules can block the DNS connections on the system. Similarly, the Antivirus program installed on the customer’s system can also hamper the VPN functionality.

So, in such cases our Support Experts temporary disable the security applications and the Antivirus program one by one. Thus, we can determine which application is blocking the connections and fix it’s settings.

Moreover, we ensure to allow the following in firewall.

• Loop backup interface or hostname itself.
• Interface created by OpenVPN.
• UDP packets on port 53 for DNS queries.

In addition to that, we ensure that the ports required for the OpenVPN to communicate are included in the router settings.

2) Incorrect hostname

Similarly, a typo in the hostname or an inactive host specified in the OpenVPN settings can lead to this error.

Firstly, our Support Experts confirm whether the host is active using the ping command.

ping vpn.xx.xx.xx.xx.com

In addition to that, we check the DNS connectivity of the hostname using dig and nslookup commands.

dig vpn.xx.xx.xx.xx.com
nslookup vpn.xx.xx.xx.xx.com

In this way, we confirm that whether the customer uses a valid and correct hostname.

If we find any problems with the hostname, we’ll contact the customer and update them to use the correct hostname. Alternatively, we update the customer to use the explicit IP address instead of the domain name.

3) DNS servers

If that doesn’t work, this error can be caused by the DNS settings.

Sometimes, DNS servers doesn’t resolve the server name translating it to the IP address. This can be due to DNS spoofing in some countries that censor websites.  In other words, the DNS servers in these countries refuse to resolve the hostname or provide the wrong IP address leading to a dead link.

Our Support Experts easily fix this by helping the customer to switch the DNS servers on their computer to the ones outside the country. There are many free DNS servers available such as Google, OpenDNS, etc.

Google DNS : 8.8.8.8 and 8.8.4.4
OpenDNS server :  208.67.222.222 and 208.67.220.220

For example on a Mac system, we modify the DNS servers from System Preferences > Network > Select the connections through which you connect > Advanced > DNS > DNS servers > Update the new DNS servers > OK > Apply.

Most importantly, we update the customers to change the network adapter settings as well.

4) OpenVPN client configuration

Similarly, this error can also be caused by misconfigured OpenVPN client configuration. A sample OpenVPN configuration looks like this.

client
dev tun
proto tcp
remote vpn.xx.xx.xx.xx.com 1194 
resolv-retry infinite 
remote-cert-tls server 
nobind 
persist-key 
persist-tun
verb 3
pkcs12 D:\\{cert}.p12

A single wrong entry in this file can affect the working of the VPN service. In such cases, our Server Experts get the OpenVPN client configuration and correct the wrong entries to fix the issue. Sometimes, we need to switch the protocol from TCP to UDP in the configuration to fix the issue.

4) Incorrect host file entry

Also, incorrect entries in the /etc/hosts file of your system may result in this error. Ideally, the localhost entry should be in the /etc/hosts file of your system, so that localhost name can be resolved. Missing localhost entry or typo mistakes in this file will create problems.

Here, our Support Engineers get the /etc/hosts entry details from the customers and make sure that the first entry is given as below.

127.0.0.1 localhost

[And do you need a server expert to resolve your OpenVPN errors. Our Experienced System Experts can help you here.]

Conclusion

In short, “cannot resolve host address” error in OpenVPN can occur due to firewall restrictions, OpenVPN client configuration errors, and so on. Today, we’ve discussed the top 4 reasons for this error and how our Support Engineers fix them.