Can Strongswan add DNS records for clients?

[Kverulanthonsen]

Hi,

I have a dhcp server (isc-dhcpd) and a dns server (bind9) which is authoritative for my local network (jungle.net, 192.168.0.0/24).

When I connect a device to my network either by cable or wifi, the dhcp server gives out an IP address and also instructs the dns server to update its records with the new device. I can do
$ host -l jungle.net
and I get back all connected devices in this format:
Bens-iPhone.jungle.net has address 192.168.0.172

Now I have successfully set up a IKEv2 VPN server using strongswan. In my ipsec.conf I have this line
rightsourceip=192.168.0.240-192.168.0.254
to give vpn clients addresses in this range.

So far so good. When I connect my phone via the VPN I see that it gets the first available IP, 192.168.0.240, and I can reach it from other devices in the network, with ping for instance. However, the phone does not show up when I do host -l jungle.net and something like nslookup 192.168.0.140 also yields no results.

Is there a way to make strongswan register the clients with the dns server, similar to how the dhcp server works?

[tobiasbrunner]

There is nothing like that out of the box. But you could maybe script it (via updown or vici) or write a custom plugin for it.

[Kverulanthonsen]

Beautiful! I didn't know where to look, and you pointed me right to it! In case anyone is interested, here is what I did:

Make a copy of /usr/lib/ipsec/_updown, I copied it to /usr/local/lib/updown.local (the original _updown script will be overwritten if strongswan is updated, hence the copy).

In /etc/ipsec.conf, add the line
leftupdown="/usr/local/lib/updown.local" (in the "conn" section).
In the updown.local script, add the following two lines in the relevant sections (excluding the arrows):

case "$PLUTO_VERB:$1" in
up-host:)
        # connection to me coming up
        # If you are doing a custom version, firewall commands go here.
        ;;
down-host:)
        # connection to me going down
        # If you are doing a custom version, firewall commands go here.
        ;;
up-client:)
        # connection to my client subnet coming up
        # If you are doing a custom version, firewall commands go here.
        /usr/local/bin/dns-addrecord $PLUTO_XAUTH_ID $PLUTO_PEER_SOURCEIP             <-------------------
        ;;
down-client:)
        # connection to my client subnet going down
        # If you are doing a custom version, firewall commands go here.
        /usr/local/bin/dns-deleterecord $PLUTO_XAUTH_ID $PLUTO_PEER_SOURCEIP          <-------------------
        ;;

This invokes my dns-scripts with the connecting username and IP as parameters. I looked at all the PLUTO_*** variables available to the updown script, and I don't find anything other than the username that can be used as a dns entry. So, I have changed /etc/ipsec.secrets like this:

: RSA "server-key.pem"
vpn-iphone : EAP "************"

I will add new credentials, vpn-laptop, vpn-work etc as needed. Now, when I connect my phone I can do:

$ nslookup vpn-iphone
Server:         127.0.0.1
Address:        127.0.0.1#53

Name:   vpn-iphone.jungle.net
Address: 192.168.0.240

Of course you will need working dns-addrecord and dns-deleterecord scripts. I didn't include them as it's off topic for this forum, but if anyone is interested I'll be happy to share them.