VPN client and Google domains

[Antibiotic]

@stephenw10 Tried from pfsense DNS lookup to google.com and received - Host "google.com" could not be resolved but bing.com OK!

[stephenw10]

Try it against a different DNS server: dig @8.8.8.8 google.com

Seems like maybe your VPN providers DNS servers are doing something.

[Antibiotic]

@stephenw10 This is result

[stephenw10]

OK so it resolves fine against 8.8.8.8.
So what is it trying to resolve against that's failing? The VPN providers servers?

[Antibiotic]

@stephenw10 Idk just have working VPN client on pfsense from ExpressVPN. But this Google crying))) Looks like Google thinking that my Laptop dont have working DNS but I'm not expert))

[Antibiotic]

@stephenw10 I tried from Laptop with native VPN client connected and Youtube start working . But wanna use on pfsense for whole home network with Google domains in working condition. This disaster did my day today)))

[stephenw10]

Ok so check what the clients are using for DNS. It would normally be the pfSense LAN IP address.

Check what DNS servers pfSense is using in Diag > DNS Lookup.

If you set Unbound to localhost did you also set it to forwarding mode?

Is the VPN client setting itself as the default route when it connects?

[Antibiotic]

@stephenw10 said in VPN client and Google domains:

Ok so check what the clients are using for DNS. It would normally be the pfSense LAN IP address.
Check what DNS servers pfSense is using in Diag > DNS Lookup.
If you set Unbound to localhost did you also set it to forwarding mode?
Is the VPN client setting itself as the default route when it connects?

1. Client using pfSense LAN IP
2. Pfsense using 127.0.0.1 as DNS server
3. Negative, Unbound not in forwarding mode
4. Default route gateway is my ISP gateway if talking about System/routing settings
   

[Antibiotic]

@stephenw10

[Antibiotic]

@stephenw10

[stephenw10]

Ok, then Unbound is going to using the default route for resolving which is directly via the WAN and not via the VPN. Unless your VPN wasn't connected when you checked that?
So I would expect a DNS leak test to show the WAN IP and not the VPN.

However it should still be able to resolve google via either route. You might try turning up the logging level in unbound and check for errors.

Did this just start happening?

[Antibiotic]

@stephenw10 I don' t have any leakages and don not see any errors in log

[Antibiotic]

@stephenw10

[Antibiotic]

@stephenw10 VPN all time was connected

[stephenw10]

Ok, then your default route must switch when the client connects. Which is expected with the gateway set to automatic like that if the OpenVPN config doesn't expressly prevent it.
However Unbound should still be able to resolve via either route.

You probably need to turn up the logging level further to see query level logs.

You might try disabling IPSec and see if that allows it to resolve though.

Steve

[Antibiotic]

@stephenw10 Solved by set in firewall rule( Lan traffic to ExpressVpn) default gateway to ExpressVpn. Thank you for your assistance. Have a good weekend!