Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    No local DNS

    Scheduled Pinned Locked Moved
    OpenVPN
    3
    9
    749
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      madbrain
      last edited by

      I setup OpenVPN with 2.6CE according to https://www.comparitech.com/blog/vpn-privacy/openvpn-server-pfsense/ .

      The problem I have is no local DNS resolution works on my client.

      This seems to be a relatively common issue, per for example this lengthy
      thread : https://forum.netgate.com/topic/143173/openvpn-works-but-no-local-dns .

      I couldn't figure out what I'm doing wrong. I'm a newbie with pfSense (about 1 month), so please be gentle. I'm sure I'm missing something in the configuration somehow.

      361c1790-affa-42fd-90b5-5d9fcc04606b-image.png

      dc6fca37-9a6e-4cdd-8e0c-b156583165e7-image.png

      18f65cb3-d993-4de4-80c1-14056f9f46d3-image.png

      5ecf6064-0817-4b64-a86f-2e5635b0ebae-image.png

      6c5bbcd9-6abb-423a-bf34-cf6c3fa00c31-image.png

      8321bed3-01ef-46f9-a154-5bca6e6ab590-image.png

      c9e5a9b0-139b-4174-9302-4c904a8d584b-image.png

      b5f4de7a-bf5d-4d92-83d9-0f19d7942117-image.png

      94685bb9-7438-4f89-860f-a1b454189245-image.png

      2ed63b65-60af-4636-b94d-8b91bfc9ff02-image.png

      As you can see in the screenshots, I'm specifying a DNS server in the Advanced client settings.
      I have tried the IP of the OpenVPN interface, or the LAN interface, and using both of these result in no DNS resolution at all on my client.

      If I don't set a DNS server, I can resolve Internet DNS names (subject of this thread) but not local ones.

      My client is OpenVPN Connect on Android (Galaxy S22 Ultra). My client can ping the IP of the LAN and OpenVPN interfaces respectively, 192.168.100.1 and 192.168.101.1 .

      One user in the discussion mentioned the guide had a firewall rule that allowed only TCP, but this is not the case for me, my outgoing rule allows "any" protocol.

      I'm really stumped by this and would appreciate help from the experts.

      GertjanG 1 Reply Last reply Reply Quote 0
      • GertjanG
        Gertjan @madbrain
        last edited by

        Your very first image, very first line already shows an issue.

        Compare :

        65ed10f7-29c5-4794-a74a-d4c9fdf93a24-image.png

        with what you saw here :

        @madbrain said in No local DNS:

        https://www.comparitech.com/blog/vpn-privacy/openvpn-server-pfsense/

        a359ffd8-8d5e-4048-b2b6-42b2aeced8fe-image.png

        True, you could type anything here :

        732bdc61-f678-40da-a756-fd24ec27cade-image.png

        but, if you're not sure : use home.arpa.

        @madbrain said in No local DNS:

        I'm specifying a DNS server in the Advanced client settings

        192.168.101.1 => ok - just to be sure, go to Services > DNS Resolver > General Settings and make sure that unbound actually listens to "all" interfaces :

        0da0f6ca-fe19-40be-86f4-c1eac2f562ef-image.png

        Did you notice that there is no interface called "OpenVPN", but I have an interface called "OPENVPN".

        Mainly because I used the official Netgate OpenVPN video (Youtube, the Netgate channel).
        There are several OpenVPN server video's. I advise you to watch them all, even the older ones.

        What I did : Interfaces > Interface Assignments and assigned the 'ovpncx' to a 'real' interface.

        d808ef60-91fa-495a-a911-11d1134d995e-image.png

        From now on, you an leave the OpenVPN firewall page empty (no rules).
        I've added these on the OPENVPN rule page (like you) :

        8844cfb2-ab4c-4a8f-a515-dd24f4e333a3-image.png

        and now unbound/resolver can 'bind' to the interface 'OPENVPN' when it starts so it can actually listen for incoming requests.

        Let's check :

        My OpenVPN tunnel network is :

        9f04adaa-36f0-4ce6-9a0e-ca23da31d2bc-image.png

        so :

        [23.01-RELEASE][admin@pfSense.whatever.tld]/root: dig @192.168.3.1 google.com AAAA +short
2a00:1450:4007:818::200e

        so my unbound listens on 192.168.3.1 port 53

        No "help me" PM's please. Use the forum, the community will thank you.
        Edit : and where are the logs ??

        1 Reply Last reply Reply Quote 0
        • M
          madbrain
          last edited by madbrain

          @Gertjan ,
          Thanks for your response.

          1. re: the "localdomain", is it actually a problem, if you can actually type anything in the domain name field ? I know home.arpa was the default and I changed it. I can resolve *.localdomain hostnames on my LAN clients just fine. Only the VPN client cannot.

          2. Yes, it's listening on "all" interfaces, but I have far fewer than you, in particular, no Openvpn interface is listed as you mentioned.
            1bdea842-5f9d-43b4-8464-9df9bef68b9b-image.png

          3. I just added the openvpn interface, but it doesn't seem I can assign it to a "real" interface (did you mean "physical")
            630654ca-ed53-484b-8cd9-36d01f44cdde-image.png

          4. dig @192.168.100.1 worked for me , but not dig @192.168.101.1 . My LAN subnet is 192.168.100.0/24 . The VPN subnet is 192.168.101.0/24 .

          5. re: videos, I generally much prefer to read a step by step guide vs a watching a video. Is a video the only option ? Is there one in particular that is current for 2.6 you would recommend ?

          GertjanG 1 Reply Last reply Reply Quote 0
          • M
            madbrain
            last edited by

            I started my VPN setup over with the following video :
            https://www.youtube.com/watch?v=jQHqPq7ftz4
            I still can't get local DNS to work following those steps exactly.
            I must be missing something, but no idea what it could be.

            Should it be required to edit the DNS settings under "advanced client settings" for local DNS to work ?

            By default, the video and tutorials I have found always leave those fields blank.

            1 Reply Last reply Reply Quote 0
            • GertjanG
              Gertjan @madbrain
              last edited by

              @madbrain said in No local DNS:

              in particular, no Openvpn interface is listed as you mentioned.

              So unbound can listen to the 192.168.3.0/24

              My OPENVPN is not a physical interface.
              I assigned it by choosing the "ovpns1" interface, you can find it, its listed.
              This 'virtual' interface is the one created by your Open Server process.
              Just chose a name, assign ovpns1 and done, no IP or network to enter.

              When done, it will be listed among the unbound "Network interfaces" : you will have to include it, or use All, and restart unbound.
              Then restest

              dig @192.168.100.1 google.com

              again.

              No "help me" PM's please. Use the forum, the community will thank you.
              Edit : and where are the logs ??

              M 1 Reply Last reply Reply Quote 0
              • M
                madbrain @Gertjan
                last edited by

                @gertjan The DNS resolver is already listening on "all" ? How do I restart it, short of rebooting pfSense ?

                M 1 Reply Last reply Reply Quote 0
                • M
                  madbrain @madbrain
                  last edited by

                  @madbrain After creating the interface and rebooting pfSense, I still didn't have local DNS in my VPN client. Not only that, but my LAN clients could no longer reach Internet hosts. I had to delete the OpenVPN interface from the Interfaces menu, and then reboot again, and my access to the Internet got restored so that I could post here again to report. Seems like I'm running into a bug here.

                  ? 1 Reply Last reply Reply Quote 0
                  • ?
                    A Former User @madbrain
                    last edited by

                    @madbrain I have openvpn working but today I tried to add ipv6 and I no longer have internet access....

                    1 Reply Last reply Reply Quote 0
                    • M
                      madbrain
                      last edited by

                      I just upgraded to pfSense + (free version, this is for home use) and the local DNS started working.

                      1 Reply Last reply Reply Quote 0
                      • First post
                        Last post
                      Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.