Multiple-WANs & OpenVPN Client DNS Separation
-
Hello everyone, this is my first post, I've been lurking looking for answers for a while.
I've been reading about DNS Server separation for a couple of months and no one seems to have nailed a clear answer.
I have two WANs (Different ISPs) and an OpenVPN client (NordVPN).
I'm trying to force traffic to use a different DNS depending on which gateway is used (WAN1,WAN2,OPENVPN).
I've tried NAT rules, Rules on LAN and the BIND package (from my understanding, the built in DNS forwarder & resolver services are not built for what I need).
WAN1 -> DNS Request -> GoogleDNS
WAN2 -> DNS Request -> OpenDNS
NORDVPN -> DNS Request -> NordVPNThe General Setup -> DNS Servers always seem to get used no matter what I change (BIND doesn't seem to do anything, I've configured ACLs, Views & Zones).
Has anyone managed to crack this? Could anyone point me in the right direction?
Thank you!
-
This makes no sense:
WAN1 -> DNS Request -> GoogleDNS
WAN2 -> DNS Request -> OpenDNS
NORDVPN -> DNS Request -> NordVPNAre you saying that you want anything policy-routed out those interfaces to use those specific DNS servers?
DNS doesn't work that way.
The CLIENT determines what DNS servers are queried.
If that is either DNS Resolver or DNS forwarder then those have to be configured to do the "right thing" in that case (if possible).
In almost all cases, if you want your DNS to behave in a specific way you need to run your own BIND servers in the inside and tell your clients to use those.
Making DNS take different paths based on different sources and destinations is fairly complicated.
-
Are you saying that you want anything policy-routed out those interfaces to use those specific DNS servers?
Yes. Thank you for the answer!
I was trying to get BIND to do this but it just wasn't taking over the DNS paths. The General Setup -> DNS Servers would always end up being used.
I understand that this is complicated, I've been slowly tweaking and reading into it.
Maybe I am missing something stupid, I've only been using pfSense for a few months.
If I enable the BIND DNS Server, does anything need to be changed in the General Setup? It was my understanding that because 127.0.0.1 is the first DNS, it would just take over.
-
Run your own BIND servers inside the firewall. In other words off the firewall. Not the BIND package on the firewall itself.
Having your resolver traffic sourced from the firewall itself only makes things 1000% harder. pfSense policy routing is applied when traffic enters the firewall. If cannot be applied to traffic originating on the firewall itself.
You will have to - at a minimum - explicitly set the source address or interface for the specific paths so the correct interface is used. That will be a real trick with a dynamic address such as your vpn provider link. Maybe it is possible if you can use the name of an assigned interface as the source and not the address itself.
With the DNS server on the inside you could set up several STATIC local addresses on it and source from those different addresses based on the path you want the queries to take. The you can simply policy route the resolver traffic on the pfSense interface however you like.
If you really want to use the BIND package, put another pfSense on the inside for just that purpose.
