Problemi with dns resolution

KOM

I had to ask. You didn't explicitly say, and I never assume the obvious. I have a similar config and it works for me. If the client runs:

ipconfig /all

what is showing for DNS servers?

sasa1

Hi,
the dns shown is:
8.8.8.8
I attach picture.
Thanks.

KOM

OK, so it seems ot be aware of DNS available to it. Can you ping 8.8.8.8? What happens when you run this on the client:

nslookup www.microsoft.com

sasa1

the ping is OK, in attached result about dns resolution.
Thanks.

KOM

Well, there is your problem. Can you ping 8.8.8.8?

sasa1

yes, ping to 8.8.8.8 is OK.
Thanks.

KOM

OK, so what happens when you run:

nslookup
server 8.8.8.8
www.microsoft.com

As I recall, on the OpenVPN page there were some mitigation options for Windows 10 clients. Have you tried checking Force DNS cache update under Advanced Client Settings?

sasa1

the result is in attach.
Yes, force DNS cache update is already selected.
Thanks.

KOM

Show me a screenshot of your firewall rules for the OpenVPN interface. I suspect you're not allowing UDP traffic or something like that.

sasa1

Hi,
attached the required rules.
Thanks. rules openvpn.JPG

KOM

Set the protocol to Any and try again.

sasa1

Hi,
unfortunately even with any dns resolution it fails.
Thanks.

KOM

Very strange. Does your firewall log show any relevant blocks while you're testing?

sasa1

Hi,
no, I don't see deny in the logs.
Thanks.

KOM

Yo @johnpoz Johnny joe ray bob, any thoughts?

marvosa

We need more details on the setup. For clarity, is "host-to-site" referring to a remote access, road warrior setup? If so, post the server1.conf (/var/etc/openvpn).

We'll know more once we see the config, but is all traffic forced thru the tunnel?

sasa1

Hi, attached server1.conf.
The address:
192.168.1.1
is the address of the router / dns referenced by the remote client that connects to my openvpn server.
The pfSense version is 2.3.2, do I need to update it?
Thanks.
server1.txt

marvosa

Not seeing anything out of the ordinary in the config. Looks like a standard, split tunnel config. Which raises the question though, since the client is using their own internet connection for the internet, why are you pushing public DNS? It's unnecessary. It's not the issue, but unnecessary.

So, the config tells me you have a split tunnel, remote access solution where the clients are using their own internet connection for everything except for traffic destined to 10.0.0.0/24 (server-side LAN). This is all standard stuff. The config looks nearly identical to all of the split tunnel configs I've deployed.

On split tunnel implementations, all of the subnets have to be unique on both ends, so the only thing that would cause issues, in this case, would be if the client's LAN is either 192.168.10.0/24 or 10.0.0.0/24 (or if the client is trying to connect from somewhere inside the server-side LAN). Outside of those scenarios, this particular issue appears to be on the client-side network. The client's PC is having issues resolving DNS, regardless of the VPN since they're using their own internet.

I would do a few things for starters:

Update your PFsense firmware. (v2.3.2 is 16 versions behind and almost 3 years old)
Remove the DNS push for 8.8.8.8 (uncheck "DNS SErver enable")
Remove the recently checked "Force DNS cache update" option (not needed when not pushing DNS)
Re-export the full OpenVPN windows installer package, send it to your user, have them uninstall their current package, manually delete the "C:\Program Files\OpenVPN" directory, then install the new package.

I suspect the remote-end had DNS issues even before connecting, but after the above is done, if they continue to have issues then the problem is definitely somewhere on the remote network. The client-end will need to troubleshoot DNS resolution on their end because all internet activity, in this case, is handled by the client-side network.

I would also verify there are no stray, statically set DNS entries or manually added persistent routes on the PC.

sasa1

Hi,
I performed all indicated steps,now on the Windows 10 remote client I downloaded the openvpn client version 2.4.7.
Now when install to try it I have an error message saying that the version is not supported by Windows 10. client openvpn.JPG
Thanks

sasa1

@marvosa
I downloaded the client from the openvpn web site and it worked.
I tried the vpn connection and now also Internet access works !
Thank you all for your help.