Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    OpenVPN works but no local DNS

    Scheduled Pinned Locked Moved OpenVPN
    49 Posts 18 Posters 34.8k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • johnpozJ
      johnpoz LAYER 8 Global Moderator
      last edited by

      yeah that is where you set the acls on who can query unbound.

      An intelligent man is sometimes forced to be drunk to spend time with his fools
      If you get confused: Listen to the Music Play
      Please don't Chat/PM me for help, unless mod related
      SG-4860 24.11 | Lab VMs 2.8, 24.11

      john_galtJ 1 Reply Last reply Reply Quote 0
      • john_galtJ
        john_galt @johnpoz
        last edited by

        @johnpoz

        Isn't it set by that entry?

        The client is 10.0.8.2 and that is in the ACL.

        Doug

        Doug

        1 Reply Last reply Reply Quote 0
        • johnpozJ
          johnpoz LAYER 8 Global Moderator
          last edited by johnpoz

          yeah that should allow it yes.. So you just created it, or that was there already? Do you have automatic set? Not sure if when you have automatic if it reads what you set?

          autoacls.png

          I have always turned off automatic and done my own acls..

          I looked closer and sure looks like your getting answers in your packet capture..

          Oh your dns on your client is just pointing to loopback??

          broken.png

          That kind of broken... should be pointing to pfsense lan IP for dns would be how I would set it up..

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.8, 24.11

          john_galtJ 2 Replies Last reply Reply Quote 0
          • john_galtJ
            john_galt @johnpoz
            last edited by

            @johnpoz

            No I didn't just create it. It's been there probably since I setup OpenVPN.

            I haven't disabled auto-added list.

            From that packet capture I thought so as well but I still can't get host resolution. Why I'm at a loss.

            Doug

            Doug

            1 Reply Last reply Reply Quote 0
            • johnpozJ
              johnpoz LAYER 8 Global Moderator
              last edited by

              your client is asking itself for dns... So how would that get sent down the tunnel to unbound on pfsense?

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.8, 24.11

              1 Reply Last reply Reply Quote 0
              • john_galtJ
                john_galt @johnpoz
                last edited by

                @johnpoz

                I thought so as well John. I had that set to my pfSense IP before a recent pfBlockerNG devel release.
                BBcan177 did some "tinkering". I will ping him on this.

                Doug

                Doug

                1 Reply Last reply Reply Quote 0
                • john_galtJ
                  john_galt @johnpoz
                  last edited by john_galt

                  @johnpoz

                  I can now get local DNS over OpenVPN but I don't know why. I would like to if anyone can explain.

                  In Services > DNS Resolver > General Settings I changed the Network Interfaces from "All" to selecting all the interfaces and saving.

                  I've spent a lot of time trying to figure this out and really would like to understand why one setting
                  doesn't work but the other does when essentially they are both the same?

                  Thanks,

                  Doug

                  // Edit//

                  Here's the forum thread that gave me this fix.

                  alt text

                  Doug

                  B A S F 4 Replies Last reply Reply Quote 0
                  • johnpozJ
                    johnpoz LAYER 8 Global Moderator
                    last edited by

                    So your clients are using doing ssl/tls queries? over a VPN? WTF???

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                    john_galtJ 1 Reply Last reply Reply Quote 0
                    • john_galtJ
                      john_galt @johnpoz
                      last edited by

                      @johnpoz

                      I’m not even sure how to answer that John. I’ll let it go as it seems to have struck a nerve.

                      Thanks for your help.

                      Doug

                      johnpozJ 1 Reply Last reply Reply Quote 0
                      • KOMK
                        KOM
                        last edited by

                        @john_galt said in OpenVPN works but no local DNS:

                        I've spent a lot of time trying to figure this out and really would like to understand why one setting
                        doesn't work but the other does when essentially they are both the same?

                        That looks like some sort of glitch to me. There may not be any sense to be made about it other than 'bug'.

                        john_galtJ 1 Reply Last reply Reply Quote 0
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator @john_galt
                          last edited by

                          @john_galt

                          Dude why would you do dns over tls over your own vpn? Complete nonsense and extra overhead

                          Did you fix your client from pointing to loop back? Dude I use this every day there is no “bug”

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                          john_galtJ 1 Reply Last reply Reply Quote 0
                          • john_galtJ
                            john_galt @KOM
                            last edited by

                            @KOM

                            KOM,

                            Someone in the old forum article I referenced mentioned something about committing a fix but that was years ago.

                            Like I tried to explain I know enough about networking to get myself into trouble. But I'm willing to learn.

                            Thank you for your assistance.

                            Doug

                            Doug

                            1 Reply Last reply Reply Quote 0
                            • john_galtJ
                              john_galt @johnpoz
                              last edited by

                              @johnpoz

                              John,

                              My name is Doug. It's in my messages. I give you the respect of using your name.

                              I did fix the loopback.

                              I really don't understand why you are taking this request for help and my stated lack of
                              knowledge so personally. I have no idea that I'm doing DNS over TLS over my own VPN.
                              All I wanted to do was VPN into my home network from my work location and be able
                              to access assets by name.

                              If you wish to help I will listen and respect you for it. If you wish to berate then please
                              don't help.

                              Doug

                              Doug

                              1 Reply Last reply Reply Quote 4
                              • KOMK
                                KOM
                                last edited by

                                Check your DHCP server to see what it's pushing to clients for DNS.

                                john_galtJ 1 Reply Last reply Reply Quote 0
                                • john_galtJ
                                  john_galt @KOM
                                  last edited by

                                  @KOM

                                  KOM,

                                  I will check when I get back to work Monday morning.

                                  It's working now though since I made that change. I don't know why
                                  and that bothers me. I will continue my research.

                                  Thank you for your help.

                                  Doug

                                  1 Reply Last reply Reply Quote 0
                                  • johnpozJ
                                    johnpoz LAYER 8 Global Moderator
                                    last edited by johnpoz

                                    If you do not understand what dns over tls is then why would you set it??

                                    dot.png

                                    Fixing your issue does not come from just randomly clicking shit..

                                    Come back when you have your client actually pointing to the IP for dns that is your pfsense box on your vpn connection which was pointed out to you back in the beginning of this thread.

                                    Do a simple query from your client using your fav dns tool, nslookup, dig, host, etc..

                                    Does it respond - yes or no?

                                    You show an answer in your packet capture to your query to 53 - what was that query, what was the answer... download that packet capture in wireshark.

                                    It's working now though since I made that change

                                    You changed from ALL to manually selecting "all" that is not a fix that is not even different.. So how would that "fix" anything..

                                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                                    If you get confused: Listen to the Music Play
                                    Please don't Chat/PM me for help, unless mod related
                                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                                    john_galtJ 1 Reply Last reply Reply Quote 0
                                    • john_galtJ
                                      john_galt @johnpoz
                                      last edited by

                                      @johnpoz

                                      John I setup pfsense to use Quad9 DNS over TLS earlier this year. I can't find the URL for the instructions I used but will keep looking. In those instructions I was instructed to enable that feature.

                                      I will come back when I can check over the VPN connection Monday.

                                      In my initial request for help I posted a screen grab of the packet capture which you said showed the query being answered. I did that query using nslookup and explicitly setting the server to my pfsense IPv4 address. I did not get a name back using this method.

                                      I will get wireshark and get that data but can't until Monday.

                                      Thank you for your help.

                                      Doug

                                      Doug

                                      1 Reply Last reply Reply Quote 0
                                      • GertjanG
                                        Gertjan
                                        last edited by

                                        Hi,

                                        This is your tunnel :
                                        ad526486-5157-46c3-b7d3-84318a0fc19c-image.png
                                        so make the DNS 10.0.8.1 - change this :
                                        465e73e3-f8a3-4f26-a051-9e89fffe4d39-image.png

                                        also, check this :
                                        6fde7427-0438-4720-b3f1-5e36f10e614a-image.png

                                        This options seems very important to me. Read the comments.

                                        IMHO these extra options are not needed :
                                        fbd962b4-b89c-4235-b812-7082179eefe1-image.png

                                        No "help me" PM's please. Use the forum, the community will thank you.
                                        Edit : and where are the logs ??

                                        john_galtJ 1 Reply Last reply Reply Quote 1
                                        • john_galtJ
                                          john_galt @Gertjan
                                          last edited by

                                          @Gertjan
                                          @johnpoz
                                          @KOM

                                          I've made changes that you've pointed out that I should make which have yielded some success.
                                          I have two client VPN profiles on the same client computer. One profile gives me local DNS queries and the other profile doesn't. I'm going to spend some time now reading up on what I'm doing rather
                                          than, as @johnpoz put it "randomly clicking shit". Which was in fact what I was doing.

                                          I have one question now though. If I make changes to the OpenVPN server and or on the OpenVPN Client Export page does that require exporting a new client config or are those changes pushed to the client on next connect?

                                          I greatly appreciate your help and patience with me on this problem.

                                          Doug

                                          Doug

                                          1 Reply Last reply Reply Quote 0
                                          • johnpozJ
                                            johnpoz LAYER 8 Global Moderator
                                            last edited by johnpoz

                                            depends on what changes you made..

                                            Here I am at work now... And using unbound on pfsense for my dns... So I can resolve stuff on my home network

                                            Ethernet adapter Local Area Connection 2:
                                            
                                               Connection-specific DNS Suffix  . : local.lan
                                               Description . . . . . . . . . . . : TAP-Windows Adapter V9
                                               Physical Address. . . . . . . . . : 00-FF-1F-37-23-EC
                                               DHCP Enabled. . . . . . . . . . . : Yes
                                               Autoconfiguration Enabled . . . . : Yes
                                               IPv4 Address. . . . . . . . . . . : 10.0.8.100(Preferred)
                                               Subnet Mask . . . . . . . . . . . : 255.255.255.0
                                               Lease Obtained. . . . . . . . . . : Tuesday, May 14, 2019 10:01:25 AM
                                               Lease Expires . . . . . . . . . . : Wednesday, May 13, 2020 10:01:25 AM
                                               Default Gateway . . . . . . . . . :
                                               DHCP Server . . . . . . . . . . . : 10.0.8.254
                                               DNS Servers . . . . . . . . . . . : 192.168.9.253
                                                                                   192.168.9.253
                                               NetBIOS over Tcpip. . . . . . . . : Enabled
                                            

                                            You can see my vpn interface told to use pfsense lan IP for dns

                                            If I ask for say a box on my local network..

                                            C:\Windows\System32>nslookup nas.local.lan
                                            Server:  sg4860.local.lan
                                            Address:  192.168.9.253
                                            
                                            Name:    nas.local.lan
                                            Address:  192.168.9.10
                                            

                                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                                            If you get confused: Listen to the Music Play
                                            Please don't Chat/PM me for help, unless mod related
                                            SG-4860 24.11 | Lab VMs 2.8, 24.11

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.