[SOLVED] DNS Resolver not working with VPN Client

moussa854

I have a working pfsense (basic router and firewall and up to date). I installed a VPN Client with an interface to route the LAN traffic through. However, when the VPN Client is on, the DNS Resolver become unbound and I cannot connect to the internet. Even after I restart the DNS resolver the internet will not work. If I turn off the VPN Client, then I will be able to get access to the internet again.
pfSense_localdomain_-Status__Dashboard-_Firefox_Developer_Edition.png

I tired to add an Access Lists but did not work.
pfSense_localdomain_-Services__DNS_Resolver__Access_Lists__Edit-_Firefox_Developer_Edition.png

I also tried to select the interfaces individually but that did not work.
pfSense_localdomain_-Services__DNS_Resolver__General_Settings-_Firefox_Developer_Edition.png

Appreciate any thought or suggestion.

viragomann

I assume, you're missing an outbount NAT rule for localhost on the OpenVPN clients interface.

moussa854

Thank you @viragomann for your suggestion. I duplicated all the rules in NAT > Outbound
pfSense_localdomain_-Firewall__NAT__Outbound-_Firefox_Developer_Edition.png

The strange thing even with keeping the LAN interface to default, I lose access to the internet and the DNS Resolver turn into unbound when I turn the VPN Client on

viragomann

Are there some hints in the system log, general or DNS resolver?

moussa854

Here is the the DNS resolver log after starting the VPN client

Feb 17 08:32:19 	unbound 	576:0 	info: service stopped (unbound 1.9.1).
Feb 17 08:32:19 	unbound 	576:0 	info: server stats for thread 0: 21 queries, 13 answers from cache, 8 recursions, 0 prefetch, 0 rejected by ip ratelimiting
Feb 17 08:32:19 	unbound 	576:0 	info: server stats for thread 0: requestlist max 0 avg 0 exceeded 0 jostled 0
Feb 17 08:32:19 	unbound 	576:0 	info: average recursion processing time 0.531053 sec
Feb 17 08:32:19 	unbound 	576:0 	info: histogram of recursion processing times
Feb 17 08:32:19 	unbound 	576:0 	info: [25%]=0.032768 median[50%]=0.393216 [75%]=0.762144
Feb 17 08:32:19 	unbound 	576:0 	info: lower(secs) upper(secs) recursions
Feb 17 08:32:19 	unbound 	576:0 	info: 0.000000 0.000001 1
Feb 17 08:32:19 	unbound 	576:0 	info: 0.016384 0.032768 1
Feb 17 08:32:19 	unbound 	576:0 	info: 0.065536 0.131072 1
Feb 17 08:32:19 	unbound 	576:0 	info: 0.262144 0.524288 2
Feb 17 08:32:19 	unbound 	576:0 	info: 0.524288 1.000000 2
Feb 17 08:32:19 	unbound 	576:0 	info: 1.000000 2.000000 1
Feb 17 08:32:19 	unbound 	576:0 	info: server stats for thread 1: 36 queries, 26 answers from cache, 10 recursions, 0 prefetch, 0 rejected by ip ratelimiting
Feb 17 08:32:19 	unbound 	576:0 	info: server stats for thread 1: requestlist max 8 avg 0.9 exceeded 0 jostled 0
Feb 17 08:32:19 	unbound 	576:0 	info: average recursion processing time 0.437046 sec
Feb 17 08:32:19 	unbound 	576:0 	info: histogram of recursion processing times
Feb 17 08:32:19 	unbound 	576:0 	info: [25%]=0.098304 median[50%]=0.32768 [75%]=0.49152
Feb 17 08:32:19 	unbound 	576:0 	info: lower(secs) upper(secs) recursions
Feb 17 08:32:19 	unbound 	576:0 	info: 0.008192 0.016384 1
Feb 17 08:32:19 	unbound 	576:0 	info: 0.032768 0.065536 1
Feb 17 08:32:19 	unbound 	576:0 	info: 0.065536 0.131072 1
Feb 17 08:32:19 	unbound 	576:0 	info: 0.131072 0.262144 1
Feb 17 08:32:19 	unbound 	576:0 	info: 0.262144 0.524288 4
Feb 17 08:32:19 	unbound 	576:0 	info: 0.524288 1.000000 1
Feb 17 08:32:19 	unbound 	576:0 	info: 1.000000 2.000000 1
Feb 17 08:32:22 	unbound 	4806:0 	notice: init module 0: validator
Feb 17 08:32:22 	unbound 	4806:0 	notice: init module 1: iterator
Feb 17 08:32:22 	unbound 	4806:0 	info: start of service (unbound 1.9.1).

Here is the general log

Feb 17 08:17:00 	kernel 		ovpnc1: link state changed to DOWN
Feb 17 08:17:00 	check_reload_status 		Reloading filter
Feb 17 08:17:15 	rc.gateway_alarm 	33120 	>>> Gateway alarm: GCPVPNINTERFACE_VPNV4 (Addr:10.8.0.1 Alarm:1 RTT:19.156ms RTTsd:.348ms Loss:21%)
Feb 17 08:17:15 	check_reload_status 		updating dyndns GCPVPNINTERFACE_VPNV4
Feb 17 08:17:15 	check_reload_status 		Restarting ipsec tunnels
Feb 17 08:17:15 	check_reload_status 		Restarting OpenVPN tunnels/interfaces
Feb 17 08:17:15 	check_reload_status 		Reloading filter
Feb 17 08:17:16 	php-fpm 	53460 	/rc.openvpn: Gateway, none 'available' for inet6, use the first one configured. 'WAN_DHCP6'
Feb 17 08:17:16 	php-fpm 	53460 	/rc.openvpn: OpenVPN: One or more OpenVPN tunnel endpoints may have changed its IP. Reloading endpoints that may use GCPVPNINTERFACE_VPNV4.
Feb 17 08:32:15 	php-fpm 	53460 	OpenVPN terminate old pid: 98185
Feb 17 08:32:15 	php-fpm 	53460 	OpenVPN PID written: 99423
Feb 17 08:32:15 	check_reload_status 		Reloading filter
Feb 17 08:32:17 	kernel 		ovpnc1: link state changed to UP
Feb 17 08:32:17 	check_reload_status 		rc.newwanip starting ovpnc1
Feb 17 08:32:18 	php-fpm 	66584 	/rc.newwanip: rc.newwanip: Info: starting on ovpnc1.
Feb 17 08:32:18 	php-fpm 	66584 	/rc.newwanip: rc.newwanip: on (IP address: 10.8.0.9) (interface: GCPVPNINTERFACE[opt1]) (real interface: ovpnc1).
Feb 17 08:32:19 	php-fpm 	66584 	/rc.newwanip: Gateway, none 'available' for inet6, use the first one configured. 'WAN_DHCP6'
Feb 17 08:32:23 	php-fpm 	66584 	/rc.newwanip: Creating rrd update script
Feb 17 08:32:25 	php-fpm 	66584 	/rc.newwanip: pfSense package system has detected an IP change or dynamic WAN reconnection - 10.8.0.9 -> 10.8.0.9 - Restarting packages.
Feb 17 08:32:25 	check_reload_status 		Starting packages
Feb 17 08:32:26 	php-fpm 	76683 	/rc.start_packages: Restarting/Starting all packages.
Feb 17 08:32:27 	php 		[pfBlockerNG] DNSBL parser daemon started
Feb 17 08:32:27 	php_pfb 		[pfBlockerNG] filterlog daemon started

moussa854

Thank you @viragomann for helping, truly appreciated.

I was able to solve my problem by changing the compression to "Omit Preference + Disable LZO Compression"

pfSense_localdomain_-VPN__OpenVPN__Clients__Edit-_Firefox_Developer_Edition.png

viragomann

@moussa854
Strange issue. Thanks for coming back and posting the solution.