Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    DNS issue while connected to OpenVPN

    Scheduled Pinned Locked Moved OpenVPN
    43 Posts 5 Posters 6.3k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • A
      albertmiclat
      last edited by albertmiclat

      here's is one of the user who are not having issue can ping both ip and hostname and the ip address is 10.50.0.x
      37d3b9bf-576b-446c-9848-a779a808aa18-image.png

      0aa7ad35-8895-4904-bbf2-3068f0887ece-image.png

      102d47a4-2e25-4e0c-8fb1-be38cb4d7345-image.png

      1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator
        last edited by

        what is the local network of these clients that don't work..

        So the ipconfig /all for these clients, and the routing table

        route print

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.7.2, 24.11

        A 1 Reply Last reply Reply Quote 0
        • A
          albertmiclat @johnpoz
          last edited by albertmiclat

          @johnpoz this user is having DNS issue

          fe096ce7-0202-4cb9-baa9-0b2332d9ac8a-image.png

          fb4a4ca3-27bc-4d05-8d36-0eab0704fe7c-image.png

          032e5a99-7d4c-4521-9de2-8969b6ff2ca3-image.png

          1 Reply Last reply Reply Quote 0
          • johnpozJ
            johnpoz LAYER 8 Global Moderator
            last edited by

            Well no overlap with the local network..

            When you do a tracert to 10.25.1.38, you see first hop is end of the tunnel?

            Can you ping the end of the tunnel? See the gateway listed there in the route print 10.50.1.37

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.7.2, 24.11

            A 1 Reply Last reply Reply Quote 0
            • A
              albertmiclat @johnpoz
              last edited by

              @johnpoz this is another user unfortunately the prev is already end his session

              • tracert to 10.25.1.38 doesnt show anything
              • ping to the gateway also request time out

              9a2cfbcc-8fc7-4622-ae89-e80dc0cf0c11-image.png

              da48b2af-ad44-428e-b250-b7fdc24c935b-image.png

              d973edef-84c2-4ee2-9dc8-c8d393aafe3b-image.png

              1 Reply Last reply Reply Quote 0
              • johnpozJ
                johnpoz LAYER 8 Global Moderator
                last edited by johnpoz

                Well if you can not get to the end of the tunnel, its not going to be able to talk to the dns on the other end of the tunnel..

                Are the machines that are failing have any 3rd party firewall/security software on them?

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                A 1 Reply Last reply Reply Quote 0
                • A
                  albertmiclat @johnpoz
                  last edited by

                  @johnpoz nope no firewall/security software..

                  as mentioned previously this happens when the user get this subnet 10.50.1.X but when the user gets 10.50.0.X no issue, this behavior puzzled me more..

                  may subnet is 10.50.0.0/22

                  1 Reply Last reply Reply Quote 0
                  • johnpozJ
                    johnpoz LAYER 8 Global Moderator
                    last edited by

                    hmmm - didn't notice that..

                    What are the rules in your openvpn interface on pfsense?

                    example:

                    rules.jpg

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                    A 1 Reply Last reply Reply Quote 0
                    • A
                      albertmiclat @johnpoz
                      last edited by

                      @johnpoz the usual rules..
                      6cb5f4ea-ed42-4a39-9259-5da48d27176e-image.png

                      1 Reply Last reply Reply Quote 0
                      • johnpozJ
                        johnpoz LAYER 8 Global Moderator
                        last edited by

                        Can we see route print from client that is working.

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                        A 1 Reply Last reply Reply Quote 0
                        • A
                          albertmiclat @johnpoz
                          last edited by

                          @johnpoz this working client

                          e9372920-65db-4b51-b6ba-90b35ef77fd8-image.png

                          a99dccef-cd7e-4044-a751-4b706a459c1d-image.png

                          7e00f87e-4118-41e4-9e0d-c71424e2ac45-image.png

                          f9b5cc66-c7d8-4c84-9e43-52bda335aec0-image.png

                          1 Reply Last reply Reply Quote 0
                          • johnpozJ
                            johnpoz LAYER 8 Global Moderator
                            last edited by

                            hmmmm - maybe I just need to finish waking up, more coffee ;)

                            But sorry nothing currently jumping out to me on what is the issue here.. Other than yeah, if you can not talk to your gateway at the end of the tunnel, its not going to be possible to talk to some dns server that is on the other end of the tunnel..

                            The big ? is why? hmmmmm?

                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                            If you get confused: Listen to the Music Play
                            Please don't Chat/PM me for help, unless mod related
                            SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                            1 Reply Last reply Reply Quote 0
                            • jimpJ
                              jimp Rebel Alliance Developer Netgate
                              last edited by

                              Does the AD server allow DNS queries from that whole /22?

                              Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                              Need help fast? Netgate Global Support!

                              Do not Chat/PM for help!

                              A 1 Reply Last reply Reply Quote 0
                              • johnpozJ
                                johnpoz LAYER 8 Global Moderator
                                last edited by

                                Lets say it doesn't - that could explain why he can not do a dns query to it, but seems he can not even ping the other end of the tunnel, while another client that works can..

                                An intelligent man is sometimes forced to be drunk to spend time with his fools
                                If you get confused: Listen to the Music Play
                                Please don't Chat/PM me for help, unless mod related
                                SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                                1 Reply Last reply Reply Quote 0
                                • jimpJ
                                  jimp Rebel Alliance Developer Netgate
                                  last edited by

                                  Yep. That's also probably one of the easier things to miss.

                                  Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                                  Need help fast? Netgate Global Support!

                                  Do not Chat/PM for help!

                                  1 Reply Last reply Reply Quote 0
                                  • A
                                    albertmiclat @jimp
                                    last edited by

                                    @jimp my office users network is 10.25.0.0/16 no issue on DNS queries..

                                    1 Reply Last reply Reply Quote 0
                                    • jimpJ
                                      jimp Rebel Alliance Developer Netgate
                                      last edited by

                                      So the network on the LAN is actually the whole /16 directly on the interface? Or are you talking about in general?

                                      If it's really a /16 assigned to the interface then maybe you forgot something like a proxy ARP VIP block for the other part of that /22. But I really hope you don't have a /16 on an interface like that and you're just talking about the network layout in general...

                                      Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                                      Need help fast? Netgate Global Support!

                                      Do not Chat/PM for help!

                                      A 1 Reply Last reply Reply Quote 0
                                      • A
                                        albertmiclat @jimp
                                        last edited by

                                        @jimp yes im pertaining in general, office LAN users DHCP pool.

                                        1 Reply Last reply Reply Quote 0
                                        • A
                                          albertmiclat
                                          last edited by

                                          @jimp @johnpoz @Gertjan

                                          just to update you guys on this issue, since we still unable to really pin point what causes the issue.

                                          last night i did some changes on the OpenVPN configuration to best fit my requirements and to mitigate the situation.

                                          (1) i changed the topology from net30 to subnet.

                                          (2) i did shringked down my subnet from /22 to /24 this will cater the clients on the single subnet, /24 is sufficient enough for my current OpenVPN clients.

                                          As of this writing everything works pretty well no more DNS related issue reported from my helpdesk.

                                          Again, thanks guys for your individual inputs I greatly appreciate it.

                                          GertjanG 1 Reply Last reply Reply Quote 0
                                          • GertjanG
                                            Gertjan @albertmiclat
                                            last edited by

                                            @albertmiclat said in DNS issue while connected to OpenVPN:

                                            (1) i changed the topology from net30 to subnet.

                                            That's an Oops.
                                            "net30" needs 4+4 IP's per client. Older (before 2.0.x ?) need this setting. The DHCP pool will take a hit.
                                            A /24 can handle a mere 30 VPN clients when using "net30".

                                            The subnet setting, although not default, is the best choice.

                                            No "help me" PM's please. Use the forum, the community will thank you.
                                            Edit : and where are the logs ??

                                            A 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.