DNS issue while connected to OpenVPN
-
what is the local network of these clients that don't work..
So the ipconfig /all for these clients, and the routing table
route print
-
-
Well no overlap with the local network..
When you do a tracert to 10.25.1.38, you see first hop is end of the tunnel?
Can you ping the end of the tunnel? See the gateway listed there in the route print 10.50.1.37
-
@johnpoz this is another user unfortunately the prev is already end his session
- tracert to 10.25.1.38 doesnt show anything
- ping to the gateway also request time out
-
Well if you can not get to the end of the tunnel, its not going to be able to talk to the dns on the other end of the tunnel..
Are the machines that are failing have any 3rd party firewall/security software on them?
-
@johnpoz nope no firewall/security software..
as mentioned previously this happens when the user get this subnet 10.50.1.X but when the user gets 10.50.0.X no issue, this behavior puzzled me more..
may subnet is 10.50.0.0/22
-
hmmm - didn't notice that..
What are the rules in your openvpn interface on pfsense?
example:
-
@johnpoz the usual rules..
-
Can we see route print from client that is working.
-
-
hmmmm - maybe I just need to finish waking up, more coffee ;)
But sorry nothing currently jumping out to me on what is the issue here.. Other than yeah, if you can not talk to your gateway at the end of the tunnel, its not going to be possible to talk to some dns server that is on the other end of the tunnel..
The big ? is why? hmmmmm?
-
Does the AD server allow DNS queries from that whole /22?
-
Lets say it doesn't - that could explain why he can not do a dns query to it, but seems he can not even ping the other end of the tunnel, while another client that works can..
-
Yep. That's also probably one of the easier things to miss.
-
@jimp my office users network is 10.25.0.0/16 no issue on DNS queries..
-
So the network on the LAN is actually the whole /16 directly on the interface? Or are you talking about in general?
If it's really a /16 assigned to the interface then maybe you forgot something like a proxy ARP VIP block for the other part of that /22. But I really hope you don't have a /16 on an interface like that and you're just talking about the network layout in general...
-
@jimp yes im pertaining in general, office LAN users DHCP pool.
-
just to update you guys on this issue, since we still unable to really pin point what causes the issue.
last night i did some changes on the OpenVPN configuration to best fit my requirements and to mitigate the situation.
(1) i changed the topology from net30 to subnet.
(2) i did shringked down my subnet from /22 to /24 this will cater the clients on the single subnet, /24 is sufficient enough for my current OpenVPN clients.
As of this writing everything works pretty well no more DNS related issue reported from my helpdesk.
Again, thanks guys for your individual inputs I greatly appreciate it.
-
@albertmiclat said in DNS issue while connected to OpenVPN:
(1) i changed the topology from net30 to subnet.
That's an Oops.
"net30" needs 4+4 IP's per client. Older (before 2.0.x ?) need this setting. The DHCP pool will take a hit.
A /24 can handle a mere 30 VPN clients when using "net30".The subnet setting, although not default, is the best choice.
-
@Gertjan yup thats true.. thats why i switch straight away..
