Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    OpenVPN works but no local DNS

    Scheduled Pinned Locked Moved OpenVPN
    49 Posts 18 Posters 35.1k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • GertjanG
      Gertjan
      last edited by

      Hi,

      This is your tunnel :
      ad526486-5157-46c3-b7d3-84318a0fc19c-image.png
      so make the DNS 10.0.8.1 - change this :
      465e73e3-f8a3-4f26-a051-9e89fffe4d39-image.png

      also, check this :
      6fde7427-0438-4720-b3f1-5e36f10e614a-image.png

      This options seems very important to me. Read the comments.

      IMHO these extra options are not needed :
      fbd962b4-b89c-4235-b812-7082179eefe1-image.png

      No "help me" PM's please. Use the forum, the community will thank you.
      Edit : and where are the logs ??

      john_galtJ 1 Reply Last reply Reply Quote 1
      • john_galtJ
        john_galt @Gertjan
        last edited by

        @Gertjan
        @johnpoz
        @KOM

        I've made changes that you've pointed out that I should make which have yielded some success.
        I have two client VPN profiles on the same client computer. One profile gives me local DNS queries and the other profile doesn't. I'm going to spend some time now reading up on what I'm doing rather
        than, as @johnpoz put it "randomly clicking shit". Which was in fact what I was doing.

        I have one question now though. If I make changes to the OpenVPN server and or on the OpenVPN Client Export page does that require exporting a new client config or are those changes pushed to the client on next connect?

        I greatly appreciate your help and patience with me on this problem.

        Doug

        Doug

        1 Reply Last reply Reply Quote 0
        • johnpozJ
          johnpoz LAYER 8 Global Moderator
          last edited by johnpoz

          depends on what changes you made..

          Here I am at work now... And using unbound on pfsense for my dns... So I can resolve stuff on my home network

          Ethernet adapter Local Area Connection 2:
          
             Connection-specific DNS Suffix  . : local.lan
             Description . . . . . . . . . . . : TAP-Windows Adapter V9
             Physical Address. . . . . . . . . : 00-FF-1F-37-23-EC
             DHCP Enabled. . . . . . . . . . . : Yes
             Autoconfiguration Enabled . . . . : Yes
             IPv4 Address. . . . . . . . . . . : 10.0.8.100(Preferred)
             Subnet Mask . . . . . . . . . . . : 255.255.255.0
             Lease Obtained. . . . . . . . . . : Tuesday, May 14, 2019 10:01:25 AM
             Lease Expires . . . . . . . . . . : Wednesday, May 13, 2020 10:01:25 AM
             Default Gateway . . . . . . . . . :
             DHCP Server . . . . . . . . . . . : 10.0.8.254
             DNS Servers . . . . . . . . . . . : 192.168.9.253
                                                 192.168.9.253
             NetBIOS over Tcpip. . . . . . . . : Enabled
          

          You can see my vpn interface told to use pfsense lan IP for dns

          If I ask for say a box on my local network..

          C:\Windows\System32>nslookup nas.local.lan
          Server:  sg4860.local.lan
          Address:  192.168.9.253
          
          Name:    nas.local.lan
          Address:  192.168.9.10
          

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.8, 24.11

          1 Reply Last reply Reply Quote 0
          • x2rlX
            x2rl
            last edited by x2rl

            I know its an old post but Im having the very same problem. When openvpn is on my phone it does not use the dns ive set on pfsense. Also just plan ignores pfblocker-dev

            alt text

            1 Reply Last reply Reply Quote 0
            • Mr. WasteM
              Mr. Waste
              last edited by

              @x3rl
              Ipv4 Tunnel Network is set as: 10.0.1.0/24
              Dns Server 1 is set as: 10.0.0.1

              Change the dns server to 10.0.1.1

              I am doing more complex vpns. Having 2 vpns together to get the most out of the filtering.
              Home Pfsense (Connecting) to Cloud Remote Pfsense (Actual VPN) to DNS Server VPN (Actual VPN through the Cloud VPN)
              Home = Cloud = DNS

              Hope this helps.

              x2rlX 1 Reply Last reply Reply Quote 0
              • x2rlX
                x2rl @Mr. Waste
                last edited by

                @Mr-Waste did not work pal pfbocker was not working when setting that dns

                Mr. WasteM 1 Reply Last reply Reply Quote 0
                • Mr. WasteM
                  Mr. Waste
                  last edited by

                  This post is deleted!
                  1 Reply Last reply Reply Quote 0
                  • Mr. WasteM
                    Mr. Waste @x2rl
                    last edited by Mr. Waste

                    @x3rl

                    Go to Firewall/pfBlockerNG/IP
                    IP Interface/Rules Configuration:

                    Inbound Firewall Rules:
                    Wan

                    Outbound Firewall Rules:
                    Lan
                    OpenVpn Server interface

                    Make sure you have that interface highlighted. This might be the problem.
                    Make sure you have the dns resolver on as well. Local DNS Resolver to up stream DNS Server/ like cloud flare or google.

                    DNS.png

                    2.png

                    Make sure everything else are all GREEN/ ON or it will not work. - (Resolver)
                    pfb_dnsbl is down something isn't right. Like with the first picture. - (The interfaces)

                    Mr. Waste

                    1 Reply Last reply Reply Quote 1
                    • x2rlX
                      x2rl
                      last edited by

                      My dns is set to 127.0.0.1 I have all the rules and everything is active.

                      1 Reply Last reply Reply Quote 0
                      • GertjanG
                        Gertjan
                        last edited by

                        Side note :
                        @Mr-Waste :

                        475df355-93f5-4a3d-8aae-aac5e4a06030-image.png

                        ☺

                        No "help me" PM's please. Use the forum, the community will thank you.
                        Edit : and where are the logs ??

                        x2rlX 1 Reply Last reply Reply Quote 1
                        • x2rlX
                          x2rl @Gertjan
                          last edited by

                          @Gertjan pfsense does the resloving.

                          J 1 Reply Last reply Reply Quote 0
                          • J
                            Jochim @x2rl
                            last edited by

                            @x3rl
                            Try resetting everything to the way it was in your screenshot, then change the option "DNS Default Domain" to just "localdomain". Next add the tunnel network (10.0.1.0/24 in your case) to the DNS Resolver access list by going to Services > DNS Resolver > Access Lists and adding a new entry for the tunnel network.

                            Hopefully that solves the issue.

                            Jochim

                            x2rlX 1 Reply Last reply Reply Quote 1
                            • x2rlX
                              x2rl @Jochim
                              last edited by

                              @Jochim nope still does not use piholes adblocker via pfsense DNS.

                              1 Reply Last reply Reply Quote 0
                              • R
                                renegade
                                last edited by

                                Same here.
                                It seems the set DNS Server is only used for the set domain name.
                                In my case it‘s home and everything ending with .home is resolved and available in my OpenVPN Split Tunnel. But other name resolution seems to happen with any other DNS Server (unknown).

                                1 Reply Last reply Reply Quote 0
                                • S
                                  soutruth
                                  last edited by

                                  Had same issue. Unticked: "Provide a DNS server list to clients. Addresses may be IPv4 or IPv6."

                                  Fixed :)

                                  N 1 Reply Last reply Reply Quote 0
                                  • B
                                    Byter @john_galt
                                    last edited by

                                    @john_galt

                                    @john_galt said in OpenVPN works but no local DNS:

                                    @johnpoz

                                    I can now get local DNS over OpenVPN but I don't know why. I would like to if anyone can explain.

                                    In Services > DNS Resolver > General Settings I changed the Network Interfaces from "All" to selecting all the interfaces and saving.

                                    I've spent a lot of time trying to figure this out and really would like to understand why one setting
                                    doesn't work but the other does when essentially they are both the same?

                                    Thanks,

                                    Doug

                                    // Edit//

                                    Here's the forum thread that gave me this fix.

                                    alt text

                                    Actually I had an issue using another router behind a PFsense, with full functionalities. I just wanted to have a separeted network without using VLAN and I wanted to preserve the reserved IP addresses, long sotry... Anyway, I couldn't figure out why on earth I can't get the clients behind the second router to properly resolve DNS. I used the same trick as you selecting every interface by hand rather than using the "ALL" option. IT SOLVED finally my issue. I definitely think there is a glitch somewhere.

                                    1 Reply Last reply Reply Quote 0
                                    • N
                                      nonyhaha @soutruth
                                      last edited by

                                      @soutruth how on earth did that go ok for you? What dns is your client using then?

                                      Other than that, I am having the same issue and am trying to solve it.
                                      the problem for me is that I am not even trying to user pfblockerng, only use the local acl to access local assets.

                                      1 Reply Last reply Reply Quote 0
                                      • A
                                        Allistah @john_galt
                                        last edited by

                                        @john_galt

                                        I made an account here just to say that this resolved my issue as well. I am running pfSense 2.5.2-RELEASE (amd64) and I could connect to VPN without any trouble but any local DNS wouldn't work to the site I was connected to. Once I removed the DNS Resolver from "All" to manually choosing all of the IPv4 interfaces on the "Network Interfaces" and "Outgoing Network Interfaces" within the DNS Resolver, it just started to work as I would expect.

                                        Maybe there is a bug or something there.

                                        Thanks for listening - hope this can help improve pfSense!

                                        1 Reply Last reply Reply Quote 0
                                        • S
                                          Schuby @john_galt
                                          last edited by

                                          @john_galt This also worked for me. Very strange.

                                          Z 1 Reply Last reply Reply Quote 0
                                          • Z
                                            Zoltrix @Schuby
                                            last edited by

                                            @johnpoz can confirm the same issue here. Once I changed the Network Interfaces from "All" to selecting all the interfaces and saving, presto! Working.

                                            Time for a bug report I guess.

                                            F 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.