Local hostnames won't resolve over OpenVPN



  • I am having a weird problem with OpenVPN - I cannot resolve local hostnames over VPN. I can resolve all hostnames when on my wifi.  I have read and tried everything I can find, but can't seem to solve this. Where do I start troubleshooting? I can attach screenshots if necessary.

    Connection |  Internet DNS    |    Local DNS
    –---------------------------------------------                 
    Wifi            |    Works              |  Works
    OpenVPN  |    Works              |    Not working

    Thanks in advance!



  • You must give us more infos.

    What is the VPN client? pfSense? A mobile phone?
    What is the server?
    What is your local DNS?



  • I knew you would need more info, just not sure what, so thanks for clarifying. I am running pfSense 2.3.2-RELEASE-p1 (amd64) on a Watchguard XTM5. I use the OpenVPN client on an iPad, an Android phone, and a few Windows 10 laptops. I'm not sure what you mean by "What is your local DNS." I have tried DNS Resolver and DNS Forwarder, at the advice of info found elsewhere. I had this working at one point on this same hardware, but I haven't had the need to use it in a while, and apparently something must have been changed. What other info do I need to provide?

    OpenVPN client config (sensitive information removed)

    
    dev tun
    persist-tun
    persist-key
    cipher AES-256-CBC
    auth SHA512
    tls-client
    client
    resolv-retry infinite
    remote abcd.defg.com 1194 udp
    lport 0
    verify-x509-name "pfsense" name
    auth-user-pass
    pkcs12 pfSense-udp-1194-OpenVPN.p12
    tls-auth pfSense-udp-1194-OpenVPN-tls.key 1
    ns-cert-type server
    comp-lzo adaptive
    
    

    pfSense OpenVPN Server config

    
     <openvpn-server><vpnid>1</vpnid>
    			<mode>server_tls_user</mode>
    			<authmode>Local Database</authmode>
    			<protocol>UDP</protocol>
    			<dev_mode>tun</dev_mode>
    			 <ipaddr><interface>wan</interface>
    			<local_port>1194</local_port>
    
    			<custom_options>push "route x.x.x.x 255.255.255.0"; push "route x.x.x.x 255.255.255.0";</custom_options>
    			<tls>xxxxxxxxxxxxx</tls>
    			<caref>xxxxxxxxxxxxx</caref>
    			 <crlref><certref>xxxxxxxxxxxxx</certref>
    			<dh_length>4096</dh_length>
    			<cert_depth>1</cert_depth>
    			 <strictusercn><crypto>AES-256-CBC</crypto>
    			<digest>SHA512</digest>
    			<engine>none</engine>
    			<tunnel_network>x.x.x.x/24</tunnel_network>
    			 <tunnel_networkv6><remote_network><remote_networkv6><gwredir><local_network><local_networkv6><maxclients>3</maxclients>
    			<compression>adaptive</compression>
    			 <passtos><client2client><dynamic_ip>yes</dynamic_ip>
    			<pool_enable>yes</pool_enable>
    			<topology>subnet</topology>
    			 <serverbridge_dhcp><serverbridge_interface>none</serverbridge_interface>
    			 <serverbridge_dhcp_start><serverbridge_dhcp_end><dns_server1>8.8.8.8</dns_server1>
    			<dns_server2>8.8.4.4</dns_server2>
    			 <dns_server3><dns_server4><netbios_enable>yes</netbios_enable>
    			<netbios_ntype>0</netbios_ntype>
    			 <netbios_scope><no_tun_ipv6><verbosity_level>1</verbosity_level></no_tun_ipv6></netbios_scope></dns_server4></dns_server3></serverbridge_dhcp_end></serverbridge_dhcp_start></serverbridge_dhcp></client2client></passtos></local_networkv6></local_network></gwredir></remote_networkv6></remote_network></tunnel_networkv6></strictusercn></crlref></ipaddr></openvpn-server> 
    
    


  • Your VPN server pushes google DNS servers to the clients. But obviously your pfSense box provides DNS for the LAN. So delete the public DNS servers from the openVPN server settings and add your pfSenses LAN address there.



  • Ok. Tried that, and rebooted firewall, still not working. I have 2 vlans on this firewall, so the LAN/Trunk port doesn't have an IP. I added the IP of each VLAN to the pushed DNS servers. Anything else I'm missing?


  • Rebel Alliance Global Moderator

    So your hiding your rfc1918 space???  Makes it so easy to help you and talk about which network is what, etc.. :rolleyes:

    "I added the IP of each VLAN to the pushed DNS servers"

    So these IPs you added to your client do they resolve your local names?  Are your clients actually using them vs pointing to their local dns?  Do a simple nslookup, dig, host whatever your fav dns query tool is on your clients.. If phone install an app that allows you to query and give you a response.  For example the Hurricane electric APP..



  • I have 2 VLANs: 192.168.10.0/24 and 172.26.1.0/24. These subnets both resolve local hostnames. When nslookup is run over VPN, it is trying to use 192.168.10.1, but the DNS query times out.



  • What are your firewall rules on OpenVPN interface. Are the client allowed to access the DNS 192.168.10.1 on port 53 TCP/UDP?
    Is the DNS listening on 192.168.10.1??


  • Rebel Alliance Global Moderator

    If your running the resolver does your ACL allow your vpn tunnel network, ie the IP the vpn client gets to use the resolver?

    "it is trying to use 192.168.10.1, but the DNS query times out. "

    Maybe your vpn connection is just really bad on latency?  Can you ping 192.168.10.1 ?  When you do a traceroute to it does it go through the tunnel?



  • Update -

    I fixed the DNS query timeout in NSLOOKUP. Somehow, I had 'ALL" and some of the other interfaces checked in Services>DNS Forwarder>General DNS Forwarder Options>Interfaces. I changed this to have only the 'ALL" option.

    • My firewall rules on the OpenVPN interface are set to 'pass all IPv4 traffic'. I don't specifically pass port 53 in WAN or OpenVPN firewall rules. Do I need to do this with * set in the OpenVPN rules? Does port 53 TCP/UDP need a pass rule in the WAN interface?

    • DNS Forwarder is set to listen on 'ALL' interfaces.

    • I have the 192, 172, and OpenVPN networks set to 'Pass' on the DNS Resolver Access List. Does this have any effect if DNS Forwarder is used?

    • I can ping 192.168.10.1 and 172.26.0.1 over VPN, and latency is averaging 100ms. A network scan shows all devices on both subnets.

    • 'Redirect Gateway' option is set in OpenVPN. Shouldn't TRACERT show traffic flowing through the WAN IP of my pfsense box? It only shows client OpenVPN IP as first hop.



  • Any ideas? Has anyone setup OpenVPN from scratch and is able to resolve local hostnames?



  • I had this happen when I updated to 2.3.3. The following fixed it for me:

    I checked the box "Provide a default domain name to clients" under Advanced Client Settings for my OpenVPN server, filled in my local domain and now everything appears to work.