OpenVPN and DNS - not resolving internal names



  • Hi folks,

    I have the following setup and working:

    Pfsense 2.3.4 with DNS and DHCP working. I also have openvpn setup and its working (somewhat). When I am local in my LAN, I can resolve internal names, for example nas.example.net.
    When I use openvpn, I tunnel all internet traffic thru the tunnel. When I go to google.com, it resolves and works just fine. When I enter an IP address of my NAS into the browser like 192.168.1.50, I can get the NAS web interface no problem. However, when I enter nas.example.com when using the vpn tunnel, it does not get resolved.

    The DNS Resolver has the proper Access List entered, and I permit the VPN tunnel subnet to access the DNS resolver (local LAN is 192.168.1.0/24; VPN is 192.168.4.0/24).

    I have static DHCP and DHCP Reg. checked. In Host Overrides, I have entered the proper info (its working fine from internal LAN).

    So basically everything is working find and as it should from local LAN, browsing the internet and accessing local servers and sites via IP over the tunnel works fine, just using DNS names over the tunnel for internal servers and sites, does not work.

    Any ideas?

    Thanks.

    Eddi



  • Doing some more digging and found this issue:

    On a remote PC (client), the Win7 Pro install gets a domain from an AD. So the PC has mycompany.com as domain name. I have OpenVPN installed, and as I said in my first post, everything is working fine, besides resolving names as entered in Host Overrides.

    When I do "nslookup -d nas.example.net", these are are the details I get:

    
    C:\Users\eduard>nslookup -d nas.example.net
    ------------
    Got answer:
        HEADER:
            opcode = QUERY, id = 1, rcode = NOERROR
            header flags:  response, auth. answer, want recursion, recursion avail.
            questions = 1,  answers = 1,  authority records = 0,  additional = 0
    
        QUESTIONS:
            1.1.168.192.in-addr.arpa, type = PTR, class = IN
        ANSWERS:
        ->  1.1.168.192.in-addr.arpa
            name = pfsense.example.net
            ttl = 3600 (1 hour)
    
    ------------
    Server:  pfsense.example.net
    Address:  192.168.1.1
    
    ------------
    Got answer:
        HEADER:
            opcode = QUERY, id = 2, rcode = NXDOMAIN
            header flags:  response, want recursion, recursion avail.
            questions = 1,  answers = 0,  authority records = 1,  additional = 0
    
        QUESTIONS:
            nas.example.net.mycompany.com, type = A, class = IN
        AUTHORITY RECORDS:
        ->  (root)
            ttl = 3396 (56 mins 36 secs)
            primary name server = a.root-servers.net
            responsible mail addr = nstld.verisign-grs.com
            serial  = 2017051701
            refresh = 1800 (30 mins)
            retry   = 900 (15 mins)
            expire  = 604800 (7 days)
            default TTL = 86400 (1 day)
    
    

    So what is happening, is, that windows will append example.com, to the internal FQDN that I am trying to reach, in this case nas.example.net.mycompany.com, but it should just be nas.example.net.

    When I do a DNS leak test, it all clears and nothing is leaked, so the remote DNS server does not see my DNS queries …

    Hope this makes sense.

    Am I missing something, or why is this not working?

    Cheers.


Log in to reply