PfSense with AWS over IPsec DNS - Need help :)



  • Hi guys,

    First things first - I am aware that all clients should use the AD DNS as a primary DNS Server, but because we have no on-premises Server at all, the resolve time would go up from ~50ms to ~200ms because the request first goes over the IPSec tunnel to reach the Domain Controller.

    Now I'm running into what I think is a DNS related issue. The setup is:

    Internal Network ->pfSense ->IPSec ->AWS -> Server 2016 DC

    So our Domain Controller resides inside of AWS. I can join computers to the domain, no problem.

    pfSense handles DNS and DHCP. A Domain Override was set up on pfSense.

    So as I said, I can join the Domain and as long as the user is local admin on the machine, I have no issues. When the user isn't local admin and tries to install something, it takes minutes until the UAC prompt pops up and asks for Domain Admin credentials.

    Now I did not set any forwarders or did any configuration on the DC DNS at all. The clients that join the domain register in the DC DNS with the correct IP.

    A few tests I did, lets call the DC DC1 and the domain mydomain.com

    NSLOOKUP on DC1:

    DC1: Doesn't look up
    DC1.mydomain.com: Does look up

    NSLOOKUP on a Client in the internal network:

    DC1: Does look up
    DC1.mydomain.com: Does look up
    mydomain.com: does look up

    pfSense Diagnotics / DNS Lookup:

    DC1: Looks up over 127.0.0.1 0msec
    DC1.mydomain.com: looks up over 127.0.0.1 0msec

    Now I just assume it could be a DNS issue. Everything works perfectly fine as long as the user is local admin, but that is not a desired state.

    I'm really stuck here and need some advise :)