PfSense with AWS over IPsec DNS - Need help :)

[ceofreak]

Hi guys,

First things first - I am aware that all clients should use the AD DNS as a primary DNS Server, but because we have no on-premises Server at all, the resolve time would go up from ~50ms to ~200ms because the request first goes over the IPSec tunnel to reach the Domain Controller.

Now I'm running into what I think is a DNS related issue. The setup is:

Internal Network ->pfSense ->IPSec ->AWS -> Server 2016 DC

So our Domain Controller resides inside of AWS. I can join computers to the domain, no problem.

pfSense handles DNS and DHCP. A Domain Override was set up on pfSense.

So as I said, I can join the Domain and as long as the user is local admin on the machine, I have no issues. When the user isn't local admin and tries to install something, it takes minutes until the UAC prompt pops up and asks for Domain Admin credentials.

Now I did not set any forwarders or did any configuration on the DC DNS at all. The clients that join the domain register in the DC DNS with the correct IP.

A few tests I did, lets call the DC DC1 and the domain mydomain.com

NSLOOKUP on DC1:

DC1: Doesn't look up
DC1.mydomain.com: Does look up

NSLOOKUP on a Client in the internal network:

DC1: Does look up
DC1.mydomain.com: Does look up
mydomain.com: does look up

pfSense Diagnotics / DNS Lookup:

DC1: Looks up over 127.0.0.1 0msec
DC1.mydomain.com: looks up over 127.0.0.1 0msec

Now I just assume it could be a DNS issue. Everything works perfectly fine as long as the user is local admin, but that is not a desired state.

I'm really stuck here and need some advise :)