DNS not resolving over VPN

msalonius · Mar 19, 2018, 5:41 PM

Hi All,

I have a IPSEC site to site VPN

Site 1: 192.168.1.0/24
Site 2: 10.10.10.0/24 -> DNS Server 10.10.10.9

The PC's in Site 1 cannot resolve DNS via the remote DNS Server…I can ping anything from Site 1 to Site 2 and vice versa via their IP addresses but I can't resolve anything.

Any Ideas?

msalonius · Mar 20, 2018, 2:01 AM

Any ideas anyone?

MrV0 · Mar 21, 2018, 12:40 PM

Have you setup DNS suffixes in TCP/IP settings on the site 1 systems?
Please can you show your DHCP scope options.

NogBadTheBad · Mar 21, 2018, 3:51 PM

Tried adding site 1 subnet to the access list ?

Services -> DNS Resolver -> Access Lists

https://doc.pfsense.org/index.php/Unbound_DNS_Resolver#Access_Lists_Tab

MrV0 · Mar 21, 2018, 4:46 PM

@NogBadTheBad:

Tried adding site 1 subnet to the access list ?

Services -> DNS Resolver -> Access Lists

https://doc.pfsense.org/index.php/Unbound_DNS_Resolver#Access_Lists_Tab

Do you have a windows server handling DHCP?

derjuden · Apr 19, 2023, 5:22 PM

Since this is basically my same problem.
I setup a site to site VPN.
Site 1 is a remote office.
Site 2 is our DC with our domain controller and DNS servers.
users at site 1 need to reach systems by DNS at site 2.

I added a Domain Override to the DNS resolver in the pfsense firewall at site 1 with our domain and the DNS server at site 2 to send the queries to. When I did this the only thing that can be resolved by a DNS is my primary Domain controller. It happens to be a DNS server as well.
I've tried adding the DNS servers at site 2 to the general setup DNS server list as well after the ISP DNS servers.
at Site 2 I have a watchguard firewall.
I looked at this as well https://docs.netgate.com/pfsense/en/latest/vpn/ipsec/access-firewall-over-ipsec.html#ipsec-fwtraffic
but I don't think this is relates since if I set the DNS server on a local machine to the IP of the DNS server at site 2 I can resolve everything at site 2. I'd like to just do this through the pfsense at site 1.

I just put my domain DNS server as the primary DNS for the DHCP leases ( Services / DHCP Server / LAN) then google DNS, and then lastly our ISP DNS. Everything works as expected this way.