OpenVPN only recognizes the first of two DNS servers

ffarkas

Hi everyone,
I have a pfSense with a configured OpenVPN server. I have entered two DNS servers in the configuration. The first (192.168.3.8) is from the domain controller and the second (192.168.3.1) is pfSense.

I already tried to fix the problem with the settings "Block Outside DNS" and "Force DNS cache update", unfortunately this did not help.

My clients are Windows 10 and OpenVPN GUI. When I connect to pfSense, however, only the first DNS server configured in pfSense is used by Windows. The second one is ignored. I can only reach the first DNS server via nslookup and ping.

How can I fix that both DNS servers are used?

pfSense version: 2.4.4-RELEASE-p2
OpenVPN GUI version: 11.10.0.0

Thank you very much for your help
ffarkas

Konstanti

@ffarkas said in OpenVPN only recognizes the first of two DNS servers:

192.168.3.1

Hey
As far as I understand, two DNS servers , it is the main and spare. If the first is not available, then there is an appeal to the second , third,....
To be able to use two DNS servers, you need to configure 192.168.3.8 so that when the DNS query is not for a domain, it would refer to 192.168.3.1. Then the client will use two DNS servers

Therefore, internal requests will handle 192.168.3.8 , and external requests will be forwarded to 192.168.3.1
And it will be enough for the client to specify only one server in the settings 192.168.3.8

ffarkas

Hello @Konstanti,
I actually intended both DNS servers to resolve in the same zone (testdomain.local). The Microsoft DNS server should take over all Active Directory integrated devices and the pfSense all others as well as the external ones. So I thought if I specified both in OpenVPN, the Windows clients would automatically search on the other DNS server when a name cannot be resolved.

I will probably have to rethink the entire network structure.

Thank you

Derelict

All DNS servers configured on a client need to resolve the same answers for the same queries.

Your solution is likely two AD DNS servers if you want redundancy (and you should).

johnpoz

@ffarkas said in OpenVPN only recognizes the first of two DNS servers:

Windows clients would automatically search on the other DNS server when a name cannot be resolved

One of the most common misconceptions to how dns works at a basic level.

As stated by Derelict all NS pointed to by a client need to be able to resolve the the same stuff the same way or your going to have a bad day.

If a NS returns NX for something that is asked for - then the client stops asking.. Because it was told that doesn't exist, so why should it go ask anything else for something that doesn't exist. The only time a client will go ask the other NS is if there is a time out.. And you can never be sure which NS a client will be asking out of the NS listed..