Problemi with dns resolution

sasa1 · Mar 28, 2019, 5:57 PM

yes

KOM · Mar 28, 2019, 6:00 PM

I had to ask. You didn't explicitly say, and I never assume the obvious. I have a similar config and it works for me. If the client runs:

ipconfig /all

what is showing for DNS servers?

sasa1 · Mar 29, 2019, 1:34 PM

Hi,
the dns shown is:
8.8.8.8
I attach picture.
Thanks.

KOM · Mar 29, 2019, 1:39 PM

OK, so it seems ot be aware of DNS available to it. Can you ping 8.8.8.8? What happens when you run this on the client:

nslookup www.microsoft.com

sasa1 · Mar 29, 2019, 1:47 PM

the ping is OK, in attached result about dns resolution.
Thanks.

KOM · Mar 29, 2019, 1:47 PM

Well, there is your problem. Can you ping 8.8.8.8?

sasa1 · Mar 29, 2019, 1:49 PM

yes, ping to 8.8.8.8 is OK.
Thanks.

KOM · Mar 29, 2019, 1:55 PM

OK, so what happens when you run:

nslookup
server 8.8.8.8
www.microsoft.com

As I recall, on the OpenVPN page there were some mitigation options for Windows 10 clients. Have you tried checking Force DNS cache update under Advanced Client Settings?

sasa1 · Mar 29, 2019, 2:07 PM

the result is in attach.
Yes, force DNS cache update is already selected.
Thanks.

KOM · Mar 29, 2019, 2:08 PM

Show me a screenshot of your firewall rules for the OpenVPN interface. I suspect you're not allowing UDP traffic or something like that.

sasa1 · Mar 29, 2019, 2:11 PM

Hi,
attached the required rules.
Thanks.

KOM · Mar 29, 2019, 2:15 PM

Set the protocol to Any and try again.

sasa1 · Mar 29, 2019, 2:31 PM

Hi,
unfortunately even with any dns resolution it fails.
Thanks.

KOM · Mar 29, 2019, 2:40 PM

Very strange. Does your firewall log show any relevant blocks while you're testing?

sasa1 · Mar 29, 2019, 5:31 PM

Hi,
no, I don't see deny in the logs.
Thanks.

KOM · Mar 29, 2019, 5:32 PM

Yo @johnpoz Johnny joe ray bob, any thoughts?

marvosa · Mar 30, 2019, 5:19 AM

We need more details on the setup. For clarity, is "host-to-site" referring to a remote access, road warrior setup? If so, post the server1.conf (/var/etc/openvpn).

We'll know more once we see the config, but is all traffic forced thru the tunnel?

sasa1 · Mar 30, 2019, 10:46 AM

Hi, attached server1.conf.
The address:
192.168.1.1
is the address of the router / dns referenced by the remote client that connects to my openvpn server.
The pfSense version is 2.3.2, do I need to update it?
Thanks.
server1.txt

marvosa · Mar 30, 2019, 2:40 PM

Not seeing anything out of the ordinary in the config. Looks like a standard, split tunnel config. Which raises the question though, since the client is using their own internet connection for the internet, why are you pushing public DNS? It's unnecessary. It's not the issue, but unnecessary.

So, the config tells me you have a split tunnel, remote access solution where the clients are using their own internet connection for everything except for traffic destined to 10.0.0.0/24 (server-side LAN). This is all standard stuff. The config looks nearly identical to all of the split tunnel configs I've deployed.

On split tunnel implementations, all of the subnets have to be unique on both ends, so the only thing that would cause issues, in this case, would be if the client's LAN is either 192.168.10.0/24 or 10.0.0.0/24 (or if the client is trying to connect from somewhere inside the server-side LAN). Outside of those scenarios, this particular issue appears to be on the client-side network. The client's PC is having issues resolving DNS, regardless of the VPN since they're using their own internet.

I would do a few things for starters:

Update your PFsense firmware. (v2.3.2 is 16 versions behind and almost 3 years old)
Remove the DNS push for 8.8.8.8 (uncheck "DNS SErver enable")
Remove the recently checked "Force DNS cache update" option (not needed when not pushing DNS)
Re-export the full OpenVPN windows installer package, send it to your user, have them uninstall their current package, manually delete the "C:\Program Files\OpenVPN" directory, then install the new package.

I suspect the remote-end had DNS issues even before connecting, but after the above is done, if they continue to have issues then the problem is definitely somewhere on the remote network. The client-end will need to troubleshoot DNS resolution on their end because all internet activity, in this case, is handled by the client-side network.

I would also verify there are no stray, statically set DNS entries or manually added persistent routes on the PC.

sasa1 · Apr 1, 2019, 9:43 AM

Hi,
I performed all indicated steps,now on the Windows 10 remote client I downloaded the openvpn client version 2.4.7.
Now when install to try it I have an error message saying that the version is not supported by Windows 10.
Thanks