Problemi with dns resolution
-
the result is in attach.
Yes, force DNS cache update is already selected.
Thanks. -
Show me a screenshot of your firewall rules for the OpenVPN interface. I suspect you're not allowing UDP traffic or something like that.
-
Hi,
attached the required rules.
Thanks.
-
Set the protocol to Any and try again.
-
Hi,
unfortunately even with any dns resolution it fails.
Thanks.
-
Very strange. Does your firewall log show any relevant blocks while you're testing?
-
Hi,
no, I don't see deny in the logs.
Thanks. -
Yo @johnpoz Johnny joe ray bob, any thoughts?
-
We need more details on the setup. For clarity, is "host-to-site" referring to a remote access, road warrior setup? If so, post the server1.conf (/var/etc/openvpn).
We'll know more once we see the config, but is all traffic forced thru the tunnel?
-
Hi, attached server1.conf.
The address:
192.168.1.1
is the address of the router / dns referenced by the remote client that connects to my openvpn server.
The pfSense version is 2.3.2, do I need to update it?
Thanks.
server1.txt -
Not seeing anything out of the ordinary in the config. Looks like a standard, split tunnel config. Which raises the question though, since the client is using their own internet connection for the internet, why are you pushing public DNS? It's unnecessary. It's not the issue, but unnecessary.
So, the config tells me you have a split tunnel, remote access solution where the clients are using their own internet connection for everything except for traffic destined to 10.0.0.0/24 (server-side LAN). This is all standard stuff. The config looks nearly identical to all of the split tunnel configs I've deployed.
On split tunnel implementations, all of the subnets have to be unique on both ends, so the only thing that would cause issues, in this case, would be if the client's LAN is either 192.168.10.0/24 or 10.0.0.0/24 (or if the client is trying to connect from somewhere inside the server-side LAN). Outside of those scenarios, this particular issue appears to be on the client-side network. The client's PC is having issues resolving DNS, regardless of the VPN since they're using their own internet.
I would do a few things for starters:
- Update your PFsense firmware. (v2.3.2 is 16 versions behind and almost 3 years old)
- Remove the DNS push for 8.8.8.8 (uncheck "DNS SErver enable")
- Remove the recently checked "Force DNS cache update" option (not needed when not pushing DNS)
- Re-export the full OpenVPN windows installer package, send it to your user, have them uninstall their current package, manually delete the "C:\Program Files\OpenVPN" directory, then install the new package.
I suspect the remote-end had DNS issues even before connecting, but after the above is done, if they continue to have issues then the problem is definitely somewhere on the remote network. The client-end will need to troubleshoot DNS resolution on their end because all internet activity, in this case, is handled by the client-side network.
I would also verify there are no stray, statically set DNS entries or manually added persistent routes on the PC.
-
Hi,
I performed all indicated steps,now on the Windows 10 remote client I downloaded the openvpn client version 2.4.7.
Now when install to try it I have an error message saying that the version is not supported by Windows 10.
Thanks -
@marvosa
I downloaded the client from the openvpn web site and it worked.
I tried the vpn connection and now also Internet access works !
Thank you all for your help. -
Hi I have the same problem.
-
@wesleylc1 said in Problemi with dns resolution:
Hi I have the same problem.
Please start a new thread so we can offer targeted troubleshooting based on your network.
-
@marvosa I had already opened the case yesterday, follow the link
https://forum.netgate.com/topic/142192/slow-navigation-after-connecting-openvpn-problem-with-host-to-site-dns-resolution/3
Thank you.