Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Multiple OpenVPN mapped to different WiFi SSID (Unifi)

    Scheduled Pinned Locked Moved OpenVPN
    49 Posts 4 Posters 7.7k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • johnpozJ
      johnpoz LAYER 8 Global Moderator
      last edited by

      You want unbound to use your vpn connection for it lookups?

      An intelligent man is sometimes forced to be drunk to spend time with his fools
      If you get confused: Listen to the Music Play
      Please don't Chat/PM me for help, unless mod related
      SG-4860 24.11 | Lab VMs 2.8, 24.11

      Antonio76A 1 Reply Last reply Reply Quote 0
      • Antonio76A
        Antonio76 @johnpoz
        last edited by Antonio76

        @johnpoz correct. I'm playing with settings and rule but seems that I got no luck . In DNS resolver (over TLS) , all the network are selected and outgoing network interfaces are selected. No VPN providers DNS are set in the general config . I do not allow clients to override Pfsense DNS default DNS via FW rule

        M 1 Reply Last reply Reply Quote 0
        • Antonio76A
          Antonio76
          last edited by

          Should be pretty much this :/

          63f770c8-3535-4418-915a-fb2601276721-image.png

          1 Reply Last reply Reply Quote 0
          • johnpozJ
            johnpoz LAYER 8 Global Moderator
            last edited by johnpoz

            If your going to forward through a tunnel... Why would you want that to go through another tunnel? I don't get the point other than you want it ever freaking slower?

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.8, 24.11

            1 Reply Last reply Reply Quote 0
            • M
              mcarson75 @Antonio76
              last edited by

              @Antonio76 I have a similar situation, with different VPNs to different countries on different VLANs. The way that Unbound works is that it will send queries out to all the outgoing interfaces, and the way I understand it, it will use the first reply.

              This is an issue if you want to go to multiple countries. If I am on my local network, I want replies from local DNS servers, and if I'm on my VPN to the US I want replies from DNS in the US. If you have a single unbound resolver. the server farther away will never win (my VPN to the US has about 250 ms ping time from here).

              What you want is queries from a particular VLAN to only be sent out via that VLAN's gateway (i.e. routed over that VPN) but as near as I can tell you can't do that with a single instance of unbound. My solution was to run a separate DNS server (in a VM in my case) on each VLAN to ensure that queries are only sent through the proper gateway. You can also run multiple DNS servers on pfsense if you enable both the forwarder (dnsmasq) and resolver (unbound). You could also install bind to get a third. You would need to run each on a separate port of course.

              I've never played with bind, but it's possible that with the multiple views you might be able to route it correctly with a single server. I just don't have any experience with it.

              Antonio76A 1 Reply Last reply Reply Quote 1
              • johnpozJ
                johnpoz LAYER 8 Global Moderator
                last edited by johnpoz

                If your wanting a client to use dns from vpn X... Then have the client ASK for dns he is doing down the tunnel.. Not sure how you expect unbound to know which interface to use for which client.

                Set your dns on the CLIENT!! Simple via dhcp or actually set it on the client.

                Or you could set it up with views on unbound.. Its had view support for awhile, then yes specific forwarders for each view.. But your not going to be able to do that in the qui, and just way simpler to set the dns on the client. I have some threads about here setting up views.. Simple enough to do.. If that the route you want to go - but why?? Just set it on the client.. And let your unbound resolve for your normal clients that are actually using your wan.

                This is specific SSID for clients to use vpn X, then on your dhcp server for this vlan - just hand out the any dns you want your clients to ask.. Not Pfsense IP, and that query will go down the vpn tunnel.

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.8, 24.11

                M Antonio76A 2 Replies Last reply Reply Quote 0
                • M
                  mcarson75 @johnpoz
                  last edited by mcarson75

                  @johnpoz I think you misunderstood what I said, but if there's a simpler way to do it I'm willing to learn.

                  I have three subnets - 192.168.2.0/24 is my local ISP, 192.168.3.0/24 is a VPN to a VPS I have in the US, and 192.168.4.0/24 is a VPN to my parents' house, also in the US.

                  I set up three separate VMs running unbound, one on each of those subnets - 192.168.2.5, 192.168.3.5, 192.168.4.5. Clients on 192.168.2.0/24 get 192.168.2.5 from DHCP for instance.

                  My local one is set up as a recursive resolver, while my VPS-VPN one goes to Cloudflare (otherwise multiple queries at 250 ms each to recurse) and the one for my parents' queries their pfsense box's unbound on the other end.

                  This way I ensure that DNS queries on my VPN network only go through the VPN gateway.

                  Is there a way to do all that using just unbound in my pfsense instead? And also using pfBlockerNG? (I currently also have PiHole running on each VM)

                  1 Reply Last reply Reply Quote 0
                  • Antonio76A
                    Antonio76 @johnpoz
                    last edited by Antonio76

                    @johnpoz your point make sense . I just forced the client to use PFsense as only dns . A FW rule is preventing to look up different DNS .
                    I set up my Pfsense to do not override DNS settings too on a client side . Sure I can revert but what is the point security wise ?
                    BTW I have investigated the DHCP part but got not internet if enabled explictly in the DHCP server .

                    1 Reply Last reply Reply Quote 0
                    • Antonio76A
                      Antonio76 @mcarson75
                      last edited by Antonio76

                      @mcarson75 Indeed I have installed BIND yesterday. Now I'm going to play around it .
                      Local DNS should is faster than VPN provider latency wise . I could dockerize a DNS server but goal is to let Pfsense handle this without mantaininng multiple componets. Actually I can dockerize a Pi-Hole too . Done already in past and works fine

                      Antonio76A 1 Reply Last reply Reply Quote 0
                      • Antonio76A
                        Antonio76 @Antonio76
                        last edited by

                        @mcarson75 no joy enabling BIND on the VLAN . OpenVPN won't start
                        6f092977-670e-4df0-ad6b-57ba26c064b3-image.png

                        1 Reply Last reply Reply Quote 0
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator
                          last edited by

                          Again unbound can do this for you via views, and sure bind can do it - and while bind package has as a views section.. Your still going to have to do the config by hand..

                          How many clients are you going to have on this special ssid vlan? You do understand clients normally cache their own dns.. Are the clients on this vlan iot type devices that do not have a local cache of their own..

                          My take is you want these special vpn ssids so you can circumvent specific geo restrictions.. Keep in mind that both unbound and bind are going to be using a common cache..

                          So you have client look up host.domain.tld from country A, now when you have client ask pfsense for host.domain.tld but you want the answer to be the IP for country B - its just going to get the cache from country A, etc. etc..

                          Your going to be better off just letting the clients ask some public dns via your vpn connection... Your doing a lot of extra work for what a couple of ms of query time for what exactly... I don't think these clients you have on this country based vpns are going to be doing a lot of "user" internet browsing where cache helps, etc.

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                          M 1 Reply Last reply Reply Quote 0
                          • Antonio76A
                            Antonio76
                            last edited by Antonio76

                            Is not a Ms gain, is the DNSBL feature that I need . I can sacrifice time for resolve but keep the privacy and security is what concern me the most .

                            About the shared cache you are right

                            About DHCP:
                            Local DNS flush is not the issue . SSID displayed as connect, no internet

                            3bbbc095-28c4-408e-b0fb-9bc89b536419-image.png

                            M 1 Reply Last reply Reply Quote 0
                            • M
                              mcarson75 @Antonio76
                              last edited by

                              @Antonio76 It looks like you are blocking LAN in your firewall rules, but your DNS server is on your LAN. You should push 192.168.49.1 as your DNS server instead of 192.168.1.1. It should be running on all interfaces.

                              Alternatively you could add a firewall rule to allow access on port 53 only to 192.168.1.1.

                              Antonio76A 1 Reply Last reply Reply Quote 0
                              • Antonio76A
                                Antonio76 @mcarson75
                                last edited by Antonio76

                                @mcarson75 got it fixed via DNS forwarder (enabled) on that VLAN 49 . (I had it disabled)

                                Still debugging because beside click and click , I need to understand the Pfsense logic behind

                                e60c7092-00d1-43e0-9256-c76e38a9aedf-image.png

                                1 Reply Last reply Reply Quote 0
                                • johnpozJ
                                  johnpoz LAYER 8 Global Moderator
                                  last edited by

                                  @Antonio76 said in Multiple OpenVPN mapped to different WiFi SSID (Unifi):

                                  is the DNSBL feature that I need

                                  And why are you going to youporn.com? I would assume you would only go there if you wanted too.. Do you have teenage boys or something your trying to filter?

                                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                                  If you get confused: Listen to the Music Play
                                  Please don't Chat/PM me for help, unless mod related
                                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                                  Antonio76A 1 Reply Last reply Reply Quote 0
                                  • M
                                    mcarson75 @johnpoz
                                    last edited by

                                    My take is you want these special vpn ssids so you can circumvent specific geo restrictions.

                                    It's not always about geo restrictions. I'm an American working in Asia. All my banks and other accounts are in the US. I just feel more secure accessing them from a US-based VPN. Perhaps it's overkill. But yeah, most of the time I am browsing internet on my VPN to the US, and I want an ad-blocker.

                                    Antonio76A 1 Reply Last reply Reply Quote 1
                                    • Antonio76A
                                      Antonio76 @johnpoz
                                      last edited by

                                      @johnpoz porn list is one of my DNSBL. Don't get me wrong for the test selection :) . but DNSBL was the goal .
                                      Small kids, better be safe

                                      1 Reply Last reply Reply Quote 0
                                      • johnpozJ
                                        johnpoz LAYER 8 Global Moderator
                                        last edited by johnpoz

                                        @mcarson75 said in Multiple OpenVPN mapped to different WiFi SSID (Unifi):

                                        I just feel more secure accessing them from a US-based VPN.

                                        That scenario is not what it sounds like he is wanting... He has multiple vpn connections to different countries... Sorry but that just SCREAMS circumvention...

                                        Why do his small kids need to be surfing his allowed list through a vpn that goes to country xyz?

                                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                                        If you get confused: Listen to the Music Play
                                        Please don't Chat/PM me for help, unless mod related
                                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                                        M 1 Reply Last reply Reply Quote 0
                                        • Antonio76A
                                          Antonio76 @mcarson75
                                          last edited by

                                          @mcarson75 correct. Blocking ADS, crypto javascript , privacy, tracking and porn for kid. Not fakenews because it actually it blocks what is left or real news ;) .

                                          To be clear , I need access resource in other countries via DNSBL . That's the goal . No proxy PAC please . . :)

                                          1 Reply Last reply Reply Quote 0
                                          • M
                                            mcarson75 @johnpoz
                                            last edited by

                                            Why do his small kids need to be surfing his allowed list through a vpn that goes to country xyz?

                                            You're arguing as to why you disagree with his use case. That's your opinion, but honestly I don't feel it's adding anything to the discussion about whether he can do what he wants or not.

                                            Antonio76A 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.