Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    DNS Resolver redirect over OpenVPN with failover gateway group

    Scheduled Pinned Locked Moved Routing and Multi WAN
    1 Posts 1 Posters 199 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • N
      netnewb2
      last edited by netnewb2

      I have an edge case here. Maybe someone tried this before.

      I'm trying to forward most DNS queries over an OpenVPN (PIA) connection, with failover to WAN. When the VPN is down, I want queries to go out through default WAN.

      So far, the VPN connection is working fine. I can route traffic from LAN hosts over the VPN through NAT and firewall rules with a Gateway Group which has VPN as primary and WAN as secondary.

      My problem is with the DNS Resolver. As far as I can tell, I have to use Floating Rules because the DNS Resolver falls in the "Filter traffic from the firewall itself" category. But it doesn't seem to work. I see outgoing traffic in the logs, but hosts are not resolved.

      The floating rule that I tried:
      Action: Pass
      Interface: WAN
      Direction: out
      Proto: TCP/UDP
      Source: any
      Destination: any
      Destination Port: 853
      Gateway: PIA gateway group

      Some other settings:

      • DNS resolver set to forwarding mode, enabled DNSSEC, SSL/TLS, Register DHCP static mappings in the DNS Resolver
      • Gateway Group with PIA as Tier 1 and WAN as Tier 2
      • NAT Outbound Hybrid. Interface: PIA, Adress: Interface Address
      • multi-wan setup
      • setup DNS Servers for each gateway in General Setup
      1 Reply Last reply Reply Quote 0
      • First post
        Last post
      Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.