DNS Resolver redirect over OpenVPN with failover gateway group

  • I have an edge case here. Maybe someone tried this before.

    I'm trying to forward most DNS queries over an OpenVPN (PIA) connection, with failover to WAN. When the VPN is down, I want queries to go out through default WAN.

    So far, the VPN connection is working fine. I can route traffic from LAN hosts over the VPN through NAT and firewall rules with a Gateway Group which has VPN as primary and WAN as secondary.

    My problem is with the DNS Resolver. As far as I can tell, I have to use Floating Rules because the DNS Resolver falls in the "Filter traffic from the firewall itself" category. But it doesn't seem to work. I see outgoing traffic in the logs, but hosts are not resolved.

    The floating rule that I tried:
    Action: Pass
    Interface: WAN
    Direction: out
    Proto: TCP/UDP
    Source: any
    Destination: any
    Destination Port: 853
    Gateway: PIA gateway group

    Some other settings:

    • DNS resolver set to forwarding mode, enabled DNSSEC, SSL/TLS, Register DHCP static mappings in the DNS Resolver
    • Gateway Group with PIA as Tier 1 and WAN as Tier 2
    • NAT Outbound Hybrid. Interface: PIA, Adress: Interface Address
    • multi-wan setup
    • setup DNS Servers for each gateway in General Setup

Log in to reply