[SOLVED] DNS Resolver not working with VPN Client

moussa854 · Feb 17, 2020, 3:30 PM

I have a working pfsense (basic router and firewall and up to date). I installed a VPN Client with an interface to route the LAN traffic through. However, when the VPN Client is on, the DNS Resolver become unbound and I cannot connect to the internet. Even after I restart the DNS resolver the internet will not work. If I turn off the VPN Client, then I will be able to get access to the internet again.

I tired to add an Access Lists but did not work.

I also tried to select the interfaces individually but that did not work.

Appreciate any thought or suggestion.

viragomann · Feb 17, 2020, 1:01 PM

I assume, you're missing an outbount NAT rule for localhost on the OpenVPN clients interface.

moussa854 · Feb 17, 2020, 1:18 PM

Thank you @viragomann for your suggestion. I duplicated all the rules in NAT > Outbound

The strange thing even with keeping the LAN interface to default, I lose access to the internet and the DNS Resolver turn into unbound when I turn the VPN Client on

viragomann · Feb 17, 2020, 1:30 PM

Are there some hints in the system log, general or DNS resolver?

moussa854 · Feb 17, 2020, 1:38 PM

Here is the the DNS resolver log after starting the VPN client

Feb 17 08:32:19 	unbound 	576:0 	info: service stopped (unbound 1.9.1).
Feb 17 08:32:19 	unbound 	576:0 	info: server stats for thread 0: 21 queries, 13 answers from cache, 8 recursions, 0 prefetch, 0 rejected by ip ratelimiting
Feb 17 08:32:19 	unbound 	576:0 	info: server stats for thread 0: requestlist max 0 avg 0 exceeded 0 jostled 0
Feb 17 08:32:19 	unbound 	576:0 	info: average recursion processing time 0.531053 sec
Feb 17 08:32:19 	unbound 	576:0 	info: histogram of recursion processing times
Feb 17 08:32:19 	unbound 	576:0 	info: [25%]=0.032768 median[50%]=0.393216 [75%]=0.762144
Feb 17 08:32:19 	unbound 	576:0 	info: lower(secs) upper(secs) recursions
Feb 17 08:32:19 	unbound 	576:0 	info: 0.000000 0.000001 1
Feb 17 08:32:19 	unbound 	576:0 	info: 0.016384 0.032768 1
Feb 17 08:32:19 	unbound 	576:0 	info: 0.065536 0.131072 1
Feb 17 08:32:19 	unbound 	576:0 	info: 0.262144 0.524288 2
Feb 17 08:32:19 	unbound 	576:0 	info: 0.524288 1.000000 2
Feb 17 08:32:19 	unbound 	576:0 	info: 1.000000 2.000000 1
Feb 17 08:32:19 	unbound 	576:0 	info: server stats for thread 1: 36 queries, 26 answers from cache, 10 recursions, 0 prefetch, 0 rejected by ip ratelimiting
Feb 17 08:32:19 	unbound 	576:0 	info: server stats for thread 1: requestlist max 8 avg 0.9 exceeded 0 jostled 0
Feb 17 08:32:19 	unbound 	576:0 	info: average recursion processing time 0.437046 sec
Feb 17 08:32:19 	unbound 	576:0 	info: histogram of recursion processing times
Feb 17 08:32:19 	unbound 	576:0 	info: [25%]=0.098304 median[50%]=0.32768 [75%]=0.49152
Feb 17 08:32:19 	unbound 	576:0 	info: lower(secs) upper(secs) recursions
Feb 17 08:32:19 	unbound 	576:0 	info: 0.008192 0.016384 1
Feb 17 08:32:19 	unbound 	576:0 	info: 0.032768 0.065536 1
Feb 17 08:32:19 	unbound 	576:0 	info: 0.065536 0.131072 1
Feb 17 08:32:19 	unbound 	576:0 	info: 0.131072 0.262144 1
Feb 17 08:32:19 	unbound 	576:0 	info: 0.262144 0.524288 4
Feb 17 08:32:19 	unbound 	576:0 	info: 0.524288 1.000000 1
Feb 17 08:32:19 	unbound 	576:0 	info: 1.000000 2.000000 1
Feb 17 08:32:22 	unbound 	4806:0 	notice: init module 0: validator
Feb 17 08:32:22 	unbound 	4806:0 	notice: init module 1: iterator
Feb 17 08:32:22 	unbound 	4806:0 	info: start of service (unbound 1.9.1).

Here is the general log

Feb 17 08:17:00 	kernel 		ovpnc1: link state changed to DOWN
Feb 17 08:17:00 	check_reload_status 		Reloading filter
Feb 17 08:17:15 	rc.gateway_alarm 	33120 	>>> Gateway alarm: GCPVPNINTERFACE_VPNV4 (Addr:10.8.0.1 Alarm:1 RTT:19.156ms RTTsd:.348ms Loss:21%)
Feb 17 08:17:15 	check_reload_status 		updating dyndns GCPVPNINTERFACE_VPNV4
Feb 17 08:17:15 	check_reload_status 		Restarting ipsec tunnels
Feb 17 08:17:15 	check_reload_status 		Restarting OpenVPN tunnels/interfaces
Feb 17 08:17:15 	check_reload_status 		Reloading filter
Feb 17 08:17:16 	php-fpm 	53460 	/rc.openvpn: Gateway, none 'available' for inet6, use the first one configured. 'WAN_DHCP6'
Feb 17 08:17:16 	php-fpm 	53460 	/rc.openvpn: OpenVPN: One or more OpenVPN tunnel endpoints may have changed its IP. Reloading endpoints that may use GCPVPNINTERFACE_VPNV4.
Feb 17 08:32:15 	php-fpm 	53460 	OpenVPN terminate old pid: 98185
Feb 17 08:32:15 	php-fpm 	53460 	OpenVPN PID written: 99423
Feb 17 08:32:15 	check_reload_status 		Reloading filter
Feb 17 08:32:17 	kernel 		ovpnc1: link state changed to UP
Feb 17 08:32:17 	check_reload_status 		rc.newwanip starting ovpnc1
Feb 17 08:32:18 	php-fpm 	66584 	/rc.newwanip: rc.newwanip: Info: starting on ovpnc1.
Feb 17 08:32:18 	php-fpm 	66584 	/rc.newwanip: rc.newwanip: on (IP address: 10.8.0.9) (interface: GCPVPNINTERFACE[opt1]) (real interface: ovpnc1).
Feb 17 08:32:19 	php-fpm 	66584 	/rc.newwanip: Gateway, none 'available' for inet6, use the first one configured. 'WAN_DHCP6'
Feb 17 08:32:23 	php-fpm 	66584 	/rc.newwanip: Creating rrd update script
Feb 17 08:32:25 	php-fpm 	66584 	/rc.newwanip: pfSense package system has detected an IP change or dynamic WAN reconnection - 10.8.0.9 -> 10.8.0.9 - Restarting packages.
Feb 17 08:32:25 	check_reload_status 		Starting packages
Feb 17 08:32:26 	php-fpm 	76683 	/rc.start_packages: Restarting/Starting all packages.
Feb 17 08:32:27 	php 		[pfBlockerNG] DNSBL parser daemon started
Feb 17 08:32:27 	php_pfb 		[pfBlockerNG] filterlog daemon started

moussa854 · Feb 17, 2020, 3:24 PM

Thank you @viragomann for helping, truly appreciated.

I was able to solve my problem by changing the compression to "Omit Preference + Disable LZO Compression"

viragomann · Feb 18, 2020, 2:16 PM

@moussa854
Strange issue. Thanks for coming back and posting the solution.