[SOLVED] DNS Resolver not working with VPN Client



  • I have a working pfsense (basic router and firewall and up to date). I installed a VPN Client with an interface to route the LAN traffic through. However, when the VPN Client is on, the DNS Resolver become unbound and I cannot connect to the internet. Even after I restart the DNS resolver the internet will not work. If I turn off the VPN Client, then I will be able to get access to the internet again.
    pfSense_localdomain_-Status__Dashboard-_Firefox_Developer_Edition.png

    I tired to add an Access Lists but did not work.
    pfSense_localdomain_-Services__DNS_Resolver__Access_Lists__Edit-_Firefox_Developer_Edition.png

    I also tried to select the interfaces individually but that did not work.
    pfSense_localdomain_-Services__DNS_Resolver__General_Settings-_Firefox_Developer_Edition.png

    Appreciate any thought or suggestion.



  • I assume, you're missing an outbount NAT rule for localhost on the OpenVPN clients interface.



  • Thank you @viragomann for your suggestion. I duplicated all the rules in NAT > Outbound
    pfSense_localdomain_-Firewall__NAT__Outbound-_Firefox_Developer_Edition.png

    The strange thing even with keeping the LAN interface to default, I lose access to the internet and the DNS Resolver turn into unbound when I turn the VPN Client on



  • Are there some hints in the system log, general or DNS resolver?



  • Here is the the DNS resolver log after starting the VPN client

    Feb 17 08:32:19 	unbound 	576:0 	info: service stopped (unbound 1.9.1).
    Feb 17 08:32:19 	unbound 	576:0 	info: server stats for thread 0: 21 queries, 13 answers from cache, 8 recursions, 0 prefetch, 0 rejected by ip ratelimiting
    Feb 17 08:32:19 	unbound 	576:0 	info: server stats for thread 0: requestlist max 0 avg 0 exceeded 0 jostled 0
    Feb 17 08:32:19 	unbound 	576:0 	info: average recursion processing time 0.531053 sec
    Feb 17 08:32:19 	unbound 	576:0 	info: histogram of recursion processing times
    Feb 17 08:32:19 	unbound 	576:0 	info: [25%]=0.032768 median[50%]=0.393216 [75%]=0.762144
    Feb 17 08:32:19 	unbound 	576:0 	info: lower(secs) upper(secs) recursions
    Feb 17 08:32:19 	unbound 	576:0 	info: 0.000000 0.000001 1
    Feb 17 08:32:19 	unbound 	576:0 	info: 0.016384 0.032768 1
    Feb 17 08:32:19 	unbound 	576:0 	info: 0.065536 0.131072 1
    Feb 17 08:32:19 	unbound 	576:0 	info: 0.262144 0.524288 2
    Feb 17 08:32:19 	unbound 	576:0 	info: 0.524288 1.000000 2
    Feb 17 08:32:19 	unbound 	576:0 	info: 1.000000 2.000000 1
    Feb 17 08:32:19 	unbound 	576:0 	info: server stats for thread 1: 36 queries, 26 answers from cache, 10 recursions, 0 prefetch, 0 rejected by ip ratelimiting
    Feb 17 08:32:19 	unbound 	576:0 	info: server stats for thread 1: requestlist max 8 avg 0.9 exceeded 0 jostled 0
    Feb 17 08:32:19 	unbound 	576:0 	info: average recursion processing time 0.437046 sec
    Feb 17 08:32:19 	unbound 	576:0 	info: histogram of recursion processing times
    Feb 17 08:32:19 	unbound 	576:0 	info: [25%]=0.098304 median[50%]=0.32768 [75%]=0.49152
    Feb 17 08:32:19 	unbound 	576:0 	info: lower(secs) upper(secs) recursions
    Feb 17 08:32:19 	unbound 	576:0 	info: 0.008192 0.016384 1
    Feb 17 08:32:19 	unbound 	576:0 	info: 0.032768 0.065536 1
    Feb 17 08:32:19 	unbound 	576:0 	info: 0.065536 0.131072 1
    Feb 17 08:32:19 	unbound 	576:0 	info: 0.131072 0.262144 1
    Feb 17 08:32:19 	unbound 	576:0 	info: 0.262144 0.524288 4
    Feb 17 08:32:19 	unbound 	576:0 	info: 0.524288 1.000000 1
    Feb 17 08:32:19 	unbound 	576:0 	info: 1.000000 2.000000 1
    Feb 17 08:32:22 	unbound 	4806:0 	notice: init module 0: validator
    Feb 17 08:32:22 	unbound 	4806:0 	notice: init module 1: iterator
    Feb 17 08:32:22 	unbound 	4806:0 	info: start of service (unbound 1.9.1). 
    

    Here is the general log

    Feb 17 08:17:00 	kernel 		ovpnc1: link state changed to DOWN
    Feb 17 08:17:00 	check_reload_status 		Reloading filter
    Feb 17 08:17:15 	rc.gateway_alarm 	33120 	>>> Gateway alarm: GCPVPNINTERFACE_VPNV4 (Addr:10.8.0.1 Alarm:1 RTT:19.156ms RTTsd:.348ms Loss:21%)
    Feb 17 08:17:15 	check_reload_status 		updating dyndns GCPVPNINTERFACE_VPNV4
    Feb 17 08:17:15 	check_reload_status 		Restarting ipsec tunnels
    Feb 17 08:17:15 	check_reload_status 		Restarting OpenVPN tunnels/interfaces
    Feb 17 08:17:15 	check_reload_status 		Reloading filter
    Feb 17 08:17:16 	php-fpm 	53460 	/rc.openvpn: Gateway, none 'available' for inet6, use the first one configured. 'WAN_DHCP6'
    Feb 17 08:17:16 	php-fpm 	53460 	/rc.openvpn: OpenVPN: One or more OpenVPN tunnel endpoints may have changed its IP. Reloading endpoints that may use GCPVPNINTERFACE_VPNV4.
    Feb 17 08:32:15 	php-fpm 	53460 	OpenVPN terminate old pid: 98185
    Feb 17 08:32:15 	php-fpm 	53460 	OpenVPN PID written: 99423
    Feb 17 08:32:15 	check_reload_status 		Reloading filter
    Feb 17 08:32:17 	kernel 		ovpnc1: link state changed to UP
    Feb 17 08:32:17 	check_reload_status 		rc.newwanip starting ovpnc1
    Feb 17 08:32:18 	php-fpm 	66584 	/rc.newwanip: rc.newwanip: Info: starting on ovpnc1.
    Feb 17 08:32:18 	php-fpm 	66584 	/rc.newwanip: rc.newwanip: on (IP address: 10.8.0.9) (interface: GCPVPNINTERFACE[opt1]) (real interface: ovpnc1).
    Feb 17 08:32:19 	php-fpm 	66584 	/rc.newwanip: Gateway, none 'available' for inet6, use the first one configured. 'WAN_DHCP6'
    Feb 17 08:32:23 	php-fpm 	66584 	/rc.newwanip: Creating rrd update script
    Feb 17 08:32:25 	php-fpm 	66584 	/rc.newwanip: pfSense package system has detected an IP change or dynamic WAN reconnection - 10.8.0.9 -> 10.8.0.9 - Restarting packages.
    Feb 17 08:32:25 	check_reload_status 		Starting packages
    Feb 17 08:32:26 	php-fpm 	76683 	/rc.start_packages: Restarting/Starting all packages.
    Feb 17 08:32:27 	php 		[pfBlockerNG] DNSBL parser daemon started
    Feb 17 08:32:27 	php_pfb 		[pfBlockerNG] filterlog daemon started 
    


  • Thank you @viragomann for helping, truly appreciated.

    I was able to solve my problem by changing the compression to "Omit Preference + Disable LZO Compression"

    pfSense_localdomain_-VPN__OpenVPN__Clients__Edit-_Firefox_Developer_Edition.png



  • @moussa854
    Strange issue. Thanks for coming back and posting the solution.


Log in to reply