• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

DNS issue while connected to OpenVPN

Scheduled Pinned Locked Moved OpenVPN
43 Posts 5 Posters 6.3k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • A
    albertmiclat
    last edited by Apr 13, 2020, 2:25 PM

    Hi All,

    Im having DNS issue on random users while connected to OpenVPN.

    OpenVPN is connected successfully with out any issue, BUT the moment users tries to RDP into their office computer they can't connect hostname is unable to resolve.

    Looks like there is DNS leak. We have encountered this issue on both Win7 and Win10.

    Appreciate any advice.

    Thanks,
    A

    1 Reply Last reply Reply Quote 0
    • J
      jimp Rebel Alliance Developer Netgate
      last edited by Apr 13, 2020, 2:38 PM

      When you exported the configuration for Windows clients, did you check the Block Outside DNS option?

      Though the option that enables should only be relevant on Windows 10.

      It adds this to the OpenVPN configuration:

      setenv opt block-outside-dns
      

      Also make sure that the DNS resolver is configured with an ACL to allow the OpenVPN client subnet to make DNS queries.

      Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

      Need help fast? Netgate Global Support!

      Do not Chat/PM for help!

      1 Reply Last reply Reply Quote 0
      • A
        albertmiclat
        last edited by Apr 13, 2020, 2:51 PM

        Hi Jimp,

        When you exported the configuration for Windows clients, did you check the Block Outside DNS option? Nope i didn't tick this option when i export the Windows client configuration.

        will this work if tick only on the OpenVPN server? or the Windows client export must also have?

        Also make sure that the DNS resolver is configured with an ACL to allow the OpenVPN client subnet to make DNS queries. where can i check this?

        Thanks,
        A

        J 1 Reply Last reply Apr 13, 2020, 2:52 PM Reply Quote 0
        • J
          jimp Rebel Alliance Developer Netgate @albertmiclat
          last edited by Apr 13, 2020, 2:52 PM

          @albertmiclat said in DNS issue while connected to OpenVPN:

          will this work if tick only on the OpenVPN server? or the Windows client export must also have?

          That is not a server-side option. It only works on Windows clients so it would go in the Windows client configuration.

          Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

          Need help fast? Netgate Global Support!

          Do not Chat/PM for help!

          1 Reply Last reply Reply Quote 0
          • A
            albertmiclat
            last edited by Apr 13, 2020, 2:57 PM

            @jimp
            That is not a server-side option. It only works on Windows clients so it would go in the Windows client configuration. i noticed on the server configuration this option is also visible.
            4f41421c-8af6-425f-b196-6483ad4a36a1-image.png

            Also make sure that the DNS resolver is configured with an ACL to allow the OpenVPN client subnet to make DNS queries. where can i check this?

            1 Reply Last reply Reply Quote 0
            • J
              jimp Rebel Alliance Developer Netgate
              last edited by Apr 13, 2020, 2:57 PM

              Yes, but it pushes that to the client, it doesn't affect how the server behaves.

              Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

              Need help fast? Netgate Global Support!

              Do not Chat/PM for help!

              1 Reply Last reply Reply Quote 0
              • A
                albertmiclat
                last edited by Apr 13, 2020, 3:05 PM

                @jimp
                Ok, so if i want this setting to be active i must export a new Windows client configuration correct?

                by default DNS resolver is enabled, im not sure where the ACL where can i check this?
                39664538-b62c-455d-b681-23fcf228dc1c-image.png

                thanks

                1 Reply Last reply Reply Quote 0
                • J
                  jimp Rebel Alliance Developer Netgate
                  last edited by Apr 13, 2020, 3:05 PM

                  That wouldn't affect VPN clients in any way, only the firewall itself.

                  Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                  Need help fast? Netgate Global Support!

                  Do not Chat/PM for help!

                  1 Reply Last reply Reply Quote 0
                  • A
                    albertmiclat
                    last edited by Apr 13, 2020, 3:08 PM

                    Ok..

                    Also make sure that the DNS resolver is configured with an ACL to allow the OpenVPN client subnet to make DNS queries. how can i check this settings?

                    thanks

                    1 Reply Last reply Reply Quote 0
                    • J
                      jimp Rebel Alliance Developer Netgate
                      last edited by Apr 13, 2020, 3:11 PM

                      Services > DNS Resolver, Access Lists tab

                      Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                      Need help fast? Netgate Global Support!

                      Do not Chat/PM for help!

                      A 1 Reply Last reply Apr 13, 2020, 3:17 PM Reply Quote 0
                      • N
                        noplan
                        last edited by Apr 13, 2020, 3:11 PM

                        do you use the netBios setting ?
                        out of the blue
                        brNP

                        A 1 Reply Last reply Apr 13, 2020, 3:14 PM Reply Quote 0
                        • A
                          albertmiclat @noplan
                          last edited by Apr 13, 2020, 3:14 PM

                          @noplan if you are referring to this? then yes
                          0bb43550-5432-4794-b73c-4adb41933907-image.png

                          1 Reply Last reply Reply Quote 0
                          • A
                            albertmiclat @jimp
                            last edited by Apr 13, 2020, 3:17 PM

                            @jimp looks like DNS resolver is not enabled, can i still proceed to add the ACL or this must be enable first?
                            2b932d0d-b61c-430f-9953-12e0a361fb3a-image.png

                            1 Reply Last reply Reply Quote 0
                            • J
                              jimp Rebel Alliance Developer Netgate
                              last edited by Apr 13, 2020, 3:17 PM

                              Are you using the DNS Forwarder then?

                              Or what are the clients using for DNS if not the firewall?

                              Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                              Need help fast? Netgate Global Support!

                              Do not Chat/PM for help!

                              A 1 Reply Last reply Apr 13, 2020, 3:23 PM Reply Quote 0
                              • A
                                albertmiclat @jimp
                                last edited by Apr 13, 2020, 3:23 PM

                                @jimp DNS forwarders also not enabled.

                                our clients is using our Windows DNS servers..

                                configured on here System > General Setting
                                cb552701-a081-4d6e-b5e3-0fb1fe5aeb22-image.png

                                and here for OpenVPN
                                4bb91fb3-91a8-460c-abee-85ce44a1d883-image.png

                                1 Reply Last reply Reply Quote 0
                                • J
                                  jimp Rebel Alliance Developer Netgate
                                  last edited by Apr 13, 2020, 3:28 PM

                                  OK so the firewall would not be involved in their DNS at all. The "Block outside DNS" box is about all you can do there other than trying to solve client issues.

                                  Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                                  Need help fast? Netgate Global Support!

                                  Do not Chat/PM for help!

                                  A 1 Reply Last reply Apr 13, 2020, 3:31 PM Reply Quote 0
                                  • A
                                    albertmiclat @jimp
                                    last edited by Apr 13, 2020, 3:31 PM

                                    @jimp Ok.

                                    so for the "Block outside DNS" i need to generated a new Windows client configuration with "Block outside DNS" tick to get this setting in effect?

                                    1 Reply Last reply Reply Quote 0
                                    • J
                                      jimp Rebel Alliance Developer Netgate
                                      last edited by Apr 13, 2020, 3:33 PM

                                      You can check the box on the server which may help. If it doesn't, then try exporting a fresh client.

                                      If neither one helps then it's something else entirely, most likely not in OpenVPN. Could be on the client or the DNS server, but either way, not pfSense and unlikely to be OpenVPN.

                                      Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                                      Need help fast? Netgate Global Support!

                                      Do not Chat/PM for help!

                                      A 1 Reply Last reply Apr 13, 2020, 3:36 PM Reply Quote 0
                                      • A
                                        albertmiclat @jimp
                                        last edited by Apr 13, 2020, 3:36 PM

                                        @jimp Thanks jimp.. I will do some testing first. Thanks!

                                        1 Reply Last reply Reply Quote 0
                                        • A
                                          albertmiclat
                                          last edited by Apr 14, 2020, 5:26 AM

                                          @jimp base on my testing the user still encounter the same problem unable to resolves DNS hostname.

                                          my openvpn subnet is 10.50.0.0/22, i noticed when the user is getting 10.50.1.X ip address they encounter the DNS issue.

                                          i dont have any clue where to check next, any advice will be greatly appreciated. Thanks

                                          G 1 Reply Last reply Apr 14, 2020, 8:47 AM Reply Quote 0
                                          2 out of 43
                                          • First post
                                            2/43
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                            This community forum collects and processes your personal information.
                                            consent.not_received