DNS issue while connected to OpenVPN

[albertmiclat]

@jimp Ok.

so for the "Block outside DNS" i need to generated a new Windows client configuration with "Block outside DNS" tick to get this setting in effect?

[jimp]

You can check the box on the server which may help. If it doesn't, then try exporting a fresh client.

If neither one helps then it's something else entirely, most likely not in OpenVPN. Could be on the client or the DNS server, but either way, not pfSense and unlikely to be OpenVPN.

[albertmiclat]

@jimp Thanks jimp.. I will do some testing first. Thanks!

[albertmiclat]

@jimp base on my testing the user still encounter the same problem unable to resolves DNS hostname.

my openvpn subnet is 10.50.0.0/22, i noticed when the user is getting 10.50.1.X ip address they encounter the DNS issue.

i dont have any clue where to check next, any advice will be greatly appreciated. Thanks

[Gertjan]

@albertmiclat said in DNS issue while connected to OpenVPN:

the user is getting 10.50.1.X ip address

Ok for the IP, but what about the IP of the DNS the client received ? Why not mentionning it ? The gateway and mask while you're at it.
The DNS IP is your DNS server in your/a network ? Can it be accessed by the OpenVPN client ? Is the DNS set up to receive DNS requests from OpenVPN clients ?
Note : You're not using pfSense as a DNS for your networks, but some other device. So pfSense OpenVPN server should be set up accordingly. How ? depends on your network ....

I guess you should use :

where a.b.c.d is your DNS.

[albertmiclat]

@Gertjan this setting are set accordingly.

users also getting the right configurations

cannot ping both ip and hostname

[albertmiclat]

here's is one of the user who are not having issue can ping both ip and hostname and the ip address is 10.50.0.x

[johnpoz]

what is the local network of these clients that don't work..

So the ipconfig /all for these clients, and the routing table

route print

[albertmiclat]

@johnpoz this user is having DNS issue

[johnpoz]

Well no overlap with the local network..

When you do a tracert to 10.25.1.38, you see first hop is end of the tunnel?

Can you ping the end of the tunnel? See the gateway listed there in the route print 10.50.1.37

[albertmiclat]

@johnpoz this is another user unfortunately the prev is already end his session

• tracert to 10.25.1.38 doesnt show anything
• ping to the gateway also request time out

[johnpoz]

Well if you can not get to the end of the tunnel, its not going to be able to talk to the dns on the other end of the tunnel..

Are the machines that are failing have any 3rd party firewall/security software on them?

[albertmiclat]

@johnpoz nope no firewall/security software..

as mentioned previously this happens when the user get this subnet 10.50.1.X but when the user gets 10.50.0.X no issue, this behavior puzzled me more..

may subnet is 10.50.0.0/22

[johnpoz]

hmmm - didn't notice that..

What are the rules in your openvpn interface on pfsense?

example:

[albertmiclat]

@johnpoz the usual rules..

[johnpoz]

Can we see route print from client that is working.

[albertmiclat]

@johnpoz this working client

[johnpoz]

hmmmm - maybe I just need to finish waking up, more coffee ;)

But sorry nothing currently jumping out to me on what is the issue here.. Other than yeah, if you can not talk to your gateway at the end of the tunnel, its not going to be possible to talk to some dns server that is on the other end of the tunnel..

The big ? is why? hmmmmm?

[jimp]

Does the AD server allow DNS queries from that whole /22?

[johnpoz]

Lets say it doesn't - that could explain why he can not do a dns query to it, but seems he can not even ping the other end of the tunnel, while another client that works can..