[SOLVED] Access intranet through VPN



  • We have a two-site AD domain with pfsense appliances in both sites providing the OpenVPN tunnel. Both sites DCs replicate properly and DNS servers show entries for devices in both site A:192.168.15.0/24 and site B:192.168.16.0/24. We are able to access machines and resources transparently with no issues.

    In site A we've set-up a web server to serve up private intranet content. The web server can serve up content to any machine in site A. However attempting to access the server from site B fails. On site B we are running squid and users are greeted with the message

    The requested URL could not be retrieved
    While trying to retrieve the URL: http://prv-web/docs
    The following error was encountered:
       Unable to determine IP address from host name for prv-web
    The dnsserver returned:
       Name Error: The domain name does not exist.

    This is interesting because prv-web (in site A) can indeed be resolved with a NSLOOKUP from site B. In fact prv-web is currently serving up other non-web content happily between sites.

    Upon further investigation from within pfsense the appliance cannot resolve prv-web with a DNS lookup. This makes sense because the only DNS entries are those for the ISP. However prv-web of course is an entry in the domain's DNS. And just to check I can access the intranet server directly using http://192.168.15.14/docs from site B.

    And finally I tried adding the local DNS server to the DNS servers list in pfsense but this didn't work, and I confess i'm now guessing at a possible solution.

    Any ideas?

    Thanks.



  • You can try "Domain Overrides" under Services/DNS Forwarder and create an entry for your dns server(s)

    http://doc.pfsense.org/index.php/DNS_Forwarder



  • Since you are using squid on site B… squid uses the dns server's in /etc/resolv.conf to resolve domain names by default.  You will have to tell squid to use site B's local DNS server with the "dns_nameservers" directive.



  • Thankyou, an entry in site B domain overrides pointing the domain to site B's DNS server did trick.


Locked