I can't reach external sites with my DNS server and OpenVPN

Alkesz

Hi everyone !

I need your help to access to resolve domains with my DNS server through OpenVPN.

I have a Raspberry Pi which contains an OpenVPN server and a DNS server.

-----------------------------
My internal network :
- ISP router : 192.168.0.1
- NAS : 192.168.0.11 (called nas.alex thanks to my DNS server)
- RaspberryPI (OpenVPN server & BIND DNS Server) : 192.168.0.10 / 10.8.0.1
- an external device connected via OpenVPN : 10.8.0.6
-----------------------------

With my external device (through VPN) - When I try to reach an internal domain it's working perfectly :

nslookup nas.alex
Server:		192.168.0.10
Address:	192.168.0.10#53

Name:		nas.alex
Address: 	192.168.0.11

It is also working if I use 10.8.0.1 as DNS server IP :

nslookup nas.alex
Server:		10.8.0.1
Address:	10.8.0.1#53

Name:		nas.alex
Address: 	192.168.0.11

With my external device (through VPN) - When I try to reach an external domain it is not working :

nslookup google.com
Server:		192.168.0.10
Address:	192.168.0.10#53

** server can't find google.com: REFUSED

And finally if i use a external DNS server (like google 8.8.8.8), nslookup google.com works

Do you have any ideas to help me ?

300000

If you uninstall bin and install dnsmasq so it is quick and very easy to make it work .if you use BIN you need to config it forward domain somewhere .but bin is too much and and dnsmasq is enough.
It served all my local host and make thing very quick. My dnsmasq event public dns so my friend can use it to block Google ad where ever you open website . Google following you in every webpare you open but block it from dns dont need any extension at all

My dnsmasq run on my raspberry so i can use it on my openvpn .it block all google ad too so only check and correct it shoul work for you. It is more easy if you can use winscp and use root user connect to your raspberry and update dnsmasq config . That make change very quick and stop and restart dnamasq to make it work for you

listen-address =127.0.0.1
listen-address=192.168.20.1
listen-address= 333.333.333.333
local=/thuctap.co.uk/

ptr-record=thuctap.co.uk,333.333.333.333
ptr-record=30.2.1.10.in-addr.arpa,"thuctap.co.uk"
address=/router.thuctap.co.uk/192.168.20.1
address=/phone.thuctap.co.uk/192.168.20.101
address=/nha.thuctap.co.uk/192.168.20.115

address=/server2016.thuctap.co.uk/192.168.20.100
address=/manifest.googlevideo.com/172.217.1.14
address=/ads.doubleclick.net/0.0.0.0
address=/ad.youtube.com/0.0.0.0
address=/ads.youtube.com/0.0.0.0
address=/clients1.google.com/0.0.0.0
address=/dts.innovid.com/0.0.0.0
address=/googleads.g.doubleclick.net/0.0.0.0
address=/googleads4.g.doubleclick.net/0.0.0.0
address=/pagead2.googlesyndication.com/0.0.0.0
address=/pixel.moatads.com/0.0.0.0
address=/rtd.tubemogul.com/0.0.0.0
address=/s.innovid.com/0.0.0.0
address=/pubads.g.doubleclick.net/0.0.0.0
address=/ssl.google-analytics.com/0.0.0.0
address=/www-google-analytics.l.google.com/0.0.0.0
address=/stats.g.doubleclick.net/0.0.0.0
address=/clients.l.google.com/0.0.0.0
address=/pagead.l.doubleclick.net/0.0.0.0
address=/www-googletagmanager.l.google.com/0.0.0.0
address=/googleadapis.l.google.com/0.0.0.0
address=/s0.2mdn.net/0.0.0.0
address=/googleads.g.doubleclick.net/0.0.0.0
address=/ad.doubleclick.net/0.0.0.0
address=/files.adform.net/0.0.0.0
address=/secure-ds.serving-sys.com/0.0.0.0
address=/securepubads.g.doubleclick.net/0.0.0.0
address=/apis.google.com/0.0.0.0
address=/2975c.v.fwmrm.net/0.0.0.0
address=/static.doubleclick.net/0.0.0.0
address=/googleadservices.com/0.0.0.0
address=/ad-g.doubleclick.net/0.0.0.0
address=/ad.doubleclick.net/0.0.0.0
address=/ad.mo.doubleclick.net/0.0.0.0
address=/doubleclick.net/0.0.0.0
address=/googleads.g.doubleclick.net/0.0.0.0
address=/pagead.googlesyndication.com/0.0.0.0
address=/pagead1.googlesyndication.com/0.0.0.0
address=/pagead2.googlesyndication.com/0.0.0.0
address=/www.googleadservices.com/0.0.0.0
address=/youtube-nocookie.com/0.0.0.0
address=/www.youtube-nocookie.com/0.0.0.0
address=/analytic-google.com/0.0.0.0
address=/www.analytic-google.com/0.0.0.0
address=/www.googletagservices.com/0.0.0.0
address=/fwmrm.net/0.0.0.0
address=/innovid.com/0.0.0.0
address=/2mdn.net/0.0.0.0
address=/fwmrm.net/0.0.0.0
address=/innovid.com/0.0.0.0
address=/2mdn.net/0.0.0.0
address=/la.vncdn.net/0.0.0.0
address=/g.eclick.vn/0.0.0.0
address=/exchange.adtrue.com/0.0.0.0
address=/track.adtrue.com/0.0.0.0
address=/vcdn-a.vnecdn.net/0.0.0.0
address=/sea-u.openx.net/0.0.0.0
address=/s.innovid.com/0.0.0.0
address=/pubads.g.doubleclick.net/0.0.0.0
address=/ssl.google-analytics.com/0.0.0.0
address=/www-google-analytics.l.google.com/0.0.0.0
address=/stats.g.doubleclick.net/0.0.0.0
address=/clients.l.google.com/0.0.0.0
address=/pagead.l.doubleclick.net/0.0.0.0
address=/www-googletagmanager.l.google.com/0.0.0.0
address=/googleadapis.l.google.com/0.0.0.0
address=/s0.2mdn.net/0.0.0.0
address=/googleads.g.doubleclick.net/0.0.0.0
address=/ad.doubleclick.net/0.0.0.0
address=/files.adform.net/0.0.0.0
address=/secure-ds.serving-sys.com/0.0.0.0
address=/securepubads.g.doubleclick.net/0.0.0.0
address=/apis.google.com/0.0.0.0
address=/2975c.v.fwmrm.net/0.0.0.0
address=/static.doubleclick.net/0.0.0.0
address=/googleadservices.com/0.0.0.0
address=/ad-g.doubleclick.net/0.0.0.0
address=/ad.doubleclick.net/0.0.0.0
address=/ad.mo.doubleclick.net/0.0.0.0
address=/doubleclick.net/0.0.0.0
address=/googleads.g.doubleclick.net/0.0.0.0
address=/pagead.googlesyndication.com/0.0.0.0
address=/pagead1.googlesyndication.com/0.0.0.0
address=/pagead2.googlesyndication.com/0.0.0.0
address=/www.googleadservices.com/0.0.0.0
address=/fwmrm.net/0.0.0.0
address=/innovid.com/0.0.0.0
address=/2mdn.net/0.0.0.0
address=/iad23s25-in-f14.1e100.net/0.0.0.0
address=/shop.thuctap.co.uk/192.168.5.1
address=/shoprouter.thuctap.co.uk/192.168.1.254
address=/maytinhdell.thuctap.co.uk/192.168.5.171
cache-size=1500
no-resolv
no-hosts
server=208.67.222.222
no-negcache
stop-dns-rebind
dhcp-authoritative
dhcp-option=option:dns-server, 192.168.20.1
dhcp-rapid-commit
expand-hosts
quiet-dhcp
expand-hosts
domain=thuctap.co.uk
domain-needed
bogus-priv

Alkesz

For now, i want to keep my BIND server. There is another way ?

300000

Alkesz wrote For now, i want to keep my BIND server. There is another way ?

So you need to learn how bin config and forward domain. That is nothing to do with openvpn at all .