DNS Server failed

tperrin

*EDIT* I realize this might not be the proper place for this topic, but I have no idea where I should open it and I don't want to open duplicates everywhere. If someone could point me to the proper forum / subforum, I'd highly appreciate it.

Hello everyone,

I am using a OpenVPN server running on a pfsense to connect to a network remotely.

Once I get connected, everything works fine in terms of pure networking, I can connect to any IP on any port without any problem, except that I cannot request DNS information.

The config works (ie I get the DNS servers on my TAP connection), I can ping the DNS server, but if I open a nslookup and point to that server to request an address, any request answers with "Server failed".

Of course the DNS works because every server inside my network can use it properly, and there is only via VPN that this problem appears.

Any help is more than welcome.

dev tun
persist-tun
persist-key
ncp-disable
cipher AES-256-CBC
auth SHA256
tls-client
client
resolv-retry infinite
remote 10.24.1.250 42229 tcp4
auth-user-pass
ca pfsense-TCP4-42229-ca.crt
tls-auth pfsense-TCP4-42229-tls.key 1
remote-cert-tls server

ipconfig :

Unknown adapter OpenVPN TAP-Windows6:

   Connection-specific DNS Suffix  . : mynetwork.local
   Description . . . . . . . . . . . : TAP-Windows Adapter V9
   Physical Address. . . . . . . . . : 00-FF-AB-E0-C8-2D
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   Link-local IPv6 Address . . . . . : fe80::f06a:a34c:aa35:f773%21(Preferred)
   IPv4 Address. . . . . . . . . . . : 192.168.249.2(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Lease Obtained. . . . . . . . . . : Tuesday, January 11, 2022 10:26:28
   Lease Expires . . . . . . . . . . : Wednesday, January 11, 2023 10:26:28
   Default Gateway . . . . . . . . . :
   DHCP Server . . . . . . . . . . . : 192.168.249.254
   DHCPv6 IAID . . . . . . . . . . . : 1275133867
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-28-9E-AA-F9-98-E7-43-62-26-C7
   DNS Servers . . . . . . . . . . . : 192.168.100.1
                                       192.168.100.2
   NetBIOS over Tcpip. . . . . . . . : Enabled

Could it be a pfsense firewalling issue ?

openvpn_inc

Hi tperrin,

You're close to being on topic if you are using our proprietary OpenVPN Connect client. If not (if you're using the OpenVPN GUI (GPL) client), this would best fit in the Community Project / Server Administration board.

If the nameserver answers you at all, that tends to suggest it's not a firewall problem. I'm guessing most likely it's giving REFUSED responses, which is a matter of configuration in the unnamed (haha, good pun there) DNS software you are using. It's probably not allowing recursion from the VPN network.

If you are getting a SERVFAIL response from the nameserver, that would be a different issue, but likely also a misconfiguration of the DNS software.

regards, rob0

tperrin

I am unfortunately only using the community version.

I will post there then.

Thanks for the advice !