Unbound and OpenVPN problem

[jjstecchino]

First post here. First of all, congratulation for this great project. I have been a very long time user of pfSense and active on their forum. I stumbled upon OPNSense by chance and I liked it so much that I migrated my long time pfSense to OPNSense. It is a fantastic firewall.

Now here is the issue. I created an OpenVPN server and set it to pass my local domain and the LAN firewall IP as DNS server. OpenVPN connection worked flawlessly, however clients were not able to resolve DNS queries.
Unbound was set to respond on ALL interfaces but was not. NSLookup from clients showed the query was refused. If I select each one of the interfaces i.e. WAN, LAN, localhost and OpenVPN, unbound will respond to DNS queries as expected. It seems that selecting ALL doesn't make unbound listen to ALL interfaces but just LAN, WAN and localhost.

Also any plan to support NCP on OpenVPN? I really miss that from pfSense.

Thanks and congratulations again for this project. As time permit I would love to get familiar with the code and help as much as I am able to.

[elektroinside]

Hi and welcome to OPNsense!

Make sure the OpenVPN subnet(s) are in the Access List as well under Services :Unbound DNS :Access Lists

[elektroinside]

Unrelated, but you might find it useful.

For best OpenVPN performance, you could also follow this guide. Its main purpose is to speed up IDPS, but has a significant impact on OpenVPN as well. I found tons of posts on the internet as to how to optimize OpenVPN throughput, but dcol's post was the only one which really helped, without any other OpenVPN parameters.

https://forum.opnsense.org/index.php?topic=6590.0

[jjstecchino]

Thanks for the welcome and for the prompt answers. Great reading on the tunables.

Regarding the OpenVPN issue, yes my openvpn tunnel network was already automatically added to unbound ACL.

[elektroinside]

Ok, the next logical question is if you have added a firewall rule to allow access from the OpenVPN net/interface to the firewall's port 53 (or the entire firewall / lan subnet, aka "any to any" rule)

[jjstecchino]

I have an OpenVPN pass all rule.

I believe the problem is that OPNSense adds an ACL entry in unbound just for the openvpn server i.e xx.xx.xx.1/32 but not for the tunnel network xx.xx.xx.0/24. Don't know if this is  by design or a bug. If it is by design something should be stated in the OpenVPN setup doc page that an ACL entry should be added in unbound for the tunnel network.

I don't see the drawback to automatically add the entire tunnel network (xx.xx.xx.xx/24 or whatever net mask may be) instead of just the openvpn server (xx.xx.xx.1/32) to unbound ACL when an OpenVPN server is created/enable. I think this second option is more intuitive and lead to less head scratching.

Anyway adding the entire tunnel network to the unbound ACL solves the problem.

[Baliste]

Thanks.

I faced the same problem and I added the OpenVPN tunnel network to the unbound ACL, and it is working now.

Frédéric