NordVPN + AdGuard + VLAN + DNS Help please :\

Started by cgi2099, August 31, 2022, 04:50:27 PM

Previous topic - Next topic
Print
Go Down Pages1
User actions
August 31, 2022, 04:50:27 PM
Hello all, I am new to OPNSense and an amateur at networking for 100%. I am pretty good at following guides and getting things to "work" but I don't know what some of the technical stuff means or exactly what is going on afterwards. But I can learn pretty easy.

My current setup is:

Code Select
                                                               > POE+ Dumb Switch > x5 CCTV Cameras
Modem > OPNSense (HP T740 + X710-T2L) > 10G Switch(semi smart) > TPLink Access Point
                                                               > Unraid Server > A few VMS
                                                                               > A Few Dockers
My subnets are:

OPNSense: 192.168.1/24

VLAN10: 10.10.10.1/24

VLAN20: 10.10.20.1/24

VLAN30: 10.10.30.1/24

VLAN40: 10.10.40.1/24



Currently I have everything configure and working about 95% how I would like. The problem I am having is with DNS on the VLAN20 that is routed through NordVPN, I followed this guide/video on how to set this up and mine is pretty much identical but through Nord and is working great: https://www.youtube.com/watch?v=ulRgecz0UsQ

I also have Adguard Home setup up identical to this guide: https://samuelsson.dev/install-adguard-home-on-an-opnsense-router/

I have all of the VLANs and LAN going through Adguard and is working great. But I have an "override" (I guess that is what you would call it) on the DHCP server for VLAN20 and I simply have put Nords special DNS setting there. Which works great for Windows devices or phones connecting, they get the correct DNS that way.

BUT if I connect a chromecast, firestick or roku to that network they grab the generic DNS from the VPN (I believe, it is a datacamp dns, I have no way I know of to verify it is Nords). So I thought I was having DOH DNS problems and went down that rabbit hole but took a step back and figured I'd give VLAN10 a static DNS on the DHCP server to Cloudflare and connect to VLAN10 on the Chromecast and it worked just like it should so the chromecast isn't using hardcoded DNS settings.

So with all of this being said, is there a setting I missed or can change on the NordVPN client to make sure it uses/forces the DHCP DNS on all devices? The only next step I know to do is factory reset one of the Chromecasts and see if it grabs the correct DNS then.

My next problem is on the VLAN20 routed through the VPN, all local traffic is also going through the VPN. For instance when I connect to my plex server on 192.168.1.190 it thinks I am a remote user or if I log into the OPNSense web GUI it thinks I am remote. Is there a way to make to make local traffic stay local?

FYI, I currently let all subnets communicate with each other wide open. I am wanting to segregate some of them after I get everything working how I would like but that is for a later adventure.

Again sorry for my lack of knowledge on all of this and appreciate any help.

Josh
September 02, 2022, 02:40:41 PM #1
Pls show screenshots  ;)
September 02, 2022, 03:14:24 PM #2
Thank you so much for the reply :)







September 02, 2022, 03:30:40 PM #3
I am not that familiar with OPNsense but there seem to be some problems.

On your last screenshot your first rule will send everything from some hosts to nordvpn, so they can't use your local dns. So this rule must go down below the dns rules.
Also your outbound NAT rule looks wrong to me. Source has to be your local LANs like in the automatic rules below that, at least all those, who actually should be able to use nordvpn.

And you shouldn't have any Port forwards on nord vpn interface at all.
And also back again on your last screenshot you have a rule containing nordvpn net. This is also a nogo and is not doing anything for you.

Haven't watched your youtubevideo but you are really at the very beginning of all of that.
September 02, 2022, 04:57:15 PM #4
Not sure if this matters but I only want the NordVPN VLAN to go to the VPN everything else I want to stay on the local network. The port forwards are suppose to be to fool the streaming devices DNS. It is suppose to let those devices think they are getting their requested DNS but then be forward to my DNS if I have it setup correctly.
September 02, 2022, 05:25:25 PM #5
Ok, so one VLAN is named NordVPN... now it makes more sense, not a good name though.  ;)
September 02, 2022, 05:27:23 PM #6
Still the rule must go down, also the screenshots are not shown fully here for me, maybe post only thumbs here with a link to the whole picture.
September 02, 2022, 11:38:54 PM #7
September 03, 2022, 01:18:33 AM #8 Last Edit: September 03, 2022, 01:20:20 AM by cgi2099
Quote from: Bob.Dig on September 02, 2022, 05:27:23 PM
Still the rule must go down, also the screenshots are not shown fully here for me, maybe post only thumbs here with a link to the whole picture.

It works if I move it to the second from last, but for some reason the DNS I apply in AdGuard, which is supposedly smart, won't grab the correct DNS :(. I suppose this is a Nord issue?

If I put the DNS, which are the same, in the DHCP section of the VLAN they work as should for all the devices except streaming stick devices because they have the DNS hard coded. I guess this is because of my port forward rules but I don't know how to get Adguard to pick up the VLAN without them?

Is there a way to route it through Nord without the Nat port forwarding?
September 03, 2022, 08:43:45 AM #9
Much better readable screenshots this time.

I think you can't do DNS Redirect with DoT and DoH...
Redirecting DNS isn't needed at all anyways.

So on which VLAN you have a problem, where is the dns server you want to use for that. One problem at a time.
September 03, 2022, 03:05:47 PM #10
The NordVPN VLAN (10.10.20.1) which is routes through the NordVPNRouted gateway.

If I set the DNS in the DHCP of the VLAN my DNS works like it should on every but streaming sticks but if I set it in adguard it does not work correctly on any device. It connects to the right DNS numbers but wrong location.

If I remove the NAT port forwardings the VLAN will not get a DNS, so it has no internet.
September 04, 2022, 03:32:45 PM #11
Quote from: Bob.Dig on September 03, 2022, 08:43:45 AM
Much better readable screenshots this time.

I think you can't do DNS Redirect with DoT and DoH...
Redirecting DNS isn't needed at all anyways.

So on which VLAN you have a problem, where is the dns server you want to use for that. One problem at a time.

I thoroughly read your messages and made sure (changed a few to match) they were right and changed a couple of settings in my Nord Account, and everything is working great :).

Thank you so much :)
Print
Go Up Pages1
User actions