Archive > 18.1 Legacy Series
Unbound and OpenVPN problem
jjstecchino:
First post here. First of all, congratulation for this great project. I have been a very long time user of pfSense and active on their forum. I stumbled upon OPNSense by chance and I liked it so much that I migrated my long time pfSense to OPNSense. It is a fantastic firewall.
Now here is the issue. I created an OpenVPN server and set it to pass my local domain and the LAN firewall IP as DNS server. OpenVPN connection worked flawlessly, however clients were not able to resolve DNS queries.
Unbound was set to respond on ALL interfaces but was not. NSLookup from clients showed the query was refused. If I select each one of the interfaces i.e. WAN, LAN, localhost and OpenVPN, unbound will respond to DNS queries as expected. It seems that selecting ALL doesn't make unbound listen to ALL interfaces but just LAN, WAN and localhost.
Also any plan to support NCP on OpenVPN? I really miss that from pfSense.
Thanks and congratulations again for this project. As time permit I would love to get familiar with the code and help as much as I am able to.
elektroinside:
Hi and welcome to OPNsense!
Make sure the OpenVPN subnet(s) are in the Access List as well under Services :Unbound DNS :Access Lists
elektroinside:
Unrelated, but you might find it useful.
For best OpenVPN performance, you could also follow this guide. Its main purpose is to speed up IDPS, but has a significant impact on OpenVPN as well. I found tons of posts on the internet as to how to optimize OpenVPN throughput, but dcol's post was the only one which really helped, without any other OpenVPN parameters.
https://forum.opnsense.org/index.php?topic=6590.0
jjstecchino:
Thanks for the welcome and for the prompt answers. Great reading on the tunables.
Regarding the OpenVPN issue, yes my openvpn tunnel network was already automatically added to unbound ACL.
elektroinside:
Ok, the next logical question is if you have added a firewall rule to allow access from the OpenVPN net/interface to the firewall's port 53 (or the entire firewall / lan subnet, aka "any to any" rule) :)
Navigation
[0] Message Index
[#] Next page
Go to full version