I am on Rasbian Stretch. I installed OpenVPN (via PiVPN) and Pi-Hole (4.2).
I setup my Pi-Hole (that runs on 192.168.1.6 on the LAN) to use Cloudflare DNS over TLS (using the
cloudflared service on port
Pi-Hole works great locally (other clients on the LAN pointing their DNS to
192.168.1.6 can navigate properly and I see their stats in the admin panel).
The problem is when I try to setup OpenVPN to use
5054) as DNS server. I see no specific error in the logs but clients connected through the VPN just don't navigate. Everything starts working again if I change the setting in
server.conf to use other DNS (like
This is my
dev tun proto udp port 50001 ca /etc/openvpn/easy-rsa/pki/ca.crt cert /etc/openvpn/easy-rsa/pki/issued/server_wohFvJ5DCWXXXXXX.crt key /etc/openvpn/easy-rsa/pki/private/server_wohFvJ5DCWXXXXXX.key dh none topology subnet server 10.8.0.0 255.255.255.0 # Set your primary domain name server address for clients push "dhcp-option DNS 192.168.1.6" push "dhcp-option DNS 22.214.171.124" push "block-outside-dns" # Override the Client default gateway by using 0.0.0.0/1 and # 126.96.36.199/1 rather than 0.0.0.0/0. This has the benefit of # overriding but not wiping out the original default gateway. push "redirect-gateway def1" client-to-client keepalive 1800 3600 remote-cert-tls client tls-version-min 1.2 tls-crypt /etc/openvpn/easy-rsa/pki/ta.key cipher AES-256-CBC auth SHA256 user nobody group nogroup persist-key persist-tun crl-verify /etc/openvpn/crl.pem status /var/log/openvpn-status.log 20 status-version 3 syslog verb 3 #DuplicateCNs allow access control on a less-granular, per user basis. #Remove # if you will manage access by user instead of device. #duplicate-cn # Generated for use by PiVPN.io
And this is
addn-hosts=/etc/pihole/gravity.list addn-hosts=/etc/pihole/black.list addn-hosts=/etc/pihole/local.list user=pihole group=pihole localise-queries no-resolv cache-size=10000 log-queries log-facility=/var/log/pihole.log local-ttl=2 log-async # If a DHCP client claims that its name is "wpad", ignore that. # This fixes a security hole. see CERT Vulnerability VU#598349 dhcp-name-match=set:wpad-ignore,wpad dhcp-ignore-names=tag:wpad-ignore server=127.0.0.1#5054 domain-needed bogus-priv interface=eth0
I tried changing
push "dhcp-option DNS 192.168.1.6" to
push "dhcp-option DNS 10.8.0.0" or
10.8.0.1 but nothing changes.
Any ideas why clients connected through OpenVPN can't navigate? What's wrong in my config? I want them to process DNS queries using
cloudflared on port 5054 of the Pi.