5

I am on Rasbian Stretch. I installed OpenVPN (via PiVPN) and Pi-Hole (4.2). I setup my Pi-Hole (that runs on 192.168.1.6 on the LAN) to use Cloudflare DNS over TLS (using the cloudflared service on port 5054). Pi-Hole works great locally (other clients on the LAN pointing their DNS to 192.168.1.6 can navigate properly and I see their stats in the admin panel).

The problem is when I try to setup OpenVPN to use 192.168.1.6 (port 5054) as DNS server. I see no specific error in the logs but clients connected through the VPN just don't navigate. Everything starts working again if I change the setting in server.conf to use other DNS (like 1.1.1.1 directly).

This is my /etc/openvpn/server.conf

dev tun
proto udp
port 50001
ca /etc/openvpn/easy-rsa/pki/ca.crt
cert /etc/openvpn/easy-rsa/pki/issued/server_wohFvJ5DCWXXXXXX.crt
key /etc/openvpn/easy-rsa/pki/private/server_wohFvJ5DCWXXXXXX.key
dh none
topology subnet
server 10.8.0.0 255.255.255.0
# Set your primary domain name server address for clients
push "dhcp-option DNS 192.168.1.6"
push "dhcp-option DNS 1.0.0.1"
push "block-outside-dns"
# Override the Client default gateway by using 0.0.0.0/1 and
# 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of
# overriding but not wiping out the original default gateway.
push "redirect-gateway def1"
client-to-client
keepalive 1800 3600
remote-cert-tls client
tls-version-min 1.2
tls-crypt /etc/openvpn/easy-rsa/pki/ta.key
cipher AES-256-CBC
auth SHA256
user nobody
group nogroup
persist-key
persist-tun
crl-verify /etc/openvpn/crl.pem
status /var/log/openvpn-status.log 20
status-version 3
syslog
verb 3
#DuplicateCNs allow access control on a less-granular, per user basis.
#Remove # if you will manage access by user instead of device. 
#duplicate-cn
# Generated for use by PiVPN.io

And this is /etc/dnsmasq.d/01-pihole.conf:

addn-hosts=/etc/pihole/gravity.list
addn-hosts=/etc/pihole/black.list
addn-hosts=/etc/pihole/local.list

user=pihole
group=pihole

localise-queries

no-resolv

cache-size=10000

log-queries
log-facility=/var/log/pihole.log

local-ttl=2

log-async

# If a DHCP client claims that its name is "wpad", ignore that.
# This fixes a security hole. see CERT Vulnerability VU#598349
dhcp-name-match=set:wpad-ignore,wpad
dhcp-ignore-names=tag:wpad-ignore
server=127.0.0.1#5054
domain-needed
bogus-priv
interface=eth0

I tried changing push "dhcp-option DNS 192.168.1.6" to push "dhcp-option DNS 10.8.0.0" or 10.8.0.1 but nothing changes.

Any ideas why clients connected through OpenVPN can't navigate? What's wrong in my config? I want them to process DNS queries using cloudflared on port 5054 of the Pi.

Improve this question
3
  • 2
    tl;dr My personal experience is that troubleshooting OpenVPN issues is devilishly difficult for "mere mortals"; i.e. those than don't invest huge amounts of time in learning the details. And as this is more an OpenVPN question than a Raspberry Pi question, you may not find the help here that you need. In my case, I use an "appliance" that's set up for the VPN/firewall application, and OPNsense software. Not suggesting you change your approach, just wanted you to be aware of other options.
    – Seamus
    Feb 3, 2019 at 22:33
  • Can you paste the output of: netstat -tnlp and netstat -unlp
    – Bungee75
    Feb 7, 2019 at 12:05
  • netstat -tnlp pastebin.com/SB0DYbVU netstat -unlp pastebin.com/MQ5MQGzY
    – MultiformeIngegno
    Feb 8, 2019 at 14:07

4 Answers 4

Reset to default
1

VPNs make services tricky because they edit the routing table. They redirect all TCP/IP traffic through them, except for traffic to the VPN server, which includes re-routing what would have been a LAN IP address. It sounds like something similar might be happening.

You can have a look at the routing table using the ip route show command. If what's happening is traffic that would be going to the DNS is being routed incorrectly, you can add an explicit route for it using ip route add $DNSIPADDRESS via $GATEWAY where $GATEWAY would be another IP address, or alternatively dev eth0 if it needs to be through a LAN connection. It's hard to be more specific without a network diagram of some sort.

Of course, this could also be an issue of what interface Pi-hole is listening on, it may simply not be accepting traffic from VPN clients because it's set to only listen for LAN clients. Check this in the Settings -> DNS panel and see if "Listen on all interfaces" is selected or look in /etc/pihole/setupVars.conf at the IPV4_ADDRESS variable, which should be set to 0.0.0.0 to listen on all interfaces.

Improve this answer
0

Unless I'm reading this wrong, it looks like you have two services configured to listen on the same IP and port: 192.168.1.6:5054

That's a definite no-no. Sounds like that is the cause of your pain... -T

Improve this answer
8
  • How do I check which services are configured to listed on the same IP:port ?
    – MultiformeIngegno
    Feb 8, 2019 at 14:07
  • netstat -ntulp will show you what processes are actually up and listening (both TCP & UDP) but if a process isn't rising up successfully because another process has grabbed the port first, that service won't appear in the output of the command. I'd review my config files for the services you configured and see if they cleash on port and IP somewhere.
    – F1Linux
    Feb 8, 2019 at 14:25
  • /etc/dnsmasq.d/01-pihole.conf specifies server=127.0.0.1#5054. However, I see from your pastebin output that Clourflared is listening on 127.0.0.1:5054 for both TCP & UDP connections. Both dnsmasq and cloudflared are point to the same ip and port.
    – F1Linux
    Feb 8, 2019 at 15:43
  • From an Arch Wiki Article which might be instructive: (wiki.archlinux.org/index.php/Pi-hole): Using Pi-hole together with OpenVPN : "An OpenVPN server can be configured to advertise a Pi-hole instance to its clients. Add the following two lines to your /etc/openvpn/server/server.conf: push "redirect-gateway def1 bypass-dhcp" push "dhcp-option DNS Pi-Hole-IP" If it still does not work, try creating a file /etc/dnsmasq.d/00-openvpn.conf with the following content: interface=tun0 It may be necessary to make dnsmasq listen on tun0."
    – F1Linux
    Feb 8, 2019 at 15:54
  • You'll need to change the port one or the other of those services are configured for to resolve the issue. BOTH can't listen on 127.0.0.1:5054
    – F1Linux
    Feb 8, 2019 at 16:03
0

If you want your pihole to listen on all interfaces, change your /etc/dnsmasq.d/01-pihole.conf "interface=eth0" to "except-interface=nonexisting". This worked for me.

Also your push "dhcp-option DNS 192.168.1.6" is probably wrong. Use the IP you can access through VPN (like 10.8.0.1)

Improve this answer
0

  1. UPDATE the server:

    sudo apt update

    sudo apt upgrade -y

    sudo apt dist-upgrade -y

    sudo apt autoremove -y

    sudo apt autoclean -y

  2. Install from original OVPN source:

wget https://git.io/vpn -O openvpn-install.sh && bash openvpn-install.sh

chmod +x openvpn-install.sh

  1. For client user/password feature:

Edit the installer to have password login feature:

`EASYRSA_CERT_EXPIRE=3650 ./easyrsa build-client-full "$client" nopass`

to

`EASYRSA_CERT_EXPIRE=3650 ./easyrsa build-client-full "$client"`

  1. RUN the installer:

    ./openvpn-install.sh

  2. Install PiHole

    curl -sSL https://install.pi-hole.net | bash

  3. Finally restart both services Or better to reboot now.

    pihole disable && pihole enable && systemctl restart openvpn-server@server

Ref: https://vvcares.com/blog/post/openvpn-with-pihole

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.