5

I am on Rasbian Stretch. I installed OpenVPN (via PiVPN) and Pi-Hole (4.2). I setup my Pi-Hole (that runs on 192.168.1.6 on the LAN) to use Cloudflare DNS over TLS (using the cloudflared service on port 5054). Pi-Hole works great locally (other clients on the LAN pointing their DNS to 192.168.1.6 can navigate properly and I see their stats in the admin panel).

The problem is when I try to setup OpenVPN to use 192.168.1.6 (port 5054) as DNS server. I see no specific error in the logs but clients connected through the VPN just don't navigate. Everything starts working again if I change the setting in server.conf to use other DNS (like 1.1.1.1 directly).

This is my /etc/openvpn/server.conf

dev tun
proto udp
port 50001
ca /etc/openvpn/easy-rsa/pki/ca.crt
cert /etc/openvpn/easy-rsa/pki/issued/server_wohFvJ5DCWXXXXXX.crt
key /etc/openvpn/easy-rsa/pki/private/server_wohFvJ5DCWXXXXXX.key
dh none
topology subnet
server 10.8.0.0 255.255.255.0
# Set your primary domain name server address for clients
push "dhcp-option DNS 192.168.1.6"
push "dhcp-option DNS 1.0.0.1"
push "block-outside-dns"
# Override the Client default gateway by using 0.0.0.0/1 and
# 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of
# overriding but not wiping out the original default gateway.
push "redirect-gateway def1"
client-to-client
keepalive 1800 3600
remote-cert-tls client
tls-version-min 1.2
tls-crypt /etc/openvpn/easy-rsa/pki/ta.key
cipher AES-256-CBC
auth SHA256
user nobody
group nogroup
persist-key
persist-tun
crl-verify /etc/openvpn/crl.pem
status /var/log/openvpn-status.log 20
status-version 3
syslog
verb 3
#DuplicateCNs allow access control on a less-granular, per user basis.
#Remove # if you will manage access by user instead of device. 
#duplicate-cn
# Generated for use by PiVPN.io

And this is /etc/dnsmasq.d/01-pihole.conf:

addn-hosts=/etc/pihole/gravity.list
addn-hosts=/etc/pihole/black.list
addn-hosts=/etc/pihole/local.list

user=pihole
group=pihole

localise-queries

no-resolv

cache-size=10000

log-queries
log-facility=/var/log/pihole.log

local-ttl=2

log-async

# If a DHCP client claims that its name is "wpad", ignore that.
# This fixes a security hole. see CERT Vulnerability VU#598349
dhcp-name-match=set:wpad-ignore,wpad
dhcp-ignore-names=tag:wpad-ignore
server=127.0.0.1#5054
domain-needed
bogus-priv
interface=eth0

I tried changing push "dhcp-option DNS 192.168.1.6" to push "dhcp-option DNS 10.8.0.0" or 10.8.0.1 but nothing changes.

Any ideas why clients connected through OpenVPN can't navigate? What's wrong in my config? I want them to process DNS queries using cloudflared on port 5054 of the Pi.

  • 1
    tl;dr My personal experience is that troubleshooting OpenVPN issues is devilishly difficult for "mere mortals"; i.e. those than don't invest huge amounts of time in learning the details. And as this is more an OpenVPN question than a Raspberry Pi question, you may not find the help here that you need. In my case, I use an "appliance" that's set up for the VPN/firewall application, and OPNsense software. Not suggesting you change your approach, just wanted you to be aware of other options. – Seamus Feb 3 at 22:33
  • Can you paste the output of: netstat -tnlp and netstat -unlp – Bungee75 Feb 7 at 12:05
  • netstat -tnlp pastebin.com/SB0DYbVU netstat -unlp pastebin.com/MQ5MQGzY – MultiformeIngegno Feb 8 at 14:07
0

Unless I'm reading this wrong, it looks like you have two services configured to listen on the same IP and port: 192.168.1.6:5054

That's a definite no-no. Sounds like that is the cause of your pain... -T

  • How do I check which services are configured to listed on the same IP:port ? – MultiformeIngegno Feb 8 at 14:07
  • netstat -ntulp will show you what processes are actually up and listening (both TCP & UDP) but if a process isn't rising up successfully because another process has grabbed the port first, that service won't appear in the output of the command. I'd review my config files for the services you configured and see if they cleash on port and IP somewhere. – F1Linux Feb 8 at 14:25
  • /etc/dnsmasq.d/01-pihole.conf specifies server=127.0.0.1#5054. However, I see from your pastebin output that Clourflared is listening on 127.0.0.1:5054 for both TCP & UDP connections. Both dnsmasq and cloudflared are point to the same ip and port. – F1Linux Feb 8 at 15:43
  • From an Arch Wiki Article which might be instructive: (wiki.archlinux.org/index.php/Pi-hole): Using Pi-hole together with OpenVPN : "An OpenVPN server can be configured to advertise a Pi-hole instance to its clients. Add the following two lines to your /etc/openvpn/server/server.conf: push "redirect-gateway def1 bypass-dhcp" push "dhcp-option DNS Pi-Hole-IP" If it still does not work, try creating a file /etc/dnsmasq.d/00-openvpn.conf with the following content: interface=tun0 It may be necessary to make dnsmasq listen on tun0." – F1Linux Feb 8 at 15:54
  • You'll need to change the port one or the other of those services are configured for to resolve the issue. BOTH can't listen on 127.0.0.1:5054 – F1Linux Feb 8 at 16:03
0

If you want your pihole to listen on all interfaces, change your /etc/dnsmasq.d/01-pihole.conf "interface=eth0" to "except-interface=nonexisting". This worked for me.

Also your push "dhcp-option DNS 192.168.1.6" is probably wrong. Use the IP you can access through VPN (like 10.8.0.1)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.