I am on Rasbian Stretch. I installed OpenVPN (via PiVPN) and Pi-Hole (4.2). I setup my Pi-Hole (that runs on on the LAN) to use Cloudflare DNS over TLS (using the cloudflared service on port 5054). Pi-Hole works great locally (other clients on the LAN pointing their DNS to can navigate properly and I see their stats in the admin panel).

The problem is when I try to setup OpenVPN to use (port 5054) as DNS server. I see no specific error in the logs but clients connected through the VPN just don't navigate. Everything starts working again if I change the setting in server.conf to use other DNS (like directly).

This is my /etc/openvpn/server.conf

dev tun
proto udp
port 50001
ca /etc/openvpn/easy-rsa/pki/ca.crt
cert /etc/openvpn/easy-rsa/pki/issued/server_wohFvJ5DCWXXXXXX.crt
key /etc/openvpn/easy-rsa/pki/private/server_wohFvJ5DCWXXXXXX.key
dh none
topology subnet
# Set your primary domain name server address for clients
push "dhcp-option DNS"
push "dhcp-option DNS"
push "block-outside-dns"
# Override the Client default gateway by using and
# rather than This has the benefit of
# overriding but not wiping out the original default gateway.
push "redirect-gateway def1"
keepalive 1800 3600
remote-cert-tls client
tls-version-min 1.2
tls-crypt /etc/openvpn/easy-rsa/pki/ta.key
cipher AES-256-CBC
auth SHA256
user nobody
group nogroup
crl-verify /etc/openvpn/crl.pem
status /var/log/openvpn-status.log 20
status-version 3
verb 3
#DuplicateCNs allow access control on a less-granular, per user basis.
#Remove # if you will manage access by user instead of device. 
# Generated for use by PiVPN.io

And this is /etc/dnsmasq.d/01-pihole.conf:









# If a DHCP client claims that its name is "wpad", ignore that.
# This fixes a security hole. see CERT Vulnerability VU#598349

I tried changing push "dhcp-option DNS" to push "dhcp-option DNS" or but nothing changes.

Any ideas why clients connected through OpenVPN can't navigate? What's wrong in my config? I want them to process DNS queries using cloudflared on port 5054 of the Pi.

  • 2
    tl;dr My personal experience is that troubleshooting OpenVPN issues is devilishly difficult for "mere mortals"; i.e. those than don't invest huge amounts of time in learning the details. And as this is more an OpenVPN question than a Raspberry Pi question, you may not find the help here that you need. In my case, I use an "appliance" that's set up for the VPN/firewall application, and OPNsense software. Not suggesting you change your approach, just wanted you to be aware of other options.
    – Seamus
    Feb 3, 2019 at 22:33
  • Can you paste the output of: netstat -tnlp and netstat -unlp
    – Bungee75
    Feb 7, 2019 at 12:05
  • netstat -tnlp pastebin.com/SB0DYbVU netstat -unlp pastebin.com/MQ5MQGzY Feb 8, 2019 at 14:07

4 Answers 4


VPNs make services tricky because they edit the routing table. They redirect all TCP/IP traffic through them, except for traffic to the VPN server, which includes re-routing what would have been a LAN IP address. It sounds like something similar might be happening.

You can have a look at the routing table using the ip route show command. If what's happening is traffic that would be going to the DNS is being routed incorrectly, you can add an explicit route for it using ip route add $DNSIPADDRESS via $GATEWAY where $GATEWAY would be another IP address, or alternatively dev eth0 if it needs to be through a LAN connection. It's hard to be more specific without a network diagram of some sort.

Of course, this could also be an issue of what interface Pi-hole is listening on, it may simply not be accepting traffic from VPN clients because it's set to only listen for LAN clients. Check this in the Settings -> DNS panel and see if "Listen on all interfaces" is selected or look in /etc/pihole/setupVars.conf at the IPV4_ADDRESS variable, which should be set to to listen on all interfaces.


Unless I'm reading this wrong, it looks like you have two services configured to listen on the same IP and port:

That's a definite no-no. Sounds like that is the cause of your pain... -T

  • How do I check which services are configured to listed on the same IP:port ? Feb 8, 2019 at 14:07
  • netstat -ntulp will show you what processes are actually up and listening (both TCP & UDP) but if a process isn't rising up successfully because another process has grabbed the port first, that service won't appear in the output of the command. I'd review my config files for the services you configured and see if they cleash on port and IP somewhere.
    – F1Linux
    Feb 8, 2019 at 14:25
  • /etc/dnsmasq.d/01-pihole.conf specifies server= However, I see from your pastebin output that Clourflared is listening on for both TCP & UDP connections. Both dnsmasq and cloudflared are point to the same ip and port.
    – F1Linux
    Feb 8, 2019 at 15:43
  • From an Arch Wiki Article which might be instructive: (wiki.archlinux.org/index.php/Pi-hole): Using Pi-hole together with OpenVPN : "An OpenVPN server can be configured to advertise a Pi-hole instance to its clients. Add the following two lines to your /etc/openvpn/server/server.conf: push "redirect-gateway def1 bypass-dhcp" push "dhcp-option DNS Pi-Hole-IP" If it still does not work, try creating a file /etc/dnsmasq.d/00-openvpn.conf with the following content: interface=tun0 It may be necessary to make dnsmasq listen on tun0."
    – F1Linux
    Feb 8, 2019 at 15:54
  • You'll need to change the port one or the other of those services are configured for to resolve the issue. BOTH can't listen on
    – F1Linux
    Feb 8, 2019 at 16:03

If you want your pihole to listen on all interfaces, change your /etc/dnsmasq.d/01-pihole.conf "interface=eth0" to "except-interface=nonexisting". This worked for me.

Also your push "dhcp-option DNS" is probably wrong. Use the IP you can access through VPN (like

  1. UPDATE the server:

    sudo apt update

    sudo apt upgrade -y

    sudo apt dist-upgrade -y

    sudo apt autoremove -y

    sudo apt autoclean -y

  2. Install from original OVPN source:

wget https://git.io/vpn -O openvpn-install.sh && bash openvpn-install.sh

chmod +x openvpn-install.sh

  1. For client user/password feature:

Edit the installer to have password login feature:

`EASYRSA_CERT_EXPIRE=3650 ./easyrsa build-client-full "$client" nopass`


`EASYRSA_CERT_EXPIRE=3650 ./easyrsa build-client-full "$client"`
  1. RUN the installer:


  2. Install PiHole

    curl -sSL https://install.pi-hole.net | bash

  3. Finally restart both services Or better to reboot now.

    pihole disable && pihole enable && systemctl restart openvpn-server@server

Ref: https://vvcares.com/blog/post/openvpn-with-pihole

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.