I am on Rasbian Stretch. I installed OpenVPN (via PiVPN) and Pi-Hole (4.2).
I setup my Pi-Hole (that runs on 192.168.1.6 on the LAN) to use Cloudflare DNS over TLS (using the cloudflared
service on port 5054
).
Pi-Hole works great locally (other clients on the LAN pointing their DNS to 192.168.1.6
can navigate properly and I see their stats in the admin panel).
The problem is when I try to setup OpenVPN to use 192.168.1.6
(port 5054
) as DNS server. I see no specific error in the logs but clients connected through the VPN just don't navigate. Everything starts working again if I change the setting in server.conf
to use other DNS (like 1.1.1.1
directly).
This is my /etc/openvpn/server.conf
dev tun
proto udp
port 50001
ca /etc/openvpn/easy-rsa/pki/ca.crt
cert /etc/openvpn/easy-rsa/pki/issued/server_wohFvJ5DCWXXXXXX.crt
key /etc/openvpn/easy-rsa/pki/private/server_wohFvJ5DCWXXXXXX.key
dh none
topology subnet
server 10.8.0.0 255.255.255.0
# Set your primary domain name server address for clients
push "dhcp-option DNS 192.168.1.6"
push "dhcp-option DNS 1.0.0.1"
push "block-outside-dns"
# Override the Client default gateway by using 0.0.0.0/1 and
# 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of
# overriding but not wiping out the original default gateway.
push "redirect-gateway def1"
client-to-client
keepalive 1800 3600
remote-cert-tls client
tls-version-min 1.2
tls-crypt /etc/openvpn/easy-rsa/pki/ta.key
cipher AES-256-CBC
auth SHA256
user nobody
group nogroup
persist-key
persist-tun
crl-verify /etc/openvpn/crl.pem
status /var/log/openvpn-status.log 20
status-version 3
syslog
verb 3
#DuplicateCNs allow access control on a less-granular, per user basis.
#Remove # if you will manage access by user instead of device.
#duplicate-cn
# Generated for use by PiVPN.io
And this is /etc/dnsmasq.d/01-pihole.conf
:
addn-hosts=/etc/pihole/gravity.list
addn-hosts=/etc/pihole/black.list
addn-hosts=/etc/pihole/local.list
user=pihole
group=pihole
localise-queries
no-resolv
cache-size=10000
log-queries
log-facility=/var/log/pihole.log
local-ttl=2
log-async
# If a DHCP client claims that its name is "wpad", ignore that.
# This fixes a security hole. see CERT Vulnerability VU#598349
dhcp-name-match=set:wpad-ignore,wpad
dhcp-ignore-names=tag:wpad-ignore
server=127.0.0.1#5054
domain-needed
bogus-priv
interface=eth0
I tried changing push "dhcp-option DNS 192.168.1.6"
to push "dhcp-option DNS 10.8.0.0"
or 10.8.0.1
but nothing changes.
Any ideas why clients connected through OpenVPN can't navigate? What's wrong in my config? I want them to process DNS queries using cloudflared
on port 5054 of the Pi.
netstat -tnlp
pastebin.com/SB0DYbVUnetstat -unlp
pastebin.com/MQ5MQGzY