0

I'm trying to route the WIFI and OPT nets from my OPNsense box to my VPN. The LAN port is connected to another router and passes directly to my WAN (for greater speed and less privacy). When I connect to the OPNsense WIFI and browse to a variety of sites, they all return "DNS address could not be found."

My VPN gateway status is "online", the VPN is "up" and has a unique remote and virtual IP. When I ping www.google.com from the WIFI source address, I get 0% packet loss with an average round-trip of 20.9 ms from my WIFI static IP. When I ping www.google.com from the VPN source address, I get 0% packet loss with an average round-trip of 114.3 ms from the VPN virtual address IP (shouldn't it be from the remote host?). So the pings look like they are working correctly, which means WIFI and VPN both have internet.

Since ProtonVPN only has instructions to install on pfsense, I attempted to follow those as closely as possible: https://protonvpn.com/support/pfsense-2-5-x-vpn-setup/

For other details I tried to adapt the NordVPN instructions: https://support.nordvpn.com/Connectivity/Router/1292598142/OPNsense-19-1-setup-with-NordVPN.htm

Any suggestions on fixing the DNS resolution? I'm new to OPNsense and still learning how to navigate all the log pages.

Using:

  • OPNsense 21.7.1
  • FreeBSD 12.1
  • OpenSSL 1.1.1

enter image description here

I tried toggling between the first 2 outbound NAT rules and the next 4, but both sets of rules didn't help the DNS resolution issue. enter image description here enter image description here

guttermonk
  • 121
  • 4

1 Answers1

0

The solution is simple, and I'm not sure why none of the instructions that I read didn't mention something as simple and critical as this, but all you have to do is add a rule to allow access to your DNS port:

  • TCP/IP Version: IPv4
  • Protocol: UDP
  • Source: any
  • Source Port: any
  • Destination: This Firewall
  • Destination Port: DNS
  • Gateway: default
  • Schedule: none

You can make some of the generic settings more specific for better security, but these should work for most users.

guttermonk
  • 121
  • 4