Solved 386.4 - Need some help with Broken OVPN to Pihole

[shadowfiber]

Hi all,

Looking for some suggestions and ideas on what I may be missing on this configuration. I believe everything was fully functional on prior firmware, however have not tested the functionality in a bit.

Environment:
AX86U -
DHCP Server provides internal IP of PiHole for DNS
WAN DNS configured to OpenDNS servers
VPN Confguration has "Advertise DNS to clients" enabled

When OVPN connects, I get a VPN address, with the proper PiHole address for DNS. I can ping the internal IP addresses, but I cannot resolve any names. This includes internal and external names. Testing device is on an Android phone.

I thought initially it was because of conditional forwarding on the pihole, it was configured only for the LAN segment. Added the VPN segment via a custom config file - and did not have any change. (unless I did it wrong)

I feel like I may be missing something simple here, open to any thoughts and suggestions.

Thanks all!

 

[eibgrad]

Can you at least ping and/or access the GUI of the pihole? If so, then most likely the pihole itself is configured only to allow access by local clients, NOT those of the OpenVPN server (e.g., 10.8.0.0/24).

We just diagnosed this problem on the DD-WRT forum.

DD-WRT :: View topic - Can't reach pihole from VPN, port 53 blocked?

forum.dd-wrt.com

 

[shadowfiber]

@eibgrad Hey, thanks for the response. Yes i can ping the pihole IP. I can get to the GUI via IPort
I also can verify that in the OVPN logs on the client it shows that the DNS server was pushed with the correct IP.

I tested what you found on the DD-WRT forum and had interesting results. I am a bit confused.

Changing "Listen on all interfaces" (Default config) to "Listen only on interface eth0" and it started resolution over the VPN tunnel. OK, great.

I am glutton for punishment and changed it back... Continued to work.

Documentation says "Listen on all interfaces" will allow queries only from 1 hop away. VPN in this case should be 1 hop, the router. Listen only on interface eth0 would allow more than 1 hop, i suppose. But then I don't understand why it continues to work?

In any case, thank you for responding, this at least gives me the functionality; I just wish I fully understood why it's now working in the same configuration I had it in before.

 

[shadowfiber]

Sorry for double post.

I feel better now.

If I reboot the pihole and try it again it breaks with the default config. Then works again when I listen past 1 hop.

Thanks for the fast response and quick fix. Hopefully this thread helps someone in the future.