2

I have a home network with most devices running NordVPN.

I have a raspberry pi acting as a mini home server - and have just started using Pi-Hole a DNS program that points various tracking and marketing URLs to nothing.

If I manually set the DNS on my computer to the local address of the Pi then it all works fine. But if I turn on the VPN (on my PC connecting over the wifi to the router and out to the intenet) then the local DNS simply fails.

In summary:- With the VPN off I can ping my mini-server and nslookup specifying it as the server 'nslookup - xxx.xxx.xxx.xxx' all works fine. But if I activate the VPN, while the ping is still fine, the nslookup times out.

I suspect the DNS requests are being sent out through the VPN (which then can't access my local addresses). Is there a way of verifying this? And if it is the problem configuring the PC to use the Pi first even when the VPN is active?

This question (local DNS not working with VPN active) has been asked a few times before, but hasn't had an answer that I could find.

Suggestions made and tried:-

  • Manually add a route to the local DNS server - unfortunately NordVPN only lets you give an IP address, not to specify a route.
  • Bridge the VPN adaptor and a local adaptor - this just blocked internet access.
  • Use a loopback adaptor with high priority so windows tries this first - unfortunately it seems the VPN priority is blank and gets first crack at everything
  • Use 'split tunneling' so only remote traffic goes via the VPN - unfortunately the NordVPN client only allows split tunneling on an app by app basis, not based on ip address.

Idea working on...

  • YogaDNS (https://www.yogadns.com/) is an app that looks like it can intercept and redirect DNS calls at a very low level -- But I have not found a configuration that works yet (I am speaking to their support people).
Improve this question
6
  • Have you considered using a hosts file for the filtering, such as MVPS?
    – JW0914
    Jan 18, 2022 at 21:02
  • 1
    Thanks for the suggestion - the advantage of pihole is that it has an automatically updated list of tens of thousands of dodgy domains, and allows 'wild card' blocking of subdomains too. So as things stand I am looking for a way of making pihole and nord work together...
    – pperrin
    Jan 18, 2022 at 23:14
  • Sorry to be blunt, but have you tried searching the web? It's considered the minimum effort to prevent that someone spends time suggesting something that you've tried already. It's fine if you found solutions but did not manage to get them to work, simply edit your question to include what you found and where you got stuck.
    – Saaru Lindestøkke
    Jan 19, 2022 at 13:38
  • @SaaruLindestøkke I have no idea what you are talking about - the problem I set out exists and no solution is apparent. I am still trying many approaches - if one works I will post it as a solution. In the mean time, if you think there is already a solution just post the link as an answer...
    – pperrin
    Jan 19, 2022 at 23:59
  • In the second link of my comment there's an explanation on how to ask questions I was referring to. It says: "Have you thoroughly searched for an answer before asking your question? Sharing your research helps everyone. Tell us what you found and why it didn’t meet your needs."
    – Saaru Lindestøkke
    Jan 20, 2022 at 8:47

3 Answers 3

Reset to default
1

This is expected behavior. All traffic must go through the VPN for it to be effective, otherwise your local DNS would point the connection towards the internet and not towards your VPN. It is going to be either your Pi DNS server or NordVPN.

Improve this answer
1
  • I am prepared to do more to get what I want (my own DNS to have first crack before passing over to the VPN) - one path I am now looking at is YogaDNS, (yogadns.com) it loos like it should do what I want, but I am still working on making it so. It effectively says it give you control of your DNS entirely separately from the interface you are currently using...
    – pperrin
    Jan 20, 2022 at 0:08
1

NordVPN is an SSL VPN [OpenVPN], with DNS settings specified in the client config templates:

  • NordVPN dynamically creates an .ovpn config from templates: 
    "%ProgramFiles%\NordVPN\<version>\Resources\templates\template.xslt"
"%ProgramFiles%\NordVPN\<version>\Resources\templates\xor_template.xslt"
  1. Shutdown NordVPN
  2. Open templates in a text editor, adding between lines:
    </xsl:for-each> and <xsl:for-each select="/config/local/setting"> 
    # Set IP to Pi-Hole's DNS server:
  dhcp-option   DNS 192.168.1.1

# You can also specify your own WAN DNS [OpenDNS]:
  dhcp-option   DNS 208.67.222.222
  dhcp-option   DNS 208.67.220.220

# May also be required: Add LAN route to Pi-Hole's IP subnet
  route         192.168.1.0 255.255.255.0
  3. Re-open NordVPN
    (I don't use NordVPN, so I have no way to test if issues occur, please leave a comment if they do)
Improve this answer
5
  • Maybe I am hitting a limit of the NordVPN client software? There is nowhere to set a route from their tunnel's adaptor to my LAN?
    – pperrin
    Jan 20, 2022 at 0:02
  • @pperrin The information would be added to the .ovpn file
    – JW0914
    Jan 20, 2022 at 14:39
  • I am running the nordvpn client on a windows machine, I have searched but can't find a ,ovpn file.
    – pperrin
    Jan 20, 2022 at 18:14
  • @pperrin NordVPN stores the template configs within %ProgramFiles%\NordVPN\6.41.11.0\Resources\templates - open the applicable template(s) within a text editor [VS Code, Notepad, etc.] and add the config options in the same area as the other OpenVPN config options that start below the line containing </xsl:for-each>. I'll update the answer within the next few days, as I didn't realize they store the config files differently than OpenVPN's default files/locations.
    – JW0914
    Jan 20, 2022 at 22:04
  • @pperrin I've added the steps specific to NordVPN, but since I don't use NordVPN, please let me know if issues occur
    – JW0914
    Jan 27, 2022 at 14:05
0

It seems a bit of a 'work around' rather than genuine solution - but I have it working based on a combination of suggestions and extra stuff...

I installed YogaDNS a windows app that intercepts DNS lookups and lets you redirect them (I told it to redirect to my local server), on it own it didn't fix the problem as it redirected the lookups through the VPN(!)... However by then adding YogaDNS to NordVPN's list of 'split tunnelling' apps I get the result I want - DNS goes to my local server but internet traffic goes through the VPN.

This isn't great because it needs to be configured on every PC (it can't be done from settings handed out by DHCP).

Also, I want my local DNS server to use NordVPN's DNS servers as its upstream server for names it doesn't yet know (I don't want to leak my DNS lookups), but this is a different issue(!).

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .