# No DNS on internal LAN but via VPN

**URL:** <https://discourse.pi-hole.net/t/no-dns-on-internal-lan-but-via-vpn/8654>\
**Category:** Help\
**Tags:** ftldns-beta\
**Created:** [April 6, 2018, 12:03pm UTC](https://discourse.pi-hole.net/t/no-dns-on-internal-lan-but-via-vpn/8654 "2018-04-06T12:03:54Z")\
**Posts on this page:** 16\
**Page:** 1

<div class="post-metadata">

**Author:** ![Rico\_Lino](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/rico_lino/32/3201_2.png) [@Rico\_Lino](https://discourse.pi-hole.net/u/Rico_Lino)\
**Post date:** [April 6, 2018, 12:03pm UTC](https://discourse.pi-hole.net/t/no-dns-on-internal-lan-but-via-vpn/8654/1 "2018-04-06T12:03:54Z")

</div>

#### Please follow the below template, it will help us to help you!

I recently installed PiVPN besides Pi-hole (both updated yesterday).  
All was working good until I did a "pihole -up" today.  
It updated with no errors but now I can only make DNS queries on the VPN connected devices. On my local LAN pinging to an external IP is possible but no DNS queries anymore.

## Expected Behaviour:

DNS queries should be possible via LAN and VPN.

## Actual Behaviour:

DNS queries are only possible via VPN (see text at the top).

## Debug Token:

pk7pbom4ew

Thanks a lot

---

<div class="post-metadata">

**Author:** ![deHakkelaar](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/dehakkelaar/32/674_2.png) [@deHakkelaar](https://discourse.pi-hole.net/u/deHakkelaar)\
**Post date:** [April 6, 2018, 3:24pm UTC](https://discourse.pi-hole.net/t/no-dns-on-internal-lan-but-via-vpn/8654/2 "2018-04-06T15:24:32Z")

</div>

Are you running Jessie by chance ?  
Read this blog about dnsmasq version and Jessie:

[https://pi-hole.net/2018/02/14/pi-hole-v3-3-released-its-extra-special/](https://pi-hole.net/2018/02/14/pi-hole-v3-3-released-its-extra-special/)

Try post some `nslookup` results on the clients (not Pi-hole) like below examples:

Querying my router for "pi.hole" :

```
C:\>nslookup pi.hole 10.0.0.1
Server: router.asus.com
Address: 10.0.0.1

*** router.asus.com can't find pi.hole: Non-existent domain

```

Querying Pi-hole for "pi.hole" :

```
C:\>nslookup pi.hole 10.0.0.2
Server: noads.dehakkelaar.nl
Address: 10.0.0.2

Name: pi.hole
Address: 10.0.0.2

```

Querying without explicit DNS server:

```
C:\>nslookup pi.hole
Server: noads.dehakkelaar.nl
Address: 10.0.0.2

Name: pi.hole
Address: 10.0.0.2

```

---

<div class="post-metadata">

**Author:** ![RamSet](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/ramset/32/3497_2.png) [@RamSet](https://discourse.pi-hole.net/u/RamSet)\
**Post date:** [April 6, 2018, 5:12pm UTC](https://discourse.pi-hole.net/t/no-dns-on-internal-lan-but-via-vpn/8654/3 "2018-04-06T17:12:47Z")

</div>

Maybe double check the Interface listening behavior (and select Listen on all interfaces, permit all origins) ?

---

<div class="post-metadata">

**Author:** ![DL6ER](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/dl6er/32/281_2.png) [@DL6ER](https://discourse.pi-hole.net/u/DL6ER)\
**Post date:** [April 6, 2018, 5:22pm UTC](https://discourse.pi-hole.net/t/no-dns-on-internal-lan-but-via-vpn/8654/4 "2018-04-06T17:22:56Z")

</div>

From @Rico_Lino tricorder log, I can already see that he has his interface listening behavior set up correctly and is participating in the FTLDNS beta phase.

Some questions, hoping to narrow down the scope of this issue:

When you run

- `dig google.com +short @127.0.0.1`
- `dig google.com +short @192.168.0.10` (replace the IP by your Pi-hole's internal networking IP)
- `dig google.com +short @10.0.0.10` (replace the IP by your Pi-hole's VPN IP)

on your Pi-hole does it return an IP address?

When you query some pages from clients in your local network, does they show up if you run `pihole -t` on your Pi-hole?

---

<div class="post-metadata">

**Author:** ![Rico\_Lino](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/rico_lino/32/3201_2.png) [@Rico\_Lino](https://discourse.pi-hole.net/u/Rico_Lino)\
**Post date:** [April 6, 2018, 6:15pm UTC](https://discourse.pi-hole.net/t/no-dns-on-internal-lan-but-via-vpn/8654/5 "2018-04-06T18:15:31Z")

</div>

I think you will have an idea seeing my outputs:

_pi@fr0sh-pi:~ $ dig google.com +short @127.0.0.1_  
_172.217.18.14_  
_pi@fr0sh-pi:~ $ dig google.com +short @192.168.178.5_

_; \<\<\>\> DiG 9.10.3-P4-Raspbian \<\<\>\> google.com +short @192.168.178.5_  
_;; global options: +cmd_  
_;; connection timed out; no servers could be reached_  
_pi@fr0sh-pi:~ $ dig google.com +short @10.8.0.1_  
_216.58.210.14_

The internal clients don't show up (192.168.178.26 was my internal device):

_pi@fr0sh-pi:~ $ pihole -t_  
\_ [i] Press Ctrl-C to exit\_  
_Apr 6 20:09:07 dnsmasq[21570]: \* 127.0.0.1/35157 reply com is DNSKEY keytag 46967, algo 8_  
_Apr 6 20:09:07 dnsmasq[21570]: \* 127.0.0.1/35157 reply com is DNSKEY keytag 30909, algo 8_  
_Apr 6 20:09:07 dnsmasq[21570]: \* 127.0.0.1/35157 reply google.com is no DS_  
_Apr 6 20:09:07 dnsmasq[21570]: 1 127.0.0.1/35157 validation result is INSECURE_  
_Apr 6 20:09:07 dnsmasq[21570]: 1 127.0.0.1/35157 reply google.com is 172.217.18.14_  
_Apr 6 20:10:13 dnsmasq[21570]: 2 10.8.0.1/39963 query[A] google.com from 10.8.0.1_  
_Apr 6 20:10:13 dnsmasq[21570]: 2 10.8.0.1/39963 forwarded google.com to 1.0.0.1_  
_Apr 6 20:10:13 dnsmasq[21570]: 2 10.8.0.1/39963 forwarded google.com to 1.1.1.1_  
_Apr 6 20:10:13 dnsmasq[21570]: 2 10.8.0.1/39963 validation result is INSECURE_  
_Apr 6 20:10:13 dnsmasq[21570]: 2 10.8.0.1/39963 reply google.com is 216.58.210.14_

I have hope that you can help me... 😉  
Thanks!

---

<div class="post-metadata">

**Author:** ![DL6ER](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/dl6er/32/281_2.png) [@DL6ER](https://discourse.pi-hole.net/u/DL6ER)\
**Post date:** [April 6, 2018, 6:46pm UTC](https://discourse.pi-hole.net/t/no-dns-on-internal-lan-but-via-vpn/8654/6 "2018-04-06T18:46:12Z")

</div>

So this indicates that your Pi-hole listening on `lo` and `tun0`, but not on `eth0` (or whatever your Ethernet port may be called). What's the output of

```auto
netstat -anp | grep "53 "

```

?

---

<div class="post-metadata">

**Author:** ![Rico\_Lino](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/rico_lino/32/3201_2.png) [@Rico\_Lino](https://discourse.pi-hole.net/u/Rico_Lino)\
**Post date:** [April 6, 2018, 6:54pm UTC](https://discourse.pi-hole.net/t/no-dns-on-internal-lan-but-via-vpn/8654/7 "2018-04-06T18:54:10Z")

</div>

_pi@fr0sh-pi:~ $ sudo netstat -anp | grep "53 "_  
_tcp 0 0 0.0.0.0:38353 0.0.0.0:\* LISTEN -_  
_tcp 0 0 0.0.0.0:53 0.0.0.0:\* LISTEN 22398/pihole-FTL_  
_tcp6 0 0 :::53 :::\* LISTEN 22398/pihole-FTL_  
_udp 0 0 0.0.0.0:5353 0.0.0.0:\* 323/avahi-daemon: r_  
_udp 0 0 0.0.0.0:53 0.0.0.0:\* 22398/pihole-FTL_  
_udp6 0 0 :::5353 :::\* 323/avahi-daemon: r_  
_udp6 0 0 :::53 :::\* 22398/pihole-FTL_

---

<div class="post-metadata">

**Author:** ![DL6ER](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/dl6er/32/281_2.png) [@DL6ER](https://discourse.pi-hole.net/u/DL6ER)\
**Post date:** [April 6, 2018, 6:55pm UTC](https://discourse.pi-hole.net/t/no-dns-on-internal-lan-but-via-vpn/8654/8 "2018-04-06T18:55:41Z")

</div>

Hmm, that seems fine, do you know if PiVPN installed any firewall rules? How about

```auto
sudo iptables -L

```

---

<div class="post-metadata">

**Author:** ![Rico\_Lino](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/rico_lino/32/3201_2.png) [@Rico\_Lino](https://discourse.pi-hole.net/u/Rico_Lino)\
**Post date:** [April 6, 2018, 6:58pm UTC](https://discourse.pi-hole.net/t/no-dns-on-internal-lan-but-via-vpn/8654/9 "2018-04-06T18:58:30Z")

</div>

Everything default (I also flushed it, just to test it):

_pi@fr0sh-pi:~ $ sudo iptables -L_  
_Chain INPUT (policy ACCEPT)_  
_target prot opt source destination_

_Chain FORWARD (policy ACCEPT)_  
_target prot opt source destination_

_Chain OUTPUT (policy ACCEPT)_  
_target prot opt source destination_

---

<div class="post-metadata">

**Author:** ![Andre\_M](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/andre_m/32/2565_2.png) [@Andre\_M](https://discourse.pi-hole.net/u/Andre_M)\
**Post date:** [April 6, 2018, 9:05pm UTC](https://discourse.pi-hole.net/t/no-dns-on-internal-lan-but-via-vpn/8654/10 "2018-04-06T21:05:09Z")

</div>

Hi,  
i had the same problem here

> [@DNS Rekursion arbeitet nicht wie gewünscht auf allen Interfaces](https://discourse.pi-hole.net/t/dns-rekursion-arbeitet-nicht-wie-gewunscht-auf-allen-interfaces/8659/6):
>
> Ha! was ein Käse! Die Lösung: except-interface=nonexisting \<- löschen in /etc/dnsmasq.d eine neue Datei anlegen touch /etc/dnsmasq.d/02-pihole-own.conf Und in dieser Datei dann: interface=eth0 interface=tun0 interface=lo eintragen. In /etc/setupVars.conf beide Interfaces ala PIHOLE\_INTERFACE=eth0 PIHOLE\_INTERFACE=tun0 eintragen. Anschließend hab ich die Kiste rebootet da ein reiner pihole restartdns nicht ausgereicht hat. Ich geb den Hint auch gleich mal in dem anderen Thread, vie…

as posted in my last comment.  
Try out  
in `/etc/pihole/setupVars.conf`

```auto
PIHOLE_INTERFACE=eth0
PIHOLE_INTERFACE=tun0

```

make a new file in `/etc/dnsmasq.d` and call it `02-pihole-own.conf`  
Write in this file just 3 lines

```auto
interface=eth0
interface=tun0
interface=lo

```

check `/etc/dnsmasq.conf` and `/etc/dnsmasq.d/*` for a file with

```auto
except-interface=nonexisting

```

if this is in a file, delete it.

After that reboot the container, pihole restartdns is not enough here.

I'm not sure why this changes is needed now, on my old jessie containers it worked a long time but on stretch it works at this way only

---

<div class="post-metadata">

**Author:** ![Rico\_Lino](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/rico_lino/32/3201_2.png) [@Rico\_Lino](https://discourse.pi-hole.net/u/Rico_Lino)\
**Post date:** [April 7, 2018, 7:31am UTC](https://discourse.pi-hole.net/t/no-dns-on-internal-lan-but-via-vpn/8654/11 "2018-04-07T07:31:08Z")

</div>

I edited the configs as stated (but: /etc **/pihole** /setupVars.conf).  
Now it is working again as expected.

Maybe on monday I can try to dig deeper if all changes are really needed or not.

But for now: thanks a lot!

---

<div class="post-metadata">

**Author:** ![Andre\_M](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/andre_m/32/2565_2.png) [@Andre\_M](https://discourse.pi-hole.net/u/Andre_M)\
**Post date:** [April 7, 2018, 2:54pm UTC](https://discourse.pi-hole.net/t/no-dns-on-internal-lan-but-via-vpn/8654/12 "2018-04-07T14:54:00Z")

</div>

i think the most important is the dnsmasq conf at this point.  
i tried with except-interface=nonexisting (that means the same as list all interfaces separatly)  
and i tried with  
interface=eth0  
interface=tun0  
only and that hadn't worked for me. I must specify the lo too.

The chances in setupVars.conf are optional but if you don't do this, a pihole -r would break your config again.

But this is my experience only, i'm very interested in your findings 😉

---

<div class="post-metadata">

**Author:** ![Rico\_Lino](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/rico_lino/32/3201_2.png) [@Rico\_Lino](https://discourse.pi-hole.net/u/Rico_Lino)\
**Post date:** [April 9, 2018, 10:19am UTC](https://discourse.pi-hole.net/t/no-dns-on-internal-lan-but-via-vpn/8654/13 "2018-04-09T10:19:00Z")

</div>

My findings are nearly the same.  
I used [https://marcstan.net/blog/2017/06/25/PiVPN-and-Pi-hole/](https://marcstan.net/blog/2017/06/25/PiVPN-and-Pi-hole/) as a guide to install PiVPN besides pi-hole.  
And there's also no mention of the lo-Interface.  
So I think it is related to it (but can't imagine why...).

Btw: In the web-settings of pi-hole this is shown now:  
Pi-hole Ethernet Interface: tun0  
Do you also have this instead of eth0?

Greetings

---

<div class="post-metadata">

**Author:** ![Rico\_Lino](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/rico_lino/32/3201_2.png) [@Rico\_Lino](https://discourse.pi-hole.net/u/Rico_Lino)\
**Post date:** [April 9, 2018, 2:10pm UTC](https://discourse.pi-hole.net/t/no-dns-on-internal-lan-but-via-vpn/8654/14 "2018-04-09T14:10:00Z")

</div>

The issue was also solved by this:

- delete the 02-ovpn.conf in /etc/dnsmasq.d/
- be sure to have the line "except-interface=nonexisting" active in 01-pihole.conf in /etc/dnsmasq.conf/
- /etc/pihole/setupVars should only have PIHOLE\_INTERFACE=eth0 (and no other interfaces)

This was mentioned wrong / outdated in the link I posted earlier.

Greetings

---

<div class="post-metadata">

**Author:** ![Andre\_M](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/andre_m/32/2565_2.png) [@Andre\_M](https://discourse.pi-hole.net/u/Andre_M)\
**Post date:** [April 9, 2018, 8:30pm UTC](https://discourse.pi-hole.net/t/no-dns-on-internal-lan-but-via-vpn/8654/15 "2018-04-09T20:30:07Z")

</div>

> [@Rico\_Lino](#):
>
> Btw: In the web-settings of pi-hole this is shown now:
> 
> Pi-hole Ethernet Interface: tun0
> 
> Do you also have this instead of eth0?

yes, its the same for me. Before i change the configs there was my th0 device... after changes there is the tun device listed

---

<div class="post-metadata">

**Author:** ![system](https://discourse.pi-hole.net/uploads/default/original/3X/7/c/7c8792f649eeb921c5d2b4c41564ffa873d9a2b8.png) [@system](https://discourse.pi-hole.net/u/system)\
**Post date:** [April 30, 2018, 8:30pm UTC](https://discourse.pi-hole.net/t/no-dns-on-internal-lan-but-via-vpn/8654/16 "2018-04-30T20:30:07Z")

</div>

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.