I have posted this to NetworkEngineering.SE, as that seems the more suitable audience for this question.
I will leave this question open here but am happy to see it closed. I just did not want to delete it in case someone was working on a reply.
I am running pfSense 2.1 and having an issue with a Proxy.sh setup. In particular, I have pfSense configured to connect over OpenVPN to the Proxy.sh server
us-nj.proxy.sh and to infinitely resolve the server.
It seems that the servers change from time-to-time, so pfSense has to re-resolve
us-nj.proxy.sh. Unfortunately the system tries to connect to DNS (Google's
220.127.116.11) through the now-disconnected proxy.
The server has interfaces
WAN (being to my ISP, named WAN_DHCP) and
OPT1 (being to the Internet via the OpenVPN interface, named ProxySHGW)
I have configured the pfSense outbound NAT as follows:
Interface Network Protocol WAN/OPT1 Ports WAN any tcp/udp/53 WAN * Straight DNS WAN 192.168.1.0/24 tcp/993 WAN * SMTP NAT WAN 192.168.1.0/24 tcp/* tcp/465 WAN * SMTP/S NAT OPT1 192.168.1.128/25 * OPT1 * LAN to OPT1 WAN 192.168.1.0/25 * WAN * LAN to WAN WAN 127.0.0.0/8 * WAN 1024:65535 localhost to WAN OPT1 127.0.0.0/8 * OPT1 1024:65535 localhost to OPT1
As you can tell the network is split, with IP addresses
192.168.12.128 – 255 going to the OPT1/OpenVPN, and
192.168.1.0 – 127 to the WAN.
The firewall rules are as follows:
Proto Source Port Destination Port Gateway IPv4 * * * 18.104.22.168 * WAN_DHCP IPv4 * * * 22.214.171.124 * WAN_DHCP IPv4 TCP LAN net * * 465 (SMTP/S) WAN_DHCP IPv4 TCP LAN net * * 993 (IMAP/S) WAN_DHCP IPv4 * 192.168.1.128/25 * * * ProxySHGW IPv4 * 192.168.1.0/25 * * * WAN_DHCP
I would think that these firewall and NAT would cause DNS requests to route over the WAN, but in practice it does not.
Strangely enough though the SMTP/S and IMAP/s routing does work as expected.
Any thoughts on what might be going on here would be much appreciated.