1

I have posted this to NetworkEngineering.SE, as that seems the more suitable audience for this question.

I will leave this question open here but am happy to see it closed. I just did not want to delete it in case someone was working on a reply.


I am running pfSense 2.1 and having an issue with a Proxy.sh setup. In particular, I have pfSense configured to connect over OpenVPN to the Proxy.sh server us-nj.proxy.sh and to infinitely resolve the server.

It seems that the servers change from time-to-time, so pfSense has to re-resolve us-nj.proxy.sh. Unfortunately the system tries to connect to DNS (Google's 8.8.8.8 and 8.8.4.4) through the now-disconnected proxy.

The server has interfaces WAN (being to my ISP, named WAN_DHCP) and OPT1 (being to the Internet via the OpenVPN interface, named ProxySHGW)

I have configured the pfSense outbound NAT as follows:

Interface  Network   Protocol     WAN/OPT1     Ports 
WAN      any      tcp/udp/53     WAN     *       Straight DNS   
WAN      192.168.1.0/24  tcp/993     WAN     *       SMTP NAT   
WAN      192.168.1.0/24  tcp/*   tcp/465     WAN     *       SMTP/S NAT     
OPT1     192.168.1.128/25    *   OPT1    *       LAN to OPT1    
WAN      192.168.1.0/25      *   WAN     *       LAN to WAN     
WAN      127.0.0.0/8         *   WAN     1024:65535      localhost to WAN   
OPT1     127.0.0.0/8         *   OPT1    1024:65535      localhost to OPT1 

As you can tell the network is split, with IP addresses 192.168.12.128 – 255 going to the OPT1/OpenVPN, and 192.168.1.0 – 127 to the WAN.

The firewall rules are as follows:

Proto Source  Port  Destination Port  Gateway
IPv4 *     *   *   8.8.8.8   *   WAN_DHCP
IPv4 *     *   *   8.8.4.4   *   WAN_DHCP 
IPv4 TCP   LAN net   *   *   465 (SMTP/S)  WAN_DHCP 
IPv4 TCP   LAN net   *   *   993 (IMAP/S)  WAN_DHCP 
IPv4 *   192.168.1.128/25  *   *   *   ProxySHGW
IPv4 *   192.168.1.0/25  *   *   *   WAN_DHCP

I would think that these firewall and NAT would cause DNS requests to route over the WAN, but in practice it does not.

Strangely enough though the SMTP/S and IMAP/s routing does work as expected.

Any thoughts on what might be going on here would be much appreciated.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.