Thread Info
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

DNS Not working through ipsec VPN

Ian Coan

I have a Sophos XG 85 v17 with a site-to-site vpn running to a Ubiquiti UDM Pro. The tunnel is working great despite DNS not resolving from either end through the tunnel. The XG subnet is 10.10.10.0/24 and the Ubiquiti subnet is 10.0.0.0/24. I can ping in both directions just fine but I cannot ping any DNS on the opposite side of the tunnel. The only way I have been able to accomplish it is by adding a record to the local hosts file on the windows machines and that is just not the way to accomplish this. So does anyone know how to actually accomplish this? I've tried adding a DNS host record on my Sophos but that didn't work.

Device to ping pinas on the Ubiquiti UDM Pro with IP of 10.0.0.2

Device to ping dmx on the Sophos XG 85 with IP of 10.10.10.240



This thread was automatically locked due to age.
  • 0

    Hi,

    what DNS settings have you configured in your XG85? Do you have any devices configured in the DNS on the XG?

    Ian

    XGS118 - v22.0 EAP

    XG115 converted to software licence v21.5.0

    If a post solves your question please use the 'Verify Answer' button.

  • 0

    for Sophos XG to be able communicate through an IPSec tunnel, you need SNAT for system generated (by the XG itself) traffic and create an ipsec route.

    https://support.sophos.com/support/s/article/KB-000035839?language=en_US

    I think this is your issue but it's unclear who resolved DNS in your situation. You could create a DNS resolution chart if the article does not help.

  • 0

    Solution
    If DNS Not working through ipsec VPN, check following steps:

    1) Make sure to set DNS server properly when configuring SSL or IPsec VPN. In this example a server .abcd.local which resolves to 10.1.2.3 will be used.
    2) Make sure to be able to ping using IP address, ping 10.1.2.3.
    3) Confirm to ping using FQDN, ping server.abcd.local.
    4) Check to ping using hostname, ping server. If not, add suffix into SSL and IPsec VPN configuration
    5) Configuring DNS suffix in SSL and IPsec VPN configuration.

    For SSL VPN.
    # config vpn ssl settings
    (settings) set dns-suffix abcd.local
    (settings) end
    For IPsec VPN.
    # config vpn ipsec phase1-interface
    (phase1-interface) edit <VPN TUNNEL NAME>
    (VPN TUNNEL NAME) set domain abcd.local
    (VPN TUNNEL NAME) end

    Regards,

    Rachel Gomez