Opnsense GEOIP Blocking blocks cert request and renewal.

[Dvalin21]

I went on Telegram and spoke to Toby about this. He suggested posting here and asking @zen8841 about the issue. I use Opnsense with Zoraxy. When I setup GEOIP Blocking in Opnsense, it blocks zoraxy from requesting and/or renewing certs. I'm using DNS Challenge. Any idea what from Opnsense GEOIP Blocking would block the DNS Challenge? Thanks

[zen8841]

Ummm...
Theoretically, If only set GEOIP limit on INbound, I think it wont block any step in dns challenge.
ACME client send request to CA, and send request to DNS server though API. Both of these are OUTbound traffic.
Unless you self host your DNS server. CA need to check if the TXT record are set on DNS. This request is INbound for OpenSense.
Otherwise, I think the GEOIP/Firewall won't affect acme step.

[Dvalin21]

I can't explain it myself, however its only when I disable GEOIP Opnsense does it then go through. I do use Adguardhome, but there is no special setup that I would see that would affect this.

[zen8841]

Can you post the log of ban IP while using zoraxy to get cert?
Or try other tools like acme.sh/certbot, see if it will be affected by geoip?
I wan't to check whether is geoip affect these.

[Dvalin21]

I was actually able to get certs using certbot on the same network, with opnsense geoip enable and everything worked. I used DNS challenge of course

[Dvalin21]

Can you post the log of ban IP while using zoraxy to get cert? Or try other tools like acme.sh/certbot, see if it will be affected by geoip? I wan't to check whether is geoip affect these.

I figured it out. I had forgotten about unbound running on opnsense also running adguardhome. Once I chose to one dns server over the other, it started working even with geoip enabled.