fix: the remote access clients' resolver answers on the internal address by default, chosen by p2s.dns_listen, so the name server can take port 53 of the external addresses.

README.md

@@ -115,6 +115,7 @@ must have the type shown below; an unknown section or setting is an error.
 | `site_to_site` | | object | | The site-to-site connections, each a name and an object of the settings below |
 | `p2s` | `enabled` | boolean | `false` | Road-warrior access |
 | `p2s` | `address_pool` | string | | CIDR assigned to road-warrior clients |
+| `p2s` | `dns_listen` | string | `internal` | The addresses of the resolver the road-warrior and OpenVPN clients are given: `internal`, `external` or `both` |
 | `wireguard` | `enabled` | boolean | `false` | WireGuard endpoint |
 | `wireguard` | `address` | string | | The router's own address on `wg0` with the prefix of the peers' network, for example `192.168.200.1/24`; the network and the broadcast address of a network larger than /31 are refused |
 | `wireguard` | `listen_port` | integer | `51820` | UDP port |
@@ -634,8 +635,8 @@ certificate and key from `/etc/caddy/vpn-router-pki/<name>/`, readable by its gr
 With `openvpn.enabled`, an `address_pool` and `wan.local_fqdn` set, `vpn-router-setup` runs
 `openvpn-server@vpn-router` with `/etc/openvpn/server/vpn-router.conf`. The server uses the
 router's VPN server certificate, the root and the P2S CA and their CRLs (see Certificates),
-pushes routes to `local.cidrs` and the router as DNS server, and opens `openvpn.port` on the
-external interface.
+pushes routes to `local.cidrs` and the router's addresses of `p2s.dns_listen` as DNS servers, and
+opens `openvpn.port` on the external interface.
 
 A client needs both a certificate of the P2S CA and the password of the user the
 certificate names:
@@ -871,9 +872,13 @@ deploying.
 which is how a deferred install is expressed. `generic` is the module to choose when the
 router should be configured but the platform adds nothing.
 
-The shipped modules currently add nothing. Road-warrior clients are given the router
-itself as their DNS server and the router forwards through its own `systemd-resolved`, so
-no provider resolver has to be advertised or routed through the tunnel on any platform.
+The shipped modules currently add nothing. Road-warrior and OpenVPN clients are given the
+router's addresses of `p2s.dns_listen` as their DNS servers, by default the internal address,
+where the drop-in `/etc/systemd/resolved.conf.d/p2s-forwarder.conf` makes the router's own
+`systemd-resolved` answer and the firewall opens port 53 for the client pools, so no provider
+resolver has to be advertised or routed through the tunnel on any platform. The clients reach
+the internal address when it is inside `local.cidrs`, which they route through the tunnel. Port 53
+of the other addresses stays free for the name server (see Name server).
 The modules exist as the documented place for platform specifics if that changes.
 
 A module may define any of the following, and takes the default for anything it omits:
@@ -1569,8 +1574,8 @@ missing, without the recommended bind backend.
 Records added with `/dns` or the Router Manager (A, AAAA, CNAME, TXT, MX, SRV, CAA) are served
 too, but not those of a name and type the zone's own records have. Setup writes the zone at each
 run; the SOA's serial grows only when the records change. While P2S or OpenVPN is enabled,
-systemd-resolved answers their clients on port 53 of the external addresses, so `dns.listen` must
-be `internal`. The parent zone must delegate `dns.zone` to `dns.nameserver`, with glue records for
+systemd-resolved answers their clients on port 53 of the addresses of `p2s.dns_listen`, by default
+the internal address, so `dns.listen` must not share an interface with it. The parent zone must delegate `dns.zone` to `dns.nameserver`, with glue records for
 a name server inside the zone.
 
 ```sh