What you have exactly added to named.conf.local?
I have there among trusted sources localnets, the VPN range is on local tap interface, but queries from VPN are refused. The .mas has also
acl "internal-local-nets" {
% foreach my $net (@internalLocalNets) {
<% $net %>;
% }
};
but I did not found a way to get a VPN ranges into "internalLocalNets" - not sure how zentyal distiguishes this. So you have added directly your VPN IP range somewhere?
Thanks