We have a site to site tunnel with using a Meraki router to the Google Cloud. Pings and normal traffic flows between the two sites. The server on the Google Cloud side is a domain controller running DNS. However, the Google side of the tunnel will not return queries.
We did packet captures on the Meraki side and they show that the traffic is leaving over the tunnel but there's no response. I verified that I have the following in the firewall section on Google's side:
vpn-dns Ingress Apply to all IP ranges: 0.0.0.0/24 tcp:53, udp:53 Allow 65534 default
Thoughts on what may be missing or how to pinpoint? The domain controller has all firewalls turned off. You can RDP to it and ping it from the remote location as well.