DHCP and DNS

• 

  HEADS UP: Be aware of Trusted Recursive Resolver (TRR) in Firefox
  • jimp

  12
  8
  Votes
  12
  Posts
  720
  Views

  

  Thanks for the info - lets hope they don't try and enable this on the sly in the background ;) Doing such a thing for sure would force me to rethink my browser choice..
• 

  RFC2136 Server Setup How-to
  • jimp

  19
  0
  Votes
  19
  Posts
  20553
  Views

  

  You have some logs as showed above ?
• T

  Wildcard DNS entries
  • tommyboy180

  6
  0
  Votes
  6
  Posts
  17150
  Views

  C

  @Yowsers: This is in the wiki as well. https://doc.pfsense.org/index.php/Wildcard_Records_in_DNS_Forwarder/Resolver Yes - and that page also misses a big gotcha. As someone coming from dnsmasq / "forwarder"  I had multiple host overrides too. Unbound / resolver refuses to start if you set up a wildcard subdomain AND have host overrides that match.  So you need to delete all the host overrides that use the same subdomain. If you want to override a host in your domain override with unbound, best to do it on the resolver at which you are pointing.
• S

  100 DNS errors on ipleak.net when upgrading to 2.4.4
  • smegheed

  8
  0
  Votes
  8
  Posts
  154
  Views

  S

  I've tried asking on the IPLeak forums about what the 100 errors mean and no one has come back to me with an informative reply. Best i can figure out the errors signify that no DNS servers were found or able to be verified as leaking or not. While i can't rule out the possibility that its more an issue with IPLeak or something else, to me it seems very conclusive that the problem lies with the update to PFsense and its dns resolver feature. I've checked, double checked and triple checked that the settings I'm using in 4.4 are the same as what i use in 4.3. I've had 2 boxes running side by side, one using 4.3 and the other using 4.4. In 4.4 it fails to work and i get the 100 errors. In 4.3 it works fine and i get 1 result with no leaking detected and more importantly no errors. It's not the browser or computer i use to access the site that's the problem as they stay they same. The only thing that changes is what version of PFSense I use. I've even tried setting up PFSense to act as a router to my main internet connection so as to eliminate openvpn being an issue along with the other settings i use to make the openvpn connection work how i need it to. Putting my ISP's router into modem mode and configuring PFSense in a very basic setup to get the IP from the modem and then accessing IPLeak through this box the problem still occurs. Where as if i access IPLeak through my ISP's router without the PFSense box i get no errors and it all works fine. I understand what's been said about if it's wise to use a VPN providers testing site but it's what i've used without a problem in the past and can still use perfectly fine in every other scenario besides if PFSense 2.4.4 is used. This make me believe that the common fault is PFSense regardless of the sites motives and trustfulness. The only thing i can think of where it's not PFSense that's the problem is that in the update to the dns resolver feature its 'improved' things to the point its now incompatible with an old way of doing the dns checking or something that IPLeak uses. If this is the cases then that's great. I can accept that. My only issue with this being the case then stems from the question: How do i know for sure and how do i figure out where the fault actually lies?
• O

  DHCP fails silently, but works on reboot of pfSense
  • obelsen

  1
  0
  Votes
  1
  Posts
  8
  Views

  No one has replied

• S

  Using different dns server per lan port.
  • supersayian

  3
  0
  Votes
  3
  Posts
  32
  Views

  S

  @KOM Thanks for the information. I will try it out and see what happens. I will be setting up vlans to separate things on my home network. I am getting a unifi wap and want to create the two networks using one access point. Currently I am using two wap to keep separate.
• L

  How to add an arp table containing a hundred entries without restarting the pfsense router?
  • linkdragon70

  4
  0
  Votes
  4
  Posts
  93
  Views

  

  Restart the dhcpd
• S

  Normal tracerotue for mail.google.com to china?
  • SmokinMoJoe

  5
  0
  Votes
  5
  Posts
  107
  Views

  S

  I had similar/identical traceroute from a Mac OS X client and on the pfSense box itself using 127.0.0.1(unbound). Seems like it would be interesting to have unbound log when DNSSEC could not be used becuase the root keys are invalid, either the time on pfSense is wrong or the ISP is doing layer 7 manipulation. i.e. like what happens when you live in China, Russia or the USA...
• Y

  PXE boot for UEFI Systems
  • yis

  2
  0
  Votes
  2
  Posts
  63
  Views

  G

  @yis Test with tftp client and see if you can get efi file. I just put them in my tftpboot folder and do not specify a Root Folder.
• H

  Is TLS resumption possible for DNS over TLS
  • HakanTT

  2
  0
  Votes
  2
  Posts
  41
  Views

  

  Not yet possible in Unbound. There is an open feature request for that in Unbound itself. https://www.nlnetlabs.nl/bugs-script/show_bug.cgi?id=4089 See also: https://nlnetlabs.nl/pipermail/unbound-users/2018-July/010743.html
• R

  DNS Query time always 0 msec
  • Raffi_

  9
  0
  Votes
  9
  Posts
  165
  Views

  

  Thanks for the update. Good to see the Universal Windows Fix also applies to other stuff, too
• T

  Does Unbound Honor Gateway Monitoring?
  • TheNarc

  1
  0
  Votes
  1
  Posts
  26
  Views

  No one has replied

• L

  Ruting DNS Server
  • l.lucii

  1
  0
  Votes
  1
  Posts
  25
  Views

  No one has replied

• L

  DNS resolver - Domain Override with MS AD
  • lolman88

  1
  0
  Votes
  1
  Posts
  21
  Views

  No one has replied

• N

  (RESOLVED) Static WAN Issue, DNS Issue, Connectivity Issue among Subnets
  • NetworkAdmin

  12
  0
  Votes
  12
  Posts
  185
  Views

  

  You think connecting interface 1 to interface 2 on the same em host is a valid config? It is FUBAR and Borked plain and simple.. but overall I'd say that 70% of post I read on this forum are techs insulting the crap out of people asking for help.. Utter Nonsense... You joined 26 days ago.. If you find posts offensive Report them!!! I have been here 10+ years.. What you find is the same question over and over and over again from people to lazy to do any research on their own. Getting fed the info on silver spoons. What you READ into something is not my problem - if you take offense to stating something is F'd UP when it it... That is not someone offending you that is someone stating their freaking opinion on a public forum just like you have the right to do... I take offense at your post to be honest ;) Here you go complaining about someone saying what you did was BORKED... Vs providing some info to work with.. While I am not a hyper-v guru... I am sure there are others here.. I don't need to be a guru to understand you don't interconnect interfaces on the same vm host together.. Then we have one nic port bridged with the lan that goes to out printer and smart tv. Your nic is bridged where in hyper-v or pfsense? Why are you bridging interfaces in pfsense? If that is the case.. Do not use your host interfaces as switch ports... If you need switch ports - get a switch.. Is that what your doing? A network drawing would be very helpful.. Some logs? Changing your wan from dhcp to static would have zero to do with your other config.. So clearly something else going on that has nothing to do with that.. But without actual info of what you did impossible to guess - to start with what 2 networks did you connect together with your nics? Remove that - what doesn't work?
• F

  VLAN DHCP Issue
  • forbidden_magic

  7
  0
  Votes
  7
  Posts
  89
  Views

  

  @johnpoz said in VLAN DHCP Issue: Yeah we have been over than and over that.. They might not strip the tags - but they don't isolate either... So broadcast traffic is going to go everywhere no matter what vlan tag you put on it.. How much broadcast traffic will there be on a small network, that it causes a problem? For example here, my only need for a VLAN is to support guest WiFi (which I wasn't able to do thanks to TP-Link and their access point which doesn't properly support VLANs). Will there be much more traffic if I didn't have a VLAN and all WiFi used the same SSID? Also, with IPv6, which I run on my network, there's no such thing as broadcasts, so that issue is going away. On the other hand, claiming a managed switch is needed just to pass VLANs is just plain wrong. I am not against a managed switch and encourage use of them, but I don't like people spreading false info. Before claiming an unmanaged switch can't be used, you really should understand the context. There really are some where a managed switch won't make much of a difference. As for isolation, how many people, other than guys like us, are even capable of configuring an interface to access VLANs? That is assuming the computer is even capable of it. My ThinkPad isn't. Will someone using the guest WiFi be able to snoop on local traffic? There are certainly reasons for managed switches, but there are also many situations where they don't buy much.
• Z

  Dynamic DNS - failing to lookup WAN IP in 2.4.4
  dyndns ddns • • ZPrime

  11
  1
  Votes
  11
  Posts
  367
  Views

  Z

  @jimp On my installation, the default route is set to the cable modem static gateway, so no gateway group issue in play for me. "Link#6" is igb5 which is my OPT4 interface going to the DSL modem. The modem has an IP of 192.168.254.254/24 (it's from Windstream), the pfSense box has .1, which we set statically. "Link #2" is igb1 which is the static IP (/30) from Spectrum / Time Warner Business. netstat -nr Routing tables Internet: Destination Gateway Flags Netif Expire default 70.60.x.y UGS igb1 1.0.0.1 192.168.254.254 UGHS igb5 1.1.1.1 70.60.x.y UGHS igb1 4.2.2.4 192.168.254.254 UGHS igb5 4.2.2.5 70.60.x.y UGHS igb1 8.8.4.4 192.168.254.254 UGHS igb5 8.8.8.8 70.60.x.y UGHS igb1 9.9.9.9 70.60.x.y UGHS igb1 10.17.0.0/24 link#1 U igb0 10.17.0.1 link#1 UHS lo0 10.254.254.0/24 10.254.254.2 UGS ovpns1 10.254.254.1 link#11 UHS lo0 10.254.254.2 link#11 UH ovpns1 70.60.x.w/30 link#2 U igb1 70.60.x.z link#2 UHS lo0 127.0.0.1 link#8 UH lo0 149.112.112.112 192.168.254.254 UGHS igb5 192.168.254.0/24 link#6 U igb5 192.168.254.1 link#6 UHS lo0 ping -c 4 192.168.254.254 PING 192.168.254.254 (192.168.254.254): 56 data bytes 64 bytes from 192.168.254.254: icmp_seq=0 ttl=64 time=1.170 ms 64 bytes from 192.168.254.254: icmp_seq=1 ttl=64 time=1.071 ms 64 bytes from 192.168.254.254: icmp_seq=2 ttl=64 time=1.084 ms 64 bytes from 192.168.254.254: icmp_seq=3 ttl=64 time=1.083 ms --- 192.168.254.254 ping statistics --- 4 packets transmitted, 4 packets received, 0.0% packet loss round-trip min/avg/max/stddev = 1.071/1.102/1.170/0.040 ms arp -i igb5 -a ? (192.168.254.254) at 4c:17:eb:21:26:09 on igb5 expires in 1178 seconds [ethernet] ? (192.168.254.1) at 00:08:a2:09:5a:15 on igb5 permanent [ethernet] traceroute -I -i igb5 checkip.dyndns.com traceroute: Warning: checkip.dyndns.com has multiple addresses; using 216.146.43.71 traceroute to checkip.dyndns.com (216.146.43.71), 64 hops max, 48 byte packets 1 * * * 2 * * * 3 * * * 4 * * * ^C ping -c 4 -S 192.168.254.1 checkip.dyndns.com PING checkip.dyndns.com (216.146.43.71) from 192.168.254.1: 56 data bytes --- checkip.dyndns.com ping statistics --- 4 packets transmitted, 0 packets received, 100.0% packet loss [This seems like it might be some of the problem...] It seems like I can't get a traceroute (ICMP) through the crappy DSL modem. However, apinger is not complaining about the connection being down, and it is set to ping 4.2.2.4 from that interface (instead of using the gateway IP). So maybe there's an apinger bug in play here and my connection is actually down but not correctly showing it? It would be immensely more helpful if BSD ping could be forced to send from a specific interface... I'm wondering if ping -S <int_ip> is trying to send the traffic out the wrong interface somehow and is maybe a red herring? So let's play some more - adding a static route to 216.146.43.71 (which is one of the IPs for checkip.dyndns.com) to force it through the DSL gateway: route add -host 216.146.43.71 192.168.254.254 add host 216.146.43.71: gateway 192.168.254.254 ping 216.146.43.71 PING 216.146.43.71 (216.146.43.71): 56 data bytes 64 bytes from 216.146.43.71: icmp_seq=0 ttl=49 time=149.241 ms 64 bytes from 216.146.43.71: icmp_seq=1 ttl=49 time=150.749 ms 64 bytes from 216.146.43.71: icmp_seq=2 ttl=49 time=151.432 ms ^C --- 216.146.43.71 ping statistics --- 3 packets transmitted, 3 packets received, 0.0% packet loss traceroute -I 216.146.43.71 traceroute to 216.146.43.71 (216.146.43.71), 64 hops max, 48 byte packets 1 192.168.254.254 (192.168.254.254) 1.165 ms 0.912 ms 0.930 ms 2 h3.176.142.40.ip.windstream.net (40.142.176.3) 20.753 ms 20.375 ms 19.908 ms 3 ae2-0.agr03.hdsn01-oh.us.windstream.net (40.136.113.108) 21.559 ms 22.031 ms 21.936 ms 4 et9-0-0-0.cr01.cley01-oh.us.windstream.net (40.136.97.135) 24.981 ms 20.902 ms 24.131 ms 5 et11-0-0-0.cr01.chcg01-il.us.windstream.net (40.128.248.71) 27.746 ms 30.224 ms 30.609 ms 6 chi-b21-link.telia.net (80.239.194.41) 30.788 ms 32.021 ms 28.424 ms 7 nyk-bb3-link.telia.net (80.91.246.163) 147.362 ms 149.769 ms 147.627 ms 8 ldn-bb3-link.telia.net (62.115.135.95) 144.829 ms 144.190 ms 144.030 ms 9 hbg-bb1-link.telia.net (80.91.249.11) 140.047 ms 132.839 ms 130.322 ms 10 war-b1-link.telia.net (62.115.135.187) 145.479 ms 146.117 ms 145.660 ms 11 dnsnet-ic-320436-war-b1.c.telia.net (213.248.68.135) 151.281 ms 147.401 ms 151.799 ms 12 checkip.dyndns.com (216.146.43.71) 150.409 ms 152.881 ms 151.245 ms curl -v --interface igb5 http://216.146.43.71 * Rebuilt URL to: http://216.146.43.71/ * Trying 216.146.43.71... * TCP_NODELAY set * Local Interface igb5 is ip 192.168.254.1 using address family 2 * Local port: 0 * Connected to 216.146.43.71 (216.146.43.71) port 80 (#0) > GET / HTTP/1.1 > Host: 216.146.43.71 > User-Agent: curl/7.61.1 > Accept: */* > < HTTP/1.1 200 OK < Content-Type: text/html < Server: DynDNS-CheckIP/1.0.1 < Connection: close < Cache-Control: no-cache < Pragma: no-cache < Content-Length: 104 < <html><head><title>Current IP Check</title></head><body>Current IP Address: 75.90.aaa.bbb</body></html> * Closing connection 0 [!! WORKS !!] Something really weird is going on here. For whatever reason the traffic is not correctly egressing through the specified interface when using curl --interface, and it's only going the way we want if I manually add a static route. I'm not exactly sure how the PHP code is hitting checkip.dyndns.com directly via a given interface, but something has changed behavior-wise that is making this fail. (Guessing maybe it's an underlying OS thing at this point, but I suppose it could also be something with curl if that is just being called via PHP?)
• T

  Does pfSense answer to DHCP Helpers/Relay yet?
  • tomstephens89

  5
  0
  Votes
  5
  Posts
  113
  Views

  T

  @derelict Damn, ok thanks.
• S

  Static WAN to Bridged Router
  • sikita

  7
  0
  Votes
  7
  Posts
  116
  Views

  S

  Ok, all clear, thank you!
• D

  Cannot access Unbound Remote Control
  • douglasg14b

  2
  0
  Votes
  2
  Posts
  64
  Views

  

  You need to pass it the full path to the config file. $ unbound-control -c /var/unbound/unbound.conf stats_noreset
• E

  pfSense DNS cache refresh interval
  • Exocomp

  19
  0
  Votes
  19
  Posts
  207
  Views

  

  Any time - I could discuss DNS for hours and hours ;) So if you ever have any questions about DNS just post a thread I will more then likely see it and comment.. The problem of when a firewall updates its aliases is problem with pretty much every firewall have worked with in the last 30 years when client might use or get something different. When there is more than 1 IP for some fqdn.. Be it based upon geo location of the query or some sort of roundrobin, or from a cache that resolves from a different location then the firewall/user, etc. It's not just pfsense that such issues can be seen that is for sure.. Blocking of url based stuff is normally done better with a proxy where the proxy so you can base the filter on the actual uri being requested vs the IP of said fqdn in the url.. Proxy also allows for filtering on path or other words in the url and not just the hostname portion, etc. DNS based lookups and blocking of the IP work fine when its static sort of IPs returned, but when your wanting to talk to something hosted on a CDN that returns lots of different IPs for the same fqdn then yeah you can run into complications.
• T

  Custom resolv.conf Options
  • TheNarc

  5
  0
  Votes
  5
  Posts
  90
  Views

  T

  Ah okay, that would explain it, thanks!
• L

  DNS forwarder not working on query mode
  • La6er

  14
  0
  Votes
  14
  Posts
  161
  Views

  

  @derelict Haha I didn't actually mean to reply to you, but to him. No idea how that happened.
• S

  DNS Resolver, PPPoE, OpenVPN client (AirVPN) and outbound interface
  • Steven SL

  1
  0
  Votes
  1
  Posts
  69
  Views

  No one has replied

• D

  pfSense 2.4.4 - Status - DHCP Leases - New Feature Request - Online Column contents colored ?
  • DeeJayOne

  4
  0
  Votes
  4
  Posts
  83
  Views

  

  ^ agreed, The online/offline status can be confusing to new users for sure.. It is not very helpful to be honest ;) The online/offline status would really only be valid if pfsense was actively arping for devices every X amount of time.. And even then the status would only show that something replied to arp for that IP Time-X ago.. All it currently really tells you is that that IP is currently listed in the arp cache - and pfsense arp cache is actually fairly long..
• J

  DHCP failing when moving between AP's
  dhcp unifi access point • • jafr

  13
  0
  Votes
  13
  Posts
  103
  Views

  

  @jafr said in DHCP failing when moving between AP's: HP 2530 Quick look shows that that switch can do dhcp snooping since I see in the manual dhcp snooping events for snmp.. So you need to look at the configuration of that switch or the port your AP is connected to. If pfsense does not see the discover for dhcp then no it would never offer an IP..
• N

  Wan DHCP Won't Update to new Dynamic IP Version 2.4.4
  • NetworkAdmin

  3
  0
  Votes
  3
  Posts
  81
  Views

  N

  @zprime It seems very similar for sure and seeing you posted this 5 days ago and no replies doesn't make me feel very good. I wish I knew what was going on. I can hold my own but this problem is way out of my league, hints me asking for help.
• A

  DNS across VLANS
  • angdigi

  15
  0
  Votes
  15
  Posts
  130
  Views

  

  you can query them by just host name if you add more search suffix, you can have more than 1 and put them in order.. Your box will just do multiple queries with each suffix.
• R

  [SOLVED] LAN clients lost outside connection after upgrade to 2.4.4 [2.4.5-DEV]
  • rosch

  16
  0
  Votes
  16
  Posts
  128
  Views

  P

  @rosch Okay, would have thought that would be there even if traffic was blocked. Perhaps is has some dynamic gateway monitoring or something that told it not to define that route when it wasn't available. The dhcp packet from pfSense side wouldn't be any different though afaik. But well its fixed :) i guess no further investigation is needed just to satisfy my curiosity . Thanks for reporting back
• D

  DHCP Static Mapping Range (v2.4.4-release) [solved]
  • DeeJayOne

  6
  0
  Votes
  6
  Posts
  84
  Views

  D

  @viragomann I have some "holes" between all my devices IP List. I reserve IP by kind devices and keep free IP for future devices, I don't want shift all my IP address because there is no IP available in the range I want to use. So Maybe I will have to reduce my "holes" range to save extra space for the DHCP pool. This is an other approch, it is quite different. Maybe I don't like to change my way to do it ! Thanks for your reply
• C

  setup multiple subnets with DHCP question
  • comet424

  19
  0
  Votes
  19
  Posts
  186
  Views

  

  @comet424 said in setup multiple subnets with DHCP question: house 1 200 feet away Is that 100 to 200 feet away or 1200 feet away? 200 is not going to cut it... Lets look at this one for example https://www.canadacomputers.com/product_info.php?cPath=27_1045_349&item_id=071622 Camera's look like 9w max each, that above switch says can do 75 total... So your right at the very limit.. And its 50% over your budget.. And its only 10 port with 8 of them being poe.. So doesn't leave you ports for much else.. The next size at 28 ports is close close to $500.. So your talking 8 x 250ish or 2 Grand in Camera's but your at 200 for your switch to run your whole network??? Makes NO Sense!! You can save some money if you use power ejectors with your camera's vs using a POE switch.. Many come with them, some you have to order separate. This allows you to inject power into onto the ethernet without having a poe switch. This is fine when you have a couple of poe devices. But if your wanting to run 6 or 8 camera's then yeah your prob going to want a switch.. You could get say that low end one - but not a lot of wiggle room for total poe power available. And then you would want another smart switch for your non poe devices. Which prob put you close to the cost of the bigger poe switch anyway.
• R

  DHCP wont Start Version 2.3.4
  • rommelzkie

  8
  0
  Votes
  8
  Posts
  122
  Views

  G

  @rommelzkie said in DHCP wont Start Version 2.3.4: The problem happened when we had power iinterruption last night. If forces our pfsense box to shut down forcefully. That likely corrupted the disk, take a backup of your config and do a fresh install. Preferably with a currently supported pfSense version, the 2.3 line is EOL and 2.3.4 isn't even the most current in the 2.3 line. Also get an UPS to protect against power interruptions.
• B

  Missing DHCP tab for additional interfaces
  • bstaa

  1
  0
  Votes
  1
  Posts
  40
  Views

  No one has replied

• X

  DHCPv6 Server - DDNS
  • xero9

  1
  0
  Votes
  1
  Posts
  43
  Views

  No one has replied

• X

  Multiple different DNS servers
  • xman111

  3
  0
  Votes
  3
  Posts
  70
  Views

  X

  thanks John. so under my computer that is 192.168.10.11 i can point to getflix DNS. That same computer on the VPN network is 192.168.40.11, i can put the AIRVPN server there? Will that prevent AIRVPN leaking my DNS? is the DNS settings under general left blank?
• R

  dns resolver not resolving dns names
  • robina80

  11
  0
  Votes
  11
  Posts
  255
  Views

  R

  pfSense DNS Resolver Similarly, if you are using pfSense’s internal DNS resolver service, you’ll want to adjust that configuration. In the pfSense web UI, go to Services > DNS Resolver, click Display Custom Options, and enter the following the the text box: server: private-domain: "plex.direct" but it wasnt just this that pfsense crashed on it crashed while i was installing openvpn client exporter so i really dont know why it kept on crashing in the end i installed OPNsense and added the custom dns config and also set up openvpn server and it all works perfect now for the time being im going to use OPNsense but it is far less superior than pfsense
• M

  2.4.4 generated config file cannot be parsed by unbound.
  • MagicCamera

  13
  0
  Votes
  13
  Posts
  167
  Views

  M

  @jimp Got the image file flashed a usb stick clean reinstall succeeded. Restored my config and rebooted everything back to normal. :D Thanks again jimp.
• R

  DNS resolver not resolving most host names [FROM NEW DEFAULT INSTALL]
  dns resolver • • Rastikan

  8
  0
  Votes
  8
  Posts
  124
  Views

  

  Yes I understand that The high latency connection will run in to time outs noting you can do to change that. Cashing with unbound may alleviate some of the problems, but there are so many setting he can do that will help with a high latency. Also setting up squid would help as well. Also you may confuse him by saying forwarding mode as there are to options he can use Unbound/Resolver and Forwarder.
• F

  DNS Resolver return a wrong answer
  • fabiensch2

  2
  0
  Votes
  2
  Posts
  67
  Views

  F

  I just updated my pfSense in 2.4.4 and it's ok
• U

  DNS OVER TLS GETDNS and STUBBY Amended Package Creation
  • ubernupe

  1
  0
  Votes
  1
  Posts
  84
  Views

  No one has replied