@tinfoilmatt said in DNS Resolver Infrastructure Cache Stats:

In fact, if you were really paranoid, you could encapsulate DoT queries within the tunnel to keep them hidden from even your VPN provider

Please, if possible, show example?

@JKnott I hear yeah.. it should be really rare I would agree. The only time I have had to manually release and renew my wan lease was when the isp merged with another and they redid a lot of their IP scheme and moved IPs around, etc.

And that was years ago, had my current IP for easy before covid, etc.

One of my favorite pages on the Netgate Docs-
https://docs.netgate.com/pfsense/en/latest/recipes/index.html
Scroll down to DNS then click on redirecting client Dns.

@johnpoz said in Trailing dot on DHCP DNS entries from Windows clients:

So I had to switch back to ISC for the moment as I need this functionality.

Yeah unless your just handing IPs to clients and that is it, KEA not really ready for anything else that this point.. I validated that it works, ie it does hand out IPs to dhcp clients. But I use options and register reservations, etc. I will continue to use isc until such time that the kea integration is complete, or at least much farther along than it is now.

Oh wow so that is the cause? KEA not handing out the suffix set in the General menu (or overridden in the DHCP Server menu)? This has been driving me crazy because all of my internal server references were to "home.arpa" (e.g. "printer.home.arpa") with the "home.arpa" suffix appended by pfSense/ISC. And my self-signed certificates now blow chunks too because the DNS name registered for it is "printer.home.arpa" and the browser does not like it being referenced as just "printer".

Netgate, please fix this in KEA! Note that I did submit a Redmine bug against this issue.

@saqibs Yes, it needs two parameters instead of one. Hopefully someone can help us out.

@Modesty said in Bizarre IP in my LAN:

now they behave like kids ;-)

hahah - not sure how to take that, you mean they are working correctly or are they still acting up - hahah ;)

make that a not...

if i nslookup k8s-prd-1 i get nothing, it seem to go out to internet directly...

I've added the name to local dns resolver and the 3 applicable up addresses of my k8s master nodes that i want to resolved to.

G

@georgelza how I would do it is include some text file that contains your entries

Example

[24.03-RELEASE][admin@sg4860.home.arpa]/var/unbound: cat newhosts.conf local-data: "newhost.newdomain.tld. A 10.11.12.13" local-data: "otherhost.otherdomain.tld. A 10.11.12.14" [24.03-RELEASE][admin@sg4860.home.arpa]/var/unbound:

So you could script adding whatever records you want in there like the above.. you can create ptr records as well with local-data-ptr:

And then have your script restart unbound so those are loaded..

unbound.jpg

edit: btw, not really sure what might happen to that text file you create with your records on an update to pfsense or even the unbound package.. So you might want to keep a copy handy of what you put in there.

Another way would be directly editing the xml to put your hosts in there as overrides - but that seems more complex and possible corruption of your configuration of pfsenses overall xml.. The loading of text file seems way less intrusive and easier to accomplish with simple script and less risk of borking something up.

This issue should be handled with the 24.11-RC. Feedback on it would be helpful if you were hitting this previously.

Root problem was I was running the command as a user, not as root. Shouldn't do things early in the morning!

All cron'd up and working as expected now!

@Laxarus said in pfsense, windows server active directory, dhcp and dns:

did you ever try windows admin center?

No, I've just used the direct snapin plugin managment tool in Windows Server itself via RDP. I really don't do very much to my AD configuration these days. It just runs very well all by itself. I very rarely need to change anything, and thus it is not that big of a deal to use the MMC on the rare chance when I need to look at something or make a change.

@johnpoz
Na, I'm on 2.7.1 for now. I've looked over the release notes for 2.7.2 and didn't see any updates or changes to KEA so I haven't ugpraded to it yet. Probably will this weekend or next when things are quiet.

Maybe I'll hold off until 2.8 releases and check the notes to see if those KEA improvements fixes the DHCP registrations into DNS.