DHCP and DNS

• 

  HEADS UP: Be aware of Trusted Recursive Resolver (TRR) in Firefox
  • jimp

  12
  8
  Votes
  12
  Posts
  707
  Views

  

  Thanks for the info - lets hope they don't try and enable this on the sly in the background ;) Doing such a thing for sure would force me to rethink my browser choice..
• 

  RFC2136 Server Setup How-to
  • jimp

  19
  0
  Votes
  19
  Posts
  20536
  Views

  

  You have some logs as showed above ?
• T

  Wildcard DNS entries
  • tommyboy180

  6
  0
  Votes
  6
  Posts
  17130
  Views

  C

  @Yowsers: This is in the wiki as well. https://doc.pfsense.org/index.php/Wildcard_Records_in_DNS_Forwarder/Resolver Yes - and that page also misses a big gotcha. As someone coming from dnsmasq / "forwarder"  I had multiple host overrides too. Unbound / resolver refuses to start if you set up a wildcard subdomain AND have host overrides that match.  So you need to delete all the host overrides that use the same subdomain. If you want to override a host in your domain override with unbound, best to do it on the resolver at which you are pointing.
• S

  100 DNS errors on ipleak.net when upgrading to 2.4.4
  • smegheed

  4
  0
  Votes
  4
  Posts
  41
  Views

  V

  Yeah, I'm getting the same result... also, where the GRC DNS spoofability test used to run (and used to do very well with my DNS settings in Unbound!), it's also returning 0 DNS servers found now. Which is CLEARLY not right, since I certainly browse the internet using domain names and not IP addresses. Maybe something in the browsers has changed instead of something in pfSense... but something definitely doesn't let these tests work like they should. Edit to add: Not likely the browsers... tried multiple browsers and all failed the same way for both tests.
• S

  Normal tracerotue for mail.google.com to china?
  • SmokinMoJoe

  5
  0
  Votes
  5
  Posts
  79
  Views

  S

  I had similar/identical traceroute from a Mac OS X client and on the pfSense box itself using 127.0.0.1(unbound). Seems like it would be interesting to have unbound log when DNSSEC could not be used becuase the root keys are invalid, either the time on pfSense is wrong or the ISP is doing layer 7 manipulation. i.e. like what happens when you live in China, Russia or the USA...
• Y

  PXE boot for UEFI Systems
  • yis

  2
  0
  Votes
  2
  Posts
  43
  Views

  G

  @yis Test with tftp client and see if you can get efi file. I just put them in my tftpboot folder and do not specify a Root Folder.
• L

  How to add an arp table containing a hundred entries without restarting the pfsense router?
  • linkdragon70

  3
  0
  Votes
  3
  Posts
  60
  Views

  L

  Hello, I want to add a hundred or more static mapping to my dhcp server. But as explained, I know how to add / edit in the .xml file, but the changes I make require a restart of the router to take effect. My question is if there is a way to make additions / changes without restart? Regards, Gabriel
• H

  Is TLS resumption possible for DNS over TLS
  • HakanTT

  2
  0
  Votes
  2
  Posts
  11
  Views

  

  Not yet possible in Unbound. There is an open feature request for that in Unbound itself. https://www.nlnetlabs.nl/bugs-script/show_bug.cgi?id=4089 See also: https://nlnetlabs.nl/pipermail/unbound-users/2018-July/010743.html
• R

  DNS Query time always 0 msec
  • Raffi_

  9
  0
  Votes
  9
  Posts
  146
  Views

  

  Thanks for the update. Good to see the Universal Windows Fix also applies to other stuff, too
• T

  Does Unbound Honor Gateway Monitoring?
  • TheNarc

  1
  0
  Votes
  1
  Posts
  11
  Views

  No one has replied

• L

  Ruting DNS Server
  • l.lucii

  1
  0
  Votes
  1
  Posts
  16
  Views

  No one has replied

• L

  DNS resolver - Domain Override with MS AD
  • lolman88

  1
  0
  Votes
  1
  Posts
  13
  Views

  No one has replied

• N

  (RESOLVED) Static WAN Issue, DNS Issue, Connectivity Issue among Subnets
  • NetworkAdmin

  12
  0
  Votes
  12
  Posts
  166
  Views

  

  You think connecting interface 1 to interface 2 on the same em host is a valid config? It is FUBAR and Borked plain and simple.. but overall I'd say that 70% of post I read on this forum are techs insulting the crap out of people asking for help.. Utter Nonsense... You joined 26 days ago.. If you find posts offensive Report them!!! I have been here 10+ years.. What you find is the same question over and over and over again from people to lazy to do any research on their own. Getting fed the info on silver spoons. What you READ into something is not my problem - if you take offense to stating something is F'd UP when it it... That is not someone offending you that is someone stating their freaking opinion on a public forum just like you have the right to do... I take offense at your post to be honest ;) Here you go complaining about someone saying what you did was BORKED... Vs providing some info to work with.. While I am not a hyper-v guru... I am sure there are others here.. I don't need to be a guru to understand you don't interconnect interfaces on the same vm host together.. Then we have one nic port bridged with the lan that goes to out printer and smart tv. Your nic is bridged where in hyper-v or pfsense? Why are you bridging interfaces in pfsense? If that is the case.. Do not use your host interfaces as switch ports... If you need switch ports - get a switch.. Is that what your doing? A network drawing would be very helpful.. Some logs? Changing your wan from dhcp to static would have zero to do with your other config.. So clearly something else going on that has nothing to do with that.. But without actual info of what you did impossible to guess - to start with what 2 networks did you connect together with your nics? Remove that - what doesn't work?
• F

  VLAN DHCP Issue
  • forbidden_magic

  7
  0
  Votes
  7
  Posts
  74
  Views

  

  @johnpoz said in VLAN DHCP Issue: Yeah we have been over than and over that.. They might not strip the tags - but they don't isolate either... So broadcast traffic is going to go everywhere no matter what vlan tag you put on it.. How much broadcast traffic will there be on a small network, that it causes a problem? For example here, my only need for a VLAN is to support guest WiFi (which I wasn't able to do thanks to TP-Link and their access point which doesn't properly support VLANs). Will there be much more traffic if I didn't have a VLAN and all WiFi used the same SSID? Also, with IPv6, which I run on my network, there's no such thing as broadcasts, so that issue is going away. On the other hand, claiming a managed switch is needed just to pass VLANs is just plain wrong. I am not against a managed switch and encourage use of them, but I don't like people spreading false info. Before claiming an unmanaged switch can't be used, you really should understand the context. There really are some where a managed switch won't make much of a difference. As for isolation, how many people, other than guys like us, are even capable of configuring an interface to access VLANs? That is assuming the computer is even capable of it. My ThinkPad isn't. Will someone using the guest WiFi be able to snoop on local traffic? There are certainly reasons for managed switches, but there are also many situations where they don't buy much.
• Z

  Dynamic DNS - failing to lookup WAN IP in 2.4.4
  dyndns ddns • • ZPrime

  11
  1
  Votes
  11
  Posts
  354
  Views

  Z

  @jimp On my installation, the default route is set to the cable modem static gateway, so no gateway group issue in play for me. "Link#6" is igb5 which is my OPT4 interface going to the DSL modem. The modem has an IP of 192.168.254.254/24 (it's from Windstream), the pfSense box has .1, which we set statically. "Link #2" is igb1 which is the static IP (/30) from Spectrum / Time Warner Business. netstat -nr Routing tables Internet: Destination Gateway Flags Netif Expire default 70.60.x.y UGS igb1 1.0.0.1 192.168.254.254 UGHS igb5 1.1.1.1 70.60.x.y UGHS igb1 4.2.2.4 192.168.254.254 UGHS igb5 4.2.2.5 70.60.x.y UGHS igb1 8.8.4.4 192.168.254.254 UGHS igb5 8.8.8.8 70.60.x.y UGHS igb1 9.9.9.9 70.60.x.y UGHS igb1 10.17.0.0/24 link#1 U igb0 10.17.0.1 link#1 UHS lo0 10.254.254.0/24 10.254.254.2 UGS ovpns1 10.254.254.1 link#11 UHS lo0 10.254.254.2 link#11 UH ovpns1 70.60.x.w/30 link#2 U igb1 70.60.x.z link#2 UHS lo0 127.0.0.1 link#8 UH lo0 149.112.112.112 192.168.254.254 UGHS igb5 192.168.254.0/24 link#6 U igb5 192.168.254.1 link#6 UHS lo0 ping -c 4 192.168.254.254 PING 192.168.254.254 (192.168.254.254): 56 data bytes 64 bytes from 192.168.254.254: icmp_seq=0 ttl=64 time=1.170 ms 64 bytes from 192.168.254.254: icmp_seq=1 ttl=64 time=1.071 ms 64 bytes from 192.168.254.254: icmp_seq=2 ttl=64 time=1.084 ms 64 bytes from 192.168.254.254: icmp_seq=3 ttl=64 time=1.083 ms --- 192.168.254.254 ping statistics --- 4 packets transmitted, 4 packets received, 0.0% packet loss round-trip min/avg/max/stddev = 1.071/1.102/1.170/0.040 ms arp -i igb5 -a ? (192.168.254.254) at 4c:17:eb:21:26:09 on igb5 expires in 1178 seconds [ethernet] ? (192.168.254.1) at 00:08:a2:09:5a:15 on igb5 permanent [ethernet] traceroute -I -i igb5 checkip.dyndns.com traceroute: Warning: checkip.dyndns.com has multiple addresses; using 216.146.43.71 traceroute to checkip.dyndns.com (216.146.43.71), 64 hops max, 48 byte packets 1 * * * 2 * * * 3 * * * 4 * * * ^C ping -c 4 -S 192.168.254.1 checkip.dyndns.com PING checkip.dyndns.com (216.146.43.71) from 192.168.254.1: 56 data bytes --- checkip.dyndns.com ping statistics --- 4 packets transmitted, 0 packets received, 100.0% packet loss [This seems like it might be some of the problem...] It seems like I can't get a traceroute (ICMP) through the crappy DSL modem. However, apinger is not complaining about the connection being down, and it is set to ping 4.2.2.4 from that interface (instead of using the gateway IP). So maybe there's an apinger bug in play here and my connection is actually down but not correctly showing it? It would be immensely more helpful if BSD ping could be forced to send from a specific interface... I'm wondering if ping -S <int_ip> is trying to send the traffic out the wrong interface somehow and is maybe a red herring? So let's play some more - adding a static route to 216.146.43.71 (which is one of the IPs for checkip.dyndns.com) to force it through the DSL gateway: route add -host 216.146.43.71 192.168.254.254 add host 216.146.43.71: gateway 192.168.254.254 ping 216.146.43.71 PING 216.146.43.71 (216.146.43.71): 56 data bytes 64 bytes from 216.146.43.71: icmp_seq=0 ttl=49 time=149.241 ms 64 bytes from 216.146.43.71: icmp_seq=1 ttl=49 time=150.749 ms 64 bytes from 216.146.43.71: icmp_seq=2 ttl=49 time=151.432 ms ^C --- 216.146.43.71 ping statistics --- 3 packets transmitted, 3 packets received, 0.0% packet loss traceroute -I 216.146.43.71 traceroute to 216.146.43.71 (216.146.43.71), 64 hops max, 48 byte packets 1 192.168.254.254 (192.168.254.254) 1.165 ms 0.912 ms 0.930 ms 2 h3.176.142.40.ip.windstream.net (40.142.176.3) 20.753 ms 20.375 ms 19.908 ms 3 ae2-0.agr03.hdsn01-oh.us.windstream.net (40.136.113.108) 21.559 ms 22.031 ms 21.936 ms 4 et9-0-0-0.cr01.cley01-oh.us.windstream.net (40.136.97.135) 24.981 ms 20.902 ms 24.131 ms 5 et11-0-0-0.cr01.chcg01-il.us.windstream.net (40.128.248.71) 27.746 ms 30.224 ms 30.609 ms 6 chi-b21-link.telia.net (80.239.194.41) 30.788 ms 32.021 ms 28.424 ms 7 nyk-bb3-link.telia.net (80.91.246.163) 147.362 ms 149.769 ms 147.627 ms 8 ldn-bb3-link.telia.net (62.115.135.95) 144.829 ms 144.190 ms 144.030 ms 9 hbg-bb1-link.telia.net (80.91.249.11) 140.047 ms 132.839 ms 130.322 ms 10 war-b1-link.telia.net (62.115.135.187) 145.479 ms 146.117 ms 145.660 ms 11 dnsnet-ic-320436-war-b1.c.telia.net (213.248.68.135) 151.281 ms 147.401 ms 151.799 ms 12 checkip.dyndns.com (216.146.43.71) 150.409 ms 152.881 ms 151.245 ms curl -v --interface igb5 http://216.146.43.71 * Rebuilt URL to: http://216.146.43.71/ * Trying 216.146.43.71... * TCP_NODELAY set * Local Interface igb5 is ip 192.168.254.1 using address family 2 * Local port: 0 * Connected to 216.146.43.71 (216.146.43.71) port 80 (#0) > GET / HTTP/1.1 > Host: 216.146.43.71 > User-Agent: curl/7.61.1 > Accept: */* > < HTTP/1.1 200 OK < Content-Type: text/html < Server: DynDNS-CheckIP/1.0.1 < Connection: close < Cache-Control: no-cache < Pragma: no-cache < Content-Length: 104 < <html><head><title>Current IP Check</title></head><body>Current IP Address: 75.90.aaa.bbb</body></html> * Closing connection 0 [!! WORKS !!] Something really weird is going on here. For whatever reason the traffic is not correctly egressing through the specified interface when using curl --interface, and it's only going the way we want if I manually add a static route. I'm not exactly sure how the PHP code is hitting checkip.dyndns.com directly via a given interface, but something has changed behavior-wise that is making this fail. (Guessing maybe it's an underlying OS thing at this point, but I suppose it could also be something with curl if that is just being called via PHP?)
• T

  Does pfSense answer to DHCP Helpers/Relay yet?
  • tomstephens89

  5
  0
  Votes
  5
  Posts
  104
  Views

  T

  @derelict Damn, ok thanks.
• S

  Static WAN to Bridged Router
  • sikita

  7
  0
  Votes
  7
  Posts
  106
  Views

  S

  Ok, all clear, thank you!
• D

  Cannot access Unbound Remote Control
  • douglasg14b

  2
  0
  Votes
  2
  Posts
  55
  Views

  

  You need to pass it the full path to the config file. $ unbound-control -c /var/unbound/unbound.conf stats_noreset
• E

  pfSense DNS cache refresh interval
  • Exocomp

  19
  0
  Votes
  19
  Posts
  196
  Views

  

  Any time - I could discuss DNS for hours and hours ;) So if you ever have any questions about DNS just post a thread I will more then likely see it and comment.. The problem of when a firewall updates its aliases is problem with pretty much every firewall have worked with in the last 30 years when client might use or get something different. When there is more than 1 IP for some fqdn.. Be it based upon geo location of the query or some sort of roundrobin, or from a cache that resolves from a different location then the firewall/user, etc. It's not just pfsense that such issues can be seen that is for sure.. Blocking of url based stuff is normally done better with a proxy where the proxy so you can base the filter on the actual uri being requested vs the IP of said fqdn in the url.. Proxy also allows for filtering on path or other words in the url and not just the hostname portion, etc. DNS based lookups and blocking of the IP work fine when its static sort of IPs returned, but when your wanting to talk to something hosted on a CDN that returns lots of different IPs for the same fqdn then yeah you can run into complications.
• T

  Custom resolv.conf Options
  • TheNarc

  5
  0
  Votes
  5
  Posts
  83
  Views

  T

  Ah okay, that would explain it, thanks!
• L

  DNS forwarder not working on query mode
  • La6er

  14
  0
  Votes
  14
  Posts
  153
  Views

  

  @derelict Haha I didn't actually mean to reply to you, but to him. No idea how that happened.
• S

  DNS Resolver, PPPoE, OpenVPN client (AirVPN) and outbound interface
  • Steven SL

  1
  0
  Votes
  1
  Posts
  65
  Views

  No one has replied

• D

  pfSense 2.4.4 - Status - DHCP Leases - New Feature Request - Online Column contents colored ?
  • DeeJayOne

  4
  0
  Votes
  4
  Posts
  79
  Views

  

  ^ agreed, The online/offline status can be confusing to new users for sure.. It is not very helpful to be honest ;) The online/offline status would really only be valid if pfsense was actively arping for devices every X amount of time.. And even then the status would only show that something replied to arp for that IP Time-X ago.. All it currently really tells you is that that IP is currently listed in the arp cache - and pfsense arp cache is actually fairly long..
• J

  DHCP failing when moving between AP's
  dhcp unifi access point • • jafr

  13
  0
  Votes
  13
  Posts
  92
  Views

  

  @jafr said in DHCP failing when moving between AP's: HP 2530 Quick look shows that that switch can do dhcp snooping since I see in the manual dhcp snooping events for snmp.. So you need to look at the configuration of that switch or the port your AP is connected to. If pfsense does not see the discover for dhcp then no it would never offer an IP..
• N

  Wan DHCP Won't Update to new Dynamic IP Version 2.4.4
  • NetworkAdmin

  3
  0
  Votes
  3
  Posts
  74
  Views

  N

  @zprime It seems very similar for sure and seeing you posted this 5 days ago and no replies doesn't make me feel very good. I wish I knew what was going on. I can hold my own but this problem is way out of my league, hints me asking for help.
• A

  DNS across VLANS
  • angdigi

  15
  0
  Votes
  15
  Posts
  121
  Views

  

  you can query them by just host name if you add more search suffix, you can have more than 1 and put them in order.. Your box will just do multiple queries with each suffix.
• R

  [SOLVED] LAN clients lost outside connection after upgrade to 2.4.4 [2.4.5-DEV]
  • rosch

  16
  0
  Votes
  16
  Posts
  119
  Views

  P

  @rosch Okay, would have thought that would be there even if traffic was blocked. Perhaps is has some dynamic gateway monitoring or something that told it not to define that route when it wasn't available. The dhcp packet from pfSense side wouldn't be any different though afaik. But well its fixed :) i guess no further investigation is needed just to satisfy my curiosity . Thanks for reporting back
• D

  DHCP Static Mapping Range (v2.4.4-release) [solved]
  • DeeJayOne

  6
  0
  Votes
  6
  Posts
  70
  Views

  D

  @viragomann I have some "holes" between all my devices IP List. I reserve IP by kind devices and keep free IP for future devices, I don't want shift all my IP address because there is no IP available in the range I want to use. So Maybe I will have to reduce my "holes" range to save extra space for the DHCP pool. This is an other approch, it is quite different. Maybe I don't like to change my way to do it ! Thanks for your reply
• C

  setup multiple subnets with DHCP question
  • comet424

  19
  0
  Votes
  19
  Posts
  164
  Views

  

  @comet424 said in setup multiple subnets with DHCP question: house 1 200 feet away Is that 100 to 200 feet away or 1200 feet away? 200 is not going to cut it... Lets look at this one for example https://www.canadacomputers.com/product_info.php?cPath=27_1045_349&item_id=071622 Camera's look like 9w max each, that above switch says can do 75 total... So your right at the very limit.. And its 50% over your budget.. And its only 10 port with 8 of them being poe.. So doesn't leave you ports for much else.. The next size at 28 ports is close close to $500.. So your talking 8 x 250ish or 2 Grand in Camera's but your at 200 for your switch to run your whole network??? Makes NO Sense!! You can save some money if you use power ejectors with your camera's vs using a POE switch.. Many come with them, some you have to order separate. This allows you to inject power into onto the ethernet without having a poe switch. This is fine when you have a couple of poe devices. But if your wanting to run 6 or 8 camera's then yeah your prob going to want a switch.. You could get say that low end one - but not a lot of wiggle room for total poe power available. And then you would want another smart switch for your non poe devices. Which prob put you close to the cost of the bigger poe switch anyway.
• R

  DHCP wont Start Version 2.3.4
  • rommelzkie

  8
  0
  Votes
  8
  Posts
  104
  Views

  G

  @rommelzkie said in DHCP wont Start Version 2.3.4: The problem happened when we had power iinterruption last night. If forces our pfsense box to shut down forcefully. That likely corrupted the disk, take a backup of your config and do a fresh install. Preferably with a currently supported pfSense version, the 2.3 line is EOL and 2.3.4 isn't even the most current in the 2.3 line. Also get an UPS to protect against power interruptions.
• B

  Missing DHCP tab for additional interfaces
  • bstaa

  1
  0
  Votes
  1
  Posts
  36
  Views

  No one has replied

• X

  DHCPv6 Server - DDNS
  • xero9

  1
  0
  Votes
  1
  Posts
  37
  Views

  No one has replied

• X

  Multiple different DNS servers
  • xman111

  3
  0
  Votes
  3
  Posts
  64
  Views

  X

  thanks John. so under my computer that is 192.168.10.11 i can point to getflix DNS. That same computer on the VPN network is 192.168.40.11, i can put the AIRVPN server there? Will that prevent AIRVPN leaking my DNS? is the DNS settings under general left blank?
• R

  dns resolver not resolving dns names
  • robina80

  11
  0
  Votes
  11
  Posts
  239
  Views

  R

  pfSense DNS Resolver Similarly, if you are using pfSense’s internal DNS resolver service, you’ll want to adjust that configuration. In the pfSense web UI, go to Services > DNS Resolver, click Display Custom Options, and enter the following the the text box: server: private-domain: "plex.direct" but it wasnt just this that pfsense crashed on it crashed while i was installing openvpn client exporter so i really dont know why it kept on crashing in the end i installed OPNsense and added the custom dns config and also set up openvpn server and it all works perfect now for the time being im going to use OPNsense but it is far less superior than pfsense
• M

  2.4.4 generated config file cannot be parsed by unbound.
  • MagicCamera

  13
  0
  Votes
  13
  Posts
  149
  Views

  M

  @jimp Got the image file flashed a usb stick clean reinstall succeeded. Restored my config and rebooted everything back to normal. :D Thanks again jimp.
• R

  DNS resolver not resolving most host names [FROM NEW DEFAULT INSTALL]
  dns resolver • • Rastikan

  8
  0
  Votes
  8
  Posts
  113
  Views

  

  Yes I understand that The high latency connection will run in to time outs noting you can do to change that. Cashing with unbound may alleviate some of the problems, but there are so many setting he can do that will help with a high latency. Also setting up squid would help as well. Also you may confuse him by saying forwarding mode as there are to options he can use Unbound/Resolver and Forwarder.
• F

  DNS Resolver return a wrong answer
  • fabiensch2

  2
  0
  Votes
  2
  Posts
  62
  Views

  F

  I just updated my pfSense in 2.4.4 and it's ok
• U

  DNS OVER TLS GETDNS and STUBBY Amended Package Creation
  • ubernupe

  1
  0
  Votes
  1
  Posts
  75
  Views

  No one has replied

• R

  DNS over TLS resolution with Multi WAN
  • renegade

  1
  0
  Votes
  1
  Posts
  50
  Views

  No one has replied

• C

  pfSence box loosing DHCP connection on WAN.
  • cniles

  1
  0
  Votes
  1
  Posts
  49
  Views

  No one has replied