@vsatmydynipnet ok mr robot.. seems like a lot of trouble to keep your isp from knowing your going to amazon.com ;)

@4o4rh
https://docs.netgate.com/pfsense/en/latest/development/system-patches.html

Also of note, since the security notes are not yet in the 23.04 release notes:
https://forum.netgate.com/topic/187622/system-patches-package-v2-2-10_1

@Gertjan you are a devil 😀 that only exists with ISC DHCP and not Kea DHCP.
I have reverted back to ISC until the enhancements to Kea are done

@Gertjan

I have been trouble shooting since morning , then I finally did two things.
1- added domain in pfblocker-ng Host-Over ride with public IP of domain .
2- Changed my WAN ip address.

Restarted resolver service now guess what website is accessible and resolved :/ and then I change back to old WAN to test if it was blocked by datacenter but it was not blocked now domain is accessible on old wan IP too.

Thanks @Gertjan for your tips :).

Regards

@RickyBaker said in DNS_PROBE_FINISHED_NXDOMAIN sporadically for anywhere from 30secs to 10min. works flawlessly at all other times:

to be clear, you aren't necessarily recommending I update, right?

Boils down to the question : what do 'we' remember about 2.7.0 (years ago ?)
Maybe you and we are looking for an issue that was resolved long time, but we don't remember. The forum can tell you of course. For me, I'm just human, and I focus on the current version, and use the Form search button for the ancient issues.

Also, keep in mind : ok to use old version but when deciding to do so you become basically your own tech supporter because of what I've outlined above.

I get it, when we started to talk about 'kea' you didn't understand what we were talking about ... 😊

Btw : you should only install and update pfSense packages (always build against the latest pfSense version) with an up to date pfSense version.

Hi Everyone, It looks like I also have the same issue.

I have setup multiple VPN clients on my pfsense firewall. Using DNS Resolver as a resolver, and only selected the "VPN Interface" in the "Outgoing Network Interfaces". This setup has been working fine for years (Since I have set this up, for more than 6 years). The DNS issue started on 3rd March, 2024. I was scratching my head.
Got the DNS temporary fixed by selecting "WAS" in "Outgoing Network Interfaces".
Hopefully they fix this issue soon.

@VMlabman

Check here : Diagnostics > Configuration History
These are the moments your pfSense syncs the local config with "acb" (non abc ^^).

Now we know that acb.netgate.com has a TTL of

acb.netgate.com. 30 IN A 208.123.73.69

= 30 seconds ( dono why, but's that very short )

every time your pfSense uploads your config it has to resolve again "acb.netgate.com."
But hey, as long as the NS servers of netgate.com aren't down, this will work.
Because : Internet, see above, isn't down.
And I presume your connection isn't down.
And - important - unbound must be up and running all the time - not restarting very often - see Status >System Logs > System > DNS Resolver to check that.

I've added myself an extra gadget : Services > DNS Resolver > Advanced Settings :

4b893fff-a49d-4c9f-a6bd-dd1239148c7a-image.png

this will take care of having a cached, resolved result of expiring.
When it expires, after 30 seconds, imho, unbound will refresh it. This means I'm hamering the netgate.com NS servers with a DNS request. Not my fault, as they set the TTL so low.

I use pfBlockerng, so I have some; insight about what unbound is asked to do :

2b4651de-b62d-406d-a05b-e1084894185f-image.png

Also : Status > DNS Resolver and I tjhought I would find our acb.netgate.com here but noop.
But all the NS servers of every domain name I visited for the last past ..... days, are there.
This means that 100 % resolving, from the top root servers down to the domain name server is actually a rare event.
unbound will keep the IP of the TLD, for example : the DNS server that hosts all the dot com domains and it will also keep the IP of the domain name (== "NS") of every visited domain name.
( and even refresh the TLL when it times out - see setting above )
So, when it needs to know what the IP of acb.netgate.com is, it will ask it directly to one (there must be 2 at least) of these NS = domain Name Servers:

ns1.netgate.com. 1436 IN A 208.123.73.80 ns2.netgate.com. 8 IN A 208.123.73.90 ns3.netgate.com. 8 IN A 34.197.184.5 ns1.netgate.com. 1436 IN AAAA 2610:160:11:11::80 ns2.netgate.com. 8 IN AAAA 2610:160:11:11::90 ns3.netgate.com. 8 IN AAAA 2600:1f10:4c5e:6701:e4b2:c059:13c5:64fb

Lets check 'manually', and ask the first NS "208.123.73.80" if it knows the A of acb.netgate.com :

[24.03-RELEASE][root@pfSense.bhf.tld]/root: dig @208.123.73.80 acb.netgate.com A +short 208.123.73.69

Nice.

Another check :

dig @208.123.73.80 acb.netgate.com AAAA +short

No answer, so no IPv6 for acb.netgate.com (strange ...)

@cmcdonald that is sweet, and long time in the coming - thanks for the heads up!

For clarity since it wasn't spelled out explicitly above:

The ::1 entry for IPv6 is the same as 127.0.0.1 for IPv4. It's just the localhost loopback address but for IPv6 which allows the system to talk to itself over IPv6 locally as needed. It doesn't have any bearing on anything outside of the firewall itself.

@johnpoz

Yep -- definitely not a complaint. I enjoy learning it all. In all the examples I've seen, .local was used after the hostname. The use of mDNS was never mentioned so I assumed .local was part of the base DNS configuration.

I started reading up on mDNS a few weeks ago -- I guess I haven't made it that far yet.

@Gertjan Its traffic analyzer

@ericnix once you enable forwarding in the Resolver settings, see https://docs.netgate.com/pfsense/en/latest/recipes/dns-redirect.html

Switching back to the deprecated ISC solved my problem. Thank you @johnpoz

@johnpoz
Wow, you are awesome !!!
Huge thanks!
Worked!