as soon as you disable and enable your adapter you will see it

(ağ başdaştırıcını yenilediğin anda dhcp.leases dosyasına yerel zamanla düştüğünü göreceksin, ben denedim oldu)

@phreshjive:

Ended up disabling RDP after a few colleagues took a dump on me over using it.  Now using TeamViewer.  Thank you for help.

Whats wrong with RDP?

@oliwel:

Thanks for your answers, @bryan.paradis: As I am new to pfSense and did not use dnsmasq before, can you please point me to some docs or give an example how to enable logging?

@johnpoz: Exactly this happens, here are the results made on my Ubuntu Workstation within 2 second - I got two failures and a result on the third try.

oliwel@platin ~ $ dig www.bus-profi.de @10.16.6.1 ; <<>> DiG 9.9.2-P1 <<>> www.bus-profi.de @10.16.6.1 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 18937 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0 ;; QUESTION SECTION: ;www.bus-profi.de. IN A ;; Query time: 32 msec ;; SERVER: 10.16.6.1#53(10.16.6.1) ;; WHEN: Thu Feb 27 08:03:15 2014 ;; MSG SIZE  rcvd: 34 oliwel@platin ~ $ dig www.bus-profi.de @10.16.6.1 ; <<>> DiG 9.9.2-P1 <<>> www.bus-profi.de @10.16.6.1 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 23048 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0 ;; QUESTION SECTION: ;www.bus-profi.de. IN A ;; Query time: 31 msec ;; SERVER: 10.16.6.1#53(10.16.6.1) ;; WHEN: Thu Feb 27 08:08:12 2014 ;; MSG SIZE  rcvd: 34 oliwel@platin ~ $ dig www.bus-profi.de @10.16.6.1 ; <<>> DiG 9.9.2-P1 <<>> www.bus-profi.de @10.16.6.1 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 45941 ;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 512 ;; QUESTION SECTION: ;www.bus-profi.de. IN A ;; ANSWER SECTION: www.bus-profi.de. 6902 IN CNAME bus-profi.de. bus-profi.de. 6902 IN A 81.169.145.152 ;; Query time: 28 msec ;; SERVER: 10.16.6.1#53(10.16.6.1) ;; WHEN: Thu Feb 27 08:08:13 2014 ;; MSG SIZE  rcvd: 75

Upstream Servers on Pos 1 and 2 are those of my Upstream Provider and 3 and 4 are the google ones (8.8.8.8 and 8.8.4.4) using parallel query. I also dropped the provider servers and just used google but it didnt change anything. As said, the provider dns works flawlessly when used directly from the clients.

Oliver

Services -> DNS Forwarder -> Go down to Advanced and add log-queries -> Save

Status -> System Logs -> Resolver Log

@it_support:

where the dhcp lease file located? i mean status_dhcp_leases.php file

/usr/local/www/

if you need to find things on command line you can use find

find / -name filename

if you need wildcards use

find / -name \*filename\*

I will assume that most users are to be filtered, and the unfiltered ones are a smaller number. You could:
a) Setup the OpenDNS servers for pfSense generally as you have already, to send DNS to OpenDNS, and have block rules preventing users reaching other DNS servers.
b) Add static-mapped IP addresses in DHCP for the unfiltered users. Put them in a nice sub-range of your LAN (e.g. LAN 10.20.0.0/16 - and put all unfiltered in 10.20.254.0/16.
c) Make an Alias for that range of static-mapped LAN IPs (e.g. call it "UnfilteredLANips")
d) Make an Alias for the DNS servers you want to allow for unfiltered DNS (e.g. call it "UnfilteredDNSips")
e) On those static mapped entries, specify the unfiltered DNS servers (e.g. 8.8.8.8 and 8.8.4.4)
d) Add a firewall rule, pass protocol TCP+UDP, source UnfilteredLANips, destination UnfilteredDSNips, port 53 (DNS)

Of course, smart users who know and have admin access on their device can set their IP in the UnfilteredLANips range - but I think that applies to all the solutions. Even if you make a solution that is really MAC-address-based, people can spoof their MAC address.

The unfortunate part of this implementation is that you have to repeat pasting the same DNS server IPs into every static mapping entry.

Thanks for the heads up!  :-)

@bryan.paradis:

@ray167:

Ok so I finally got my devices to communicate with each other. I read some posts about bridging network cards together and that did it for me. This is what I did:

1. Created a bridge and bridged all my NICs to LAN
2. I went through all NICs and disabled the DHCP sever for them except for the LAN NIC
3. Set firewall rule to pass and source any and destination any

I have not tested all me equipment but I am pretty sure they all work and see each other on the network. I have also kept UPNP and NAT PMP enabled so this may also be needed to have all devices on the network see each.

Was going to say putting them on a bridge for the lan would be the idea unless you want something else specific. Glad you got it working. Unless I am extremely foggy today it shouldn't require anything other then just setting those extra nics into the lan bridge to get you going.

I did try to just bridge everything and setup rules but that didnt work for me. I read on another thread here that I should disable DHCP server on all NICs except for LAN and that did the trick.

Is there some other rogue device that comes on the network from time-to-time with address 192.168.1.1 - if that happens then sometimes some systems will find the MAC of that device when they use ARP to find 192.168.1.1
Do "arp -a" on a machine that is working and note the MAC address associated with 192.168.1.1 - should be the MAC address of pfSense LAN NIC.
Do the same thing when a machine is not working and see what MAC address it think is 192.168.1.1

Having pfSense LAN at 192.168.1.1 on a reasonable-sized network is a risk, because there are likely to be people setting up devices and quite often those devices default to 192.168.1.1 when first powered on.

No I did not make any special rules. I will check the settings when I get home tonight to see what I have enabled. Thanks for the lead.

Move the forwarder (dnsmasq) to port 5353 (or something else), then setup NAT rules to redirect your local interface queries to localhost:5353 and then your local clients can continue to perform recursive lookups via dnsmasq even with some other DNS server using port 53 for authoritative responses.

do I interpret these wrong?

Yep, that works. I removed all the DNS servers from System:General Setup, and had both these unchecked:
Allow DNS server list to be overridden by DHCP/PPP on WAN
Do not use the DNS Forwarder as a DNS server for the firewall

This makes /etc/resolv.conf contain just:

domain mydomain.xyz.org nameserver 127.0.0.1

Then in DNS Forwarder, Advanced:

server=216.146.35.35 server=216.146.36.36

And in DNS Forwarder Domain Overrides I have entries for the various local domains, and local private reverse lookup zones and the IP addresses of the internal DNS servers that know how to answer queries for those (e.g. mydomain.xyz.com 10.42.11.1)

Now when I "nslookup" from the pfSense command line, it can only ask DNS Forwarder. And DNS forwarder knows how to do "default" queries using the "server=216.146.35.35" line/s. And queries for local names and reverse lookups always get resolved correctly, or NXDOMAIN returned correctly if the local name does not exist.

The missing element of this configuration is that I can't specify the gateway to use for each upstream DNS server. DNS Forwarder will be using the default route for all of them. That could be fixed by doing this a slightly different way:
a) Add a checkbox somewhere (General Setup or DNS Forwarder config page?):
  "Use only the DNS Forwarder as a DNS server for the firewall"
b) When this is checked:
  1) Still define routes through the specified gateways for each DNS server IP in General Setup.
  2) Only put 127.0.0.1 in /etc/resolve.conf - so DNS lookups from apps on the firewall itself all go to the DNS Forwarder.
  3) Write a separate /etc/resolve-for-dns-forwarder.conf that contains the IPs of the DNS servers specified in General Setup (or given by DHCP).
  4) On dnsmasq command use "–resolv-file=/etc/resolve-for-dns-forwarder.conf"

This way DNS Forwarder will be told about the upstream DNS servers automatically, they are routed through the selected gateway/s, and pfSense apps will always use DNS Forwarder to do their DNS lookup work.

Does this sound like a reasonable enhancement to the system?

And to me it actually feels like the behavior that many people would want - that DNS done by apps on pfSense itself uses the same path for resolving names as any ordinary LAN client. Or is there some catch-22 that I have forgotten here?

My Zoom modem didn't have weekend support, so on Saturday I went and got a Motorola SB6141. Since the change I have not had any problems with a rouge dhcp server assigning addresses.

I don't know if the Zoom modem was my problem (the new ip addresses listed the Zoom as the server), but the upgrade to the Motorola cost $40. Maybe, you get what you pay for.

I rebooted and it was resolved.

I changed nothing.

Thanks Phil!!

Appreciate your input.

Have a great day!
Kell

@johnpoz:

Well seems to me they cleaned up a bug or lack of check - since it should not be possible to create dhcp reservations for the same IP address - that is not a valid configuration.  What if both of them ask for lease?  So you have duplicate IPs on the network?

Well, as for valid. This is supported by some DHCP daemons. I think one of semi-valid use cases would be

subnet 10.11.12.0 netmask 255.255.255.0 {                                                    host mylaptop-wifi {                                                                          hardware ethernet 11:22:33:44:55:66;                                                  fixed-address 10.11.12.100;                                                  }                                                                                    host mylaptop-wired {                                                                          hardware ethernet aa:bb:cc:dd:ee:ff;                                                  fixed-address 10.11.12.100;                                                  }  }

assuming I make sure to switch off the wifi before plugging in the wire.  ::)

@OP: Just do as suggested above, you simply are doing things in completely wrong place!  :P

Hi phil.davis,

thanks a lot for helping. My biggest problem was, that I have not found the custom-entry. Maybe the list can be sorted for the next release. My drop down only showed 5 entries…

Nevertheless, it's working except the result. The result is XML (see exmaple below) and I don't know how to match it, because the description says the entered result must match the returned one but the xml is too dynamic. Any ideas or do you maybe know any wildcards to match it?

<dnsapi_result><is_ok>OK:</is_ok>   <result_counts added="1" changed="0" unchanged="0" deleted="1"><actions><action action="SET" host="myhost.com" type="A" value="181.192.221.189"></action></actions></result_counts></dnsapi_result>

Thanks a lot for helping,

Thomas