Domain overrides would be what you want there, you can send a particular domain to a specific DNS server(s).

So it look to me like you have a multiple wans both behind nats, and then pfsense nats again.  Why?  Do people setup crap like this??

So you have a ms server?  Is it running active directory, are you machines part of this active directory?

All members of AD should use their DNS of the AD for their dns - PERIOD, end of story if you are not setup this way then your going to have issues!!

Your AD server then points to whatever dns you want to use.. Be it pfsense dns forwarder or external dns.

Where do your clients point to for dns, where does ms2012 go for dns, it is setup to query roots or forwarder to pfsense - something else?

@jimp:

There was a discussion here on the forum about this already with a workaround. Search the forum a bit and you'll hit it.

Is the workaround you're referring to, the one I'm currently doing with the cron job, because I was really hoping this was going to be fixed in 2.1 but it's still not working for me either.

You can change the theme of pfsense web gui, so if that is what your asking - but all the items should be there.  You can not setup relay or enable it if you have dhcp server enabled on any interface.

To see that screen you would need to disable pfsense dhcp server.

You can change themes on the bottom of general setup, I like nervecenter - but I don't believe it is default theme?

I am using
2.1-RELEASE (i386)
built on Wed Sep 11 18:16:50 EDT 2013
FreeBSD 8.3-RELEASE-p11

dhcprelayoff.png_thumb
dhcprelayoff.png
dhcprelayenable.png
dhcprelayenable.png_thumb

It is a trend - lots of regions/countries are running short of IPv4 public address space from their allocations. Here in Nepal we had a WiMax provider recently who did not even use the Carrier-Grade-NAT reserved space. We got an address like 10.20.n.n !!! Bad luck if your company happened to have picked 10.20.0.0/16 for their internal private network. Now this WiMax provider has got some public IP address space and we have got our own public IP.
Same has happened on the 3G mobile phone system - they just don't have enough IPv4 public address to give out 1 to every phone that asks. So sometimes we get CGN addresses. If I want to use a router with 3G dongle and have an OpenVPN server on it to allow remote connections back to a small office/home office then sometimes it works (mobile phone carrier DHCP gives a real public IP and DynDNS name is set to that and all is good) and sometimes it does not (gets a CGNat IP, DynDNS name is set to the ISPs eventual front-facing public IP and of course that does not port forward back to me!)
If you want to provide remote access to stuff, then you have check with the ISP when you sign up that your plan comes with a real public IP.

Hey Phil, I've got that option disabled unfortunately (as I am on a static IP).

Edit: So I found a workaround. I read here that the effect of disabling the DNS forwarder will simply cause the servers specified under the General setups' DNS server list to be specified as DNS servers for the DHCP LAN clients. Perfect!

I guess the guest wireless AP is behind (is it itself) an internal router that is itself sitting on your LAN. If so, then just:

Add a pass rule on LAN for source IP the guest WiFi subnet Add a gateway in System->Routes with the IP address of the internal router on your LAN. Add a static route for guest WiFi subnet, to the gateway from (2)

Someone crossed the streams.

Glad it's fixed.

It's working with the wifi. Thanks for pointing me in the right direction.

Well for starters on your dhcp server - Here is the thing if your on AD, then your AD really should provide both dhcp and dns.. Just the best solution.

As to your configuration of multiwan - yeah prob something wrong with it.. Draw up your network and post your configurations and we can take a  look see.  But without some more details there isn't much anyone can do.

i create the same rule on lan_1 and its now working perfectly.thanks sogutlulu_54 for helping me out.

Nobody?  :(

@adolfo_rodrigues:

@phil.davis:

You need to enable nat reflection to do that.  Or better method is to have your local hosts directly resolve www.xxx.com to your private IP 192.168.1.2

This is the answer - do one of these. An easy way is to add a host override in DNS Forwarder to define xxx.com to be 192.168.1.2

It is like phill said, I had the same issue here, the workqround was enabling DNS Forwarder to resolve the host and domain to my internal IP from my internal machines.

On your case see attached.

Hope it helps. Regards.

It is working, thank you very much!

I have many vhost like test.xxx.com bla.test.com etc… Can I set up so every vhost work also?
I have tested it works to add manually each vhost, but is their a way I can take all at the same time?

thank you

i know its easy if you got pfsense but i havnt got pfsense yet installed and before i go ahead and buy a pc and install pfsense on it, i want to do my homework before

@clauded1:

I'm trying to setup pfsense 2.1 with tinydns to serve DNS for my local net and use forwarder for external addreses. However, I'm not able to get the setup working.

DNS forwarder works fine (except pfsense can't find it's firmware updates) but resolution to local.net don't work. Here's my setup :

pfsense config:

LAN : 192.168.1.1 WAN : DHCP DNS Servers : 8.8.8.8 and 4.4.4.4

I have the same setup and it took me a while to get it going the way I liked:

You need to:

Services -> DNS Forwarder - DO NOT USE (TinyDNS provides a resolver)

Firewall Rules for DNS - Disable - you dont need them

NAT Rules for DNS - Disable - you dont need them

Services -> DNS Server -> Settings:

Binding IP Address: 127.0.0.1 Enable recursive DNS responder - ENABLE Interface to listen - Select them (I use all) Respond to IP - I use "10", because my Internal network uses 10.x.x.x - adjust accordingly System -> General Setup -> DNS Servers Your LAN IP address (you dont need the external ones like 8.8.8.8, etc)

Now, I can resolve my own domain names, external addresses and more importantly, pfsense now displays "You are on the latest version." again :)