Hey ghostshell, Thank's for your answer ! In my setup the DHCP server is Win AD! Am I correct to understand that I would need to enable dhcp on pfsense. What do you mean by Without the internal DNS PFSense… I'm confused here… Do you mean some other DNS server than the one your ISPconfig setup is providing. Can you elaborate please? Regards Franck

http://www.nirsoft.net/utils/fastresolver.html I'm thinking this might do what I want.

Hmm, having manually updated by save+force update I am no longer seeing the problem. IPv4/v6 problem? https://doc.pfsense.org/index.php/Controlling_IPv6_or_IPv4_Preference Steve

Thanks for the information. It is for a home network. The reason I even brought this up was I have a home server and I check the logs to make sure everything is going well and since I have started using pfsense I now see every time the lease gets renewed and it just adds more to the log than I really care to see. If the server is on 24/7 does a 7200 minute lease still make sense? What is the benefit/disadvantage to changing the lease time?

BTW, the first 11 allow rules are pointless and not needed. You are allowing everything with the last rule anyway

Yup once that package is working you should be golden.. I tried installing it last night - and think it has some kinks to work out currently - but the gui interface to bind settings looks fantastic!!

You said that it was working till you changed the webserver?? If it is this, you should revise your Centos configs (using the centos foruns, for example). One workaround you could test is on DNS Forwader create a rule to resolve mtrosemedia.org to your internal webserver without https. Host: "empty" Domain: mtrosemedia.org IP address: "your internal IP address" This should resolve, if it is the pfsense problem. Regards.

Well your not going to be able to run dhcp snooping unless your switches support it.  And all the switches would need to be able to do it, not just a couple of them.  Or you still would have problems with people connected to the same switch that is down stream from your managed switch.. I can not believe a school network would run on such crap? I would think a school would run decent hardware?  How does tuition not cover a decent network - shit doesn't the school have a computer science program?  This would all be hand on stuff that should be talk in the classes..

Well that makes more sense and I agree with you.. So pfsense that might have both ipv4 and ipv6 -so for its dns you can setup dns servers that are both ipv4 and ipv6 and you don't dhcpd to crash because of that.. It should say hey only look at the ipv4 dns that is listed to hand out if not setting specific dns in the scope.

ok odd – if you release and renew get whats in the overall scope - even though I didn't even see that offered in the sniff..  But then when you do /renew you get what was in the offer packet? something in the client to me.. [image: renewgetscorrect.png] [image: renewgetscorrect.png_thumb]

If you want to allow only dns, then your rule would be as above with tcp/udp 53 as the dest port. But why not just allow dns queries to the lan2 interface IP?  This would be a more common setup - dnsmasq can run on whatever IPs you want it to listen on.. Not like you have to run another instance of it or anything - it will just listen on more than one interface is all for queries.

I would revbump if I knew how.  ::)

Your still confused!!!  I give up – think what you want..  But dhcp has nothing to do with layer 2 at all, nothing!!  Yes all traffic has a layer 2 part of it where macs are used.. And yes broadcasts go to the all FFs address.  That's common with every single protocol ;) From your statement pfsense wouldn't be able to firewall anything..

There is nothing in the GUI that lets you specify the max update interval - it is still set to 25 days in the code. Not sure how "add ability to configure update interval" got into the change log. There were enhancements to make sure that No-IP free accounts actually made an IP address change after 25 days (and changed it back) as No-IP actually requires a free account holder to change their IP at least "monthly". It would not be difficult to implement - just needs someone to do a bit of code.

Dude – why not actually provide information to fix your issue...  Its posts like this that people think there is something wrong with 2.1 -- when from the complete and utter lack of anything to actually work with it really points to layer 8 issue. " i don't know how i can know if a firewall rules block a clients access tu the IP/interface that dnsmasq is listening on" Then POST them and we will help you understand.

Yes your browsers cache – did you restart the browsers?