@johnpoz

OK, looks like I have it fixed.

I reread your post above and added domain specific override to the resolver and it now works.

What is interesting to note is that if I removed the Resolver's disable rebind custom command it still works.

@McMurphy

I found this, probably not what you are looking for. But if you are using CloudConnexa as your VPN provider, then I thing you need to change your NAT rule. Try to remove the destination address.
https://openvpn.net/cloud-docs/tutorials/configuration-tutorials/connectors/routers/tutorial--configure-a-pfsense-router-to-connect-to-cloudconnexa.html

@rjcab does the dig +trace work now?

As soon as you post you work it out - turns out you need the record to exist first, before pfSense can then update it. Shouldn't need to be that way but it's working now.

@Unscathed7897 if you have been using example.com a long time internally.. From a users point of view, might be better to get a new domain example.net for external use - for your vpn connections or any other stuff you might host externally or need to resolve public for.. This might be less of a learning curve for users, and for sure less to change on your network if you have been using example.com for any length of time ;)

@johnpoz Thanks for your help that worked!

@DaveP-0 said in DNS suddenly broken [on some VLANs]:

To clarify, when you connect to the VPN server, our DNS are automatically assigned.

Nope that is not what they are doing - they are intercepting.. And the big brains running that outfit didn't think it through that interception is easy to spot and will break shit like dnssec, which is one of the things dnssec is suppose to do, validate your talking to the actual authoritative ns.. Which when your intercepting clearly your not..

Using their "app" ok assign your dns away.. But if I am routing traffic through your vpn - you shouldn't freaking touch it..

Why anyone sends their traffic through these money grabbing scare mongers is beyond me.. The whole VPN service scam that blew up over night is just horse shit all the way down.. They don't give too shits about your privacy or your security.. All they are after is a drop dead simple way to get people to send them money for doing nothing..

The only value they provide is the ability to circumvent geo IP restrictions.. And most of the services are starting to block the big boys.. So that money tree is going away..

@Gertjan @johnpoz

Here is my working config using the Forwarder. Please let me know if a better outcome can be achieved using the Resolver.

27.03.2024_07.32.00_REC.png

27.03.2024_08.21.59_REC.png

Unless a better outcome can be suggested my original setup is optimal.

@Antibiotic Looks like Domain Overrides option in DNS resolver did this trick))))

Hello, anyone?

@hspindel I reviewed my configuration, and discovered that I actually do have DNS forwarding enabled but not in the way I was looking.

DNS forwarding service is NOT enabled.

But DNS Resolver service is enabled, and the checkbox for "Enable Forwarding Mode" is checked. Description says if this is checked, then DNS queries are forwarded to the servers set in System/General Setup.

So that explains why my current setup is working.

I still do not have a solution that chooses one or the other of the DNS services in System/General Setup dependent on whether the Wireguard VPN is enabled or not.

@johnpoz
Agreed on the ISC not going anywhere. I want them to perfect Kea as much as possible.

@McMurphy I use dnsleaktest.com to check what DNS servers are being used. I believe if you see anything other than your IP and you have more than one server on your results, your DNS records are being sent elsewhere.

My pfSense is under a VPN, I only see 1 server and the VPN is the only IP I see. I have no DNS servers on my list other than my pfSense and have set to use only 127.0.0.1 and ignore other DNS servers:

91527ea0-0d4c-45de-8ecd-9be167ba4828-image.png

60c2479c-afde-4245-86f8-808c4c977c7b-image.png

7d1b75b1-0e20-4530-8c85-b006756e231c-image.png

29ea1666-f434-4f80-9558-c7188a0253d4-image.png

@sentein Huh? So you have dhcp running on pfsense.. Thought you said you had a different dhcp server?

Also Unless you put unbound into forwarding mode, setting those dns servers is pointless..

@johnpoz It's true that it is not possible to redirect a dns request from a network to a device belonging to that network ?

@johnpoz Hi,
Thank for your help, but today, I can confirm that the problem is from the TENDA I29 AP... This AP is so weird.
The web interface has few options. I don't know what's going on, but the access point refuses to connect to the LAN...

Today, I received a second TENDA I29 access point, and the problem is the same.

I also received a NETGEAR WAX615 hotspot today. And guess what?!

Miracle ! Everything works on the first try...
I performed the same operations:

Set a static IP Set mask Define the gateway and DNS1 to my pfsense...

Everything works the first time.
I even configured my VLANs for my different SSIDs, all in less than 15 minutes!!

I have no explanation regarding the TENDA access points... I performed the Firmware updates, but it didn't change anything...

I will send them back to Amazon...