@johnpoz Yes, sorry. Feel free to edit the original subject.

This was effecting

23.01-RELEASE (amd64)
built on Fri Feb 10 20:06:33 UTC 2023
FreeBSD 14.0-CURRENT

I'm sorry, but I still have a problem. I created the bridge between LAN and LAN2, I assigned an IP range to the bridge and I created the Firewall rules. All clients work outward, but I don't understand why LAN connected clients don't see LAN2 connected clients: what did I forget? What should I do to make them visible to each other?

Before anything I would like to thank you for your answer and for being so active here. This community is truly amazing :)

@gertjan said in mail DNSBL queries resulting in NXDOMAIN:

Put your email server not behind a device that places in RFC1918 land.

I concur, however, the problem here is the 127.0.0.0/8 range not the standard RFC1918. I might be wrong but I can't see that range listed in RFC1918

I did some more digging on unbound and found this regarding the setting used for DNS Rebinding Prevention on their documentation: (can just read the last paragraph)

cf6f3801-bd53-4a8b-8ad7-36287e4f7e39-image.png

@gertjan said in mail DNSBL queries resulting in NXDOMAIN:

That file, as everything config file is generated and maintained by the pfSense GUI.
So editing it won't work.
Because :
You edit the file. You restart unbound ..... with the GUI => wrong ! the config file has just been rewritten.

You are totally right :) somehow that flew right over my head

@gertjan said in mail DNSBL queries resulting in NXDOMAIN:

so do what is proposed :

So I decided to go this route with a some small modifications (for now..):

I disabled DNS Rebind Check. Then re-added RFC 1918, excluding 127.0.0.0/8. Through the "custom options" section on the DNS Resolver tab.

@johnpoz Thank you! I’m off to read that link!

@alex-5
Thanks. That’s got to be the only thing I haven’t tried yet. Separate poe unit ordered and on the way.

@jimp said in Display Status: DHCP Leases with all 3 digits?:

There is also the lazy method: Click the "IP Address" column header on pfSense to sort them before copying.

There are not enough facepalms for me this morning.

I do this all_the_time and I didn't think about that before copying.

Thanks!

@wujj123456 said in Concurrent/Rapid DNS queries fail randomly after 23.01 upgrade:

but disabling DNSSEC and leaving forward mode and DNS over TLS doesn't.

Been using 1.1.1.1 (host name one.one.one.one) and 2606:4700:4700::1111 (host name one.one.one.one), port 853 = TLS. Just to test, for 3 weeks.
DNSSEC disabled of course.
I didn't detect any issue.

Went back to default : resolving (= not forwarding), DNSSEC actif.
Empty

8c9b4d01-81ac-4223-8339-67f8e85eb782-image.png

as : if all choices work well, the one with no settings is the one to prefer 😊

See here.

I just realized that I have no idea what I'm taking about...
I am using policy routing on the vpn

I had this issue as well with DNS Domain Overrides to MS DNS over OpenVPN.

To fix I had to:

Disable DNSSEC Select outbound Interfaces as ALL.

I originally had Outbound Interfaces it as WAN. It appears that OpenVPN interfaces are implicitly included under all. They cannot be explicitly selected.

This tutorial seems like pretty much what you're looking for with an external DNS server being told about DHCP lease IPs + names - https://freeipa-users.redhat.narkive.com/xJVbXRdO/pfsense-dhcp-to-ipa-s-bind-dynamic-updates-success.

@klinger said in DNS resolution for some hosts fails, but nslookup works:

the pfSense firewall queried our central firewall for name resolution (via packet capture).

Well then you were forwarding - or that NS is authoritative for the domain you were looking up. Out of the box pfsense is a resolver, it talks to the roots down to talk to the actual NS for whatever domain your looking for.

So no out of the box pfsense would not query some NS on your network.. Unless the roots and the gltd servers pointed you to them..

Out of the box pfsense is a resolver..

Hey roots, what is the NS for .com

Hey gltd servers what is the NS for domain.com

Hey NS for domain.com what is the IP address of www.domain.com

you can see this with a simple dig and a +trace, this is how a resolver works.. So why would it ask some upstream NS in your network?

[23.01-RELEASE][admin@sg4860.local.lan]/root: dig www.netgate.com +trace ; <<>> DiG 9.18.8 <<>> www.netgate.com +trace ;; global options: +cmd . 21987 IN NS d.root-servers.net. . 21987 IN NS e.root-servers.net. . 21987 IN NS f.root-servers.net. . 21987 IN NS g.root-servers.net. . 21987 IN NS h.root-servers.net. . 21987 IN NS i.root-servers.net. . 21987 IN NS j.root-servers.net. . 21987 IN NS k.root-servers.net. . 21987 IN NS l.root-servers.net. . 21987 IN NS m.root-servers.net. . 21987 IN NS a.root-servers.net. . 21987 IN NS b.root-servers.net. . 21987 IN NS c.root-servers.net. . 21987 IN RRSIG NS 8 0 518400 20230322050000 20230309040000 951 . TN/9VuM2Q8uI9vNqRDfX/si09GNyq8dHFQdBJPG7CE935u/HbanonU99 Z/mZRM2xIt9zJd8kuvWDi9t0TTLYdFaoJ4XMcQyOQZeeZM/XfLUNBkX0 YdJqjDZD3joFSHNUpKHRF/aIZhoKwRxuAqQsiK04HXrKt3SyaGnVsUy5 kXQU05Z5HEgP8ZK3ziqLD+0bRX9uYAegL+JgEEDx421apR1xN4FY6ngF VONOKheKbl6LhSp91jfkR5LhiEyAT3PMXwfQEntHAmCyBgfw05rbSZB6 vALXQDZBcWCs/pW9VEpPx4J1DpGYhgKAa7ojk8ZDgnY3kfl/H6LplGFi qme5AQ== ;; Received 525 bytes from 127.0.0.1#53(127.0.0.1) in 0 ms com. 172800 IN NS a.gtld-servers.net. com. 172800 IN NS b.gtld-servers.net. com. 172800 IN NS c.gtld-servers.net. com. 172800 IN NS d.gtld-servers.net. com. 172800 IN NS e.gtld-servers.net. com. 172800 IN NS f.gtld-servers.net. com. 172800 IN NS g.gtld-servers.net. com. 172800 IN NS h.gtld-servers.net. com. 172800 IN NS i.gtld-servers.net. com. 172800 IN NS j.gtld-servers.net. com. 172800 IN NS k.gtld-servers.net. com. 172800 IN NS l.gtld-servers.net. com. 172800 IN NS m.gtld-servers.net. com. 86400 IN DS 30909 8 2 E2D3C916F6DEEAC73294E8268FB5885044A833FC5459588F4A9184CF C41A5766 com. 86400 IN RRSIG DS 8 1 86400 20230323050000 20230310040000 951 . ENL8WPFbxOqXipIZr0gi73LXISv1Oc5VREINA+nwZ4SdXg72++HZvKPt q7Rlv/Zy/z8U0xsV8drSfktoc3L/vOT97I/xvBiqGBKfmcI9fZ+OI+rp aql8fl7ep0KxSsCW2snOapFvf3LeDcPop5OJtCOv0h0g6CYnLugbWdRR qiF6FDg38bx/QwpQZL0BKxD3E6/qjFOrBPuTbHkWk5P+B5SdEF9cWcsK pVy+N3wxKCvKALzxQzQ/zPja/P+8plxGzOYeiaZCFDN4wxa6433zkluG lLSTABiU6mnsmOl+0mVQWzsF0s6QgLemrtyQlGT9HJw/kZhsX8N7WnlJ sPBQ6w== ;; Received 1175 bytes from 198.97.190.53#53(h.root-servers.net) in 33 ms netgate.com. 172800 IN NS ns1.netgate.com. netgate.com. 172800 IN NS ns2.netgate.com. CK0POJMG874LJREF7EFN8430QVIT8BSM.com. 86400 IN NSEC3 1 1 0 - CK0Q2D6NI4I7EQH8NA30NS61O48UL8G5 NS SOA RRSIG DNSKEY NSEC3PARAM CK0POJMG874LJREF7EFN8430QVIT8BSM.com. 86400 IN RRSIG NSEC3 8 2 86400 20230315042256 20230308041256 36739 com. VHsDr23lP03/xPxRbNUFC+UkSrUZ/Qr3JYHjhz7DYNOLPnzixRL+Hjv/ +kjbNiKVHYy2iGqU38XGJ4sPbvyRx8qygeTX3E7NnS4SdjnN2PKkTMAQ 42Vjxkq928qpoKPOwyn4zgcGSCZffTlNbY5IKVZacivEishoJ1j3BnVJ 1p2/N0gsLcS2GjIob2YGe7j4Lz8Aa5Rrj0s+DwlyP+BlCQ== 2U53SUOKS8OJJV178M90A8BMNI9USDVJ.com. 86400 IN NSEC3 1 1 0 - 2U54DC5VA9HQSV9DBV1IK3JD7KR4L61T NS DS RRSIG 2U53SUOKS8OJJV178M90A8BMNI9USDVJ.com. 86400 IN RRSIG NSEC3 8 2 86400 20230316045937 20230309044937 36739 com. JLAYnUTWdSkzhgKse8Qoyz0cdweJTibB9d0fQmTG1iDubISe0e/HhhBK SAdDEjqsOyV6x6bwtCVi+7HfoawJpsUgDNfYXEcgQfaXRk6TEOofhKnO mK+fVRHYsGbrBkyAfogu6KbQUAgleU65xfCmjKNaeYCDLe1Tq4FBcBLQ GstvOhDuAH5by0b1UBv+5k40jxuut/dlWfd+fxiwaxEO9A== ;; Received 717 bytes from 2001:502:1ca1::30#53(e.gtld-servers.net) in 36 ms www.netgate.com. 60 IN CNAME 1826203.group3.sites.hubspot.net. ;; Received 124 bytes from 208.123.73.90#53(ns2.netgate.com) in 37 ms [23.01-RELEASE][admin@sg4860.local.lan]/root:

@gertjan

Set fixed ip => printer gets new ip eventually & forgets old lease
Remove fixed ip => printer gets another different IP eventually

@furom said in DNS: Plain Unbound works, Quad9 almost...:

Unbound Resolver with quad9 through TLS
Unbound Resolver with no forwarder

I've been using the resolver as a resolver for .... 10 years or so.
Never had an issue.

Just for the fun, I'm forwarding to 1.1.1.1 and 2606:4700:4700::1111, as I use IPv6 and IPv4 for the old stuff), and because why not : over TLS using port 853.
No issues neither.

Btw : 1.1.1.1 (or 8.8.8.8 or 9.9.9.69) are all resolver.
What they can do, so can unbound, the pfSense's resolver.

@netboy You can’t forward the same port twice unless using either something like haproxy or an external load balancer.

@steveits I wonder if somehow unchecking that box reset something that was in my config causing it not to work correctly? Not sure...

@jasonau good to see another Brisbane local on the forums.

I use Active Directory on my primary LAN for DNS and DHCP to my clients. I have a guest network and a DMZ with some public facing servers which are served by pfSense for DNS Forwarder and DHCP. I also have several internal DNS based aliases for firewall rules.

I need pfSense to be able to resolve local addresses for the firewall alias rules, but don't want the guest or DMZ network to be able to query any of the DNS entries for my LAN. I figure if clients of my guest or DMZ networks get pwned I don't want them to be able to start reverse resolving my private IP addresses to potentially map my LAN network. I have specific rules in the DNS Forwarder settings blocking lookup for my internal LAN domains.

@john24634 See https://docs.netgate.com/pfsense/en/latest/services/dhcp/mappings-in-pools.html for the reasoning for this.

You can split your pool and create additional pools to use IPs in the middle.