• Unbound doesn't listen to Tailscale IP

    4
    0 Votes
    4 Posts
    1k Views
    P
    Basically, if I'm on my Tailscale VPN network, I want to be able to talk to my local Unbound DNS resolver so I can do proper DNS lookups of my internal network, as I route my IPv4 private and IPv6 ULA subnets. To do so, I want to be able to talk to Unbound via the Tailscale-assigned internal IPv4 address (100.72.216.87) and its Tailscale-assigned internal IPv6 ULA address (fd7a:115c:a1e0:ab12:4843:cd96:6248:d857) Tailscale has its own internal ACLs, so someone else on their IP range can't talk to my VPN network without permission; hence it should be reasonable safe to allow the Tailscale subnet ranges 100.64.0.0/10 and fd7a:115c:a1e0:ab12::/64 to talk to Unbound.
  • Secure Dynamic DNS updates to Windows DNS

    1
    0 Votes
    1 Posts
    330 Views
    No one has replied
  • WAN DHCP briefly assigns IP in the same subnet as LAN

    20
    0 Votes
    20 Posts
    2k Views
    P
    @rcoleman-netgate said in WAN DHCP briefly assigns IP in the same subnet as LAN: @pfpv Try setting it to 100.2 Yes, thank you. Once you wrote it, it suddenly became very logical. It works now. I have always had a virtual IP on WAN 192.168.100.5/24 and it seemed to let me access 192.168.100.1. Only now I read in the instructions that "a typical IP Alias VIP cannot be used with DHCP".
  • Duplicate Static Mappings DHCP

    1
    0 Votes
    1 Posts
    339 Views
    No one has replied
  • 0 Votes
    1 Posts
    348 Views
    No one has replied
  • Just installed and the first restore-problem

    1
    0 Votes
    1 Posts
    220 Views
    No one has replied
  • 0 Votes
    3 Posts
    966 Views
    B
    @gertjan said in DHCP static mappings that don’t specify hostnames: @bp81 said in DHCP static mappings that don’t specify hostnames: I am observing that any client that has a static mapping set but has the hostname field blank in the mapping does not get registered in dns. Non static clients will get registered as expected. Ask pfSense what it is doing, and it will tell us : /usr/local/sbin/dhcpd -user dhcpd -group _dhcp -chroot /var/dhcpd -cf /etc/dhcpd.conf -pf /var/run/dhcpd.pid interface1 interface2 ..... The DHCP server config file /var/dhcpd/etc/dhcpd.conf shows me how known static leases are setup for the dhcpd process. I guess, when creating a static based MAC lease, the info is used to create a /var/dhcpd/etc/dhcpd.conf so dhcpd knows about it, and at the same time a line is added to /etc/hosts. /etc/hosts is read by unbound when it starts executing. Take a look at the /var/dhcpd/var/db/dhcpd.leases file. You will find some leases like : lease 192.168.1.71 { starts 4 2022/07/21 09:10:02; ends 5 2022/07/22 09:10:02; cltt 4 2022/07/21 11:47:01; binding state active; next binding state free; rewind binding state free; hardware ethernet 18:e7:b0:cc:bc:d9; uid "\001\030\345\260\039\005\341"; client-hostname "iPhone-12-Jullien"; } and other leases do not have a client-hostname at all. Or worse, do have a client-hostname, but this name is not DNS-hostname format compatible. Understand that the client-hostname is given to the dhcpd server by the device, using it's dhcp client. The client-hostname can be setup by the person who admins the device. If the device even has this capability. Many device have a client-hostname hard coded, or omit it. My /var/dhcpd/var/db/dhcpd.leases file contains 276 leases, and only 12 have a client-hostname given by a device. So : using the client-hostname given by the client is ..... not a safe solution. @bp81 said in DHCP static mappings that don’t specify hostnames: I am observing that any client that has a static mapping set but has the hostname field blank There was a forum thread a while ago about this question. Or was it : give MAC and hostname but no IPv4 in a static .... ? Don't recall. Consider the "DNS" as a phone book. One rule, no exception. Planet earth goes down ? Still no exceptions. The rule is : Phone number <=> Name. If one of the two is missing the system goes belly up. DNS down is bad for business (but a very popular amusement, see the forum, it''s an on going occupation for many) So, I guess pfSense want you (forces you) to give a host name. That's the name that can be checked against DNS name compliance. That's the one being used in for DNS. You can change this behaviour of course, no need to inform the dhcpd process with a setting. It's all 'pfSense GUI' scripted somewhere in the PHP files. But take note : if you decide to add some script logic that uses the "client-hostname" (the name given by the client) then you need some other process that parses the /var/dhcpd/var/db/dhcpd.leases and now you have opened a can of worms. Just read the several thouands of forum post about this process : [/usr/local/sbin/dhcpleases -c /usr/local/bin/php-cgi -f /usr/local/sbin/prefixes.php -l /var/dhcpd/var/db/dhcpd.leases This process is activated when you select this option : [image: 1658408825583-cd729aba-4fc9-4b9c-af35-d7bc5b3c9d92-image.png] This process stops and unbound (your local DNS !) every time a DHCP lease comes in, or gets renewed. Now you know why I strongly advice to disable this option : [image: 1658409032530-7db176b8-31f7-4071-9d1b-529db9fa7fd7-image.png] for every device that you have to know by hostname, pick an easy DNS hostname, and make a static MAC lease. I know this isn't the perfect solution, but it's the one that works, is easy to maintain, and unbound will restart far less often, so DNS keeps on working, and the cache gets build and stays valid. This one : [image: 1658409222813-a26ab38c-7ba1-4263-8bb0-5a5f9e192d9a-image.png] is 'harmless' as /etc/hosts only gets read when unbound starts. In short, it appears it is not possible to create the behavior I'm looking for. It's not terribly important to us, it just would've been nice. The background on our infrastructure is that we have a mixed environment administered by Active Directory and Windows DNS. We have Windows workstations, laptops, and servers, but we also have some Linux and FreeBSD systems, as well as some IoT devices. Hostname resolution of Windows machines in Windows DNS is easy; Active Directory joined workstations have a group policy set to register their hostnames in Windows DNS. To get non-Windows systems registered in DNS, we are using some scripting to read the dhcp leases file and dhcp config file from dhcpd, then doing some filtering to determine which leases belong to non-Windows devices and dynamically register those in Windows DNS. This is being done with a powershell script. The end result being that we now have resolution by hostname for every single device provisioned by DHCP in our network (and that is ALL devices at this point. We don't do manual IP address assignment on any system at this point). The scripting based solution works very nicely, it just would've been nice if we had the option to assign an IP address via DHCP static reservation without having to assign a hostname in the static reservation. That creates a condition where, when I create static reservations, I have to remember to leave the hostname field blank for Windows machines (which will register their DNS hostnames directly with AD DNS) but specify hostnames in the reservations for non-Windows systems. It's not really that big of a deal, it would just be more convenient to be able to write my DHCP reservations in a consistent manner for all entries rather than having one kind of entry for Windows systems and a different kind of entry for non-Windows systems.
  • Problem with WAN/GATEWAY and DHCP

    3
    0 Votes
    3 Posts
    490 Views
    V
    @falassion Re-enable the gateway monitoring and set an external IP for monitoring in case you've changed that in the meantime. Then try enabling System > Advanced > Miscellaneous > State Killing on Gateway Failure.
  • Can't ping any LAN hosts by host name

    21
    0 Votes
    21 Posts
    3k Views
    P
    @rcoleman-netgate said in Can't ping any LAN hosts by host name: Bridging in BSD should be used in a very sparing, limited function. It's not a switch, it's a router. @redbearak said in Can't ping any LAN hosts by host name: If bridging is really something BSD can't do reliably, If you really wanted bridging on your hardware you could run a Hypervistor such as Proxmox which does support bridging via underlying Linux. pfsense can then be run in a VM. A Linux bridge emulates a switch (not Hub by default) but may still be inferior to a dedicated switch. The complexity of running a hypervisor just to create a switch is likely to be poor use of your time. I run pfsense under Proxmox but pass through the NICs used by pfsense to optimise pfsense function and minimise the exposure surface however may others use VirtIO
  • 0 Votes
    1 Posts
    467 Views
    No one has replied
  • Virtual pfSense Not Assigning IPs

    Moved
    2
    0 Votes
    2 Posts
    467 Views
    R
    @danjmillier have you run a packet capture on the interface to see if it's seeing the DHCP requests?
  • descriptions on devices

    4
    0 Votes
    4 Posts
    772 Views
    R
    @jwwags92 DNS resolver would make it a universal setting to all items that use your pf to resolve... but you're still stuck in the spot of having to do it manually. Configuring a static-map is still a need, and while it usually works it won't help you when you have a static address already that needs an FQDN.
  • Dynamic DNS *NOT* Updating "Cached IP"

    36
    0 Votes
    36 Posts
    10k Views
    S
    @viragomann Thanks. Will follow over there.
  • Unbound is still crashing, at least once daily.

    11
    0 Votes
    11 Posts
    2k Views
    GertjanG
    @mtarbox said in Unbound is still crashing, at least once daily.: service watchdog restarting, etcetera Be careful with that one. To keep things close to your profession : what happens when you electro choc a patients heart when it is still beating ? Right, you stop it, and thus you're making things worse. When ever possible, stop using the "service watchdog".
  • DNS Host Override not working

    8
    0 Votes
    8 Posts
    1k Views
    johnpozJ
    @cryptos said in DNS Host Override not working: Still doesn’t make sense, though, since the override should have returned the internal IP for internal queriers. Yeah - and you showed it did with your direct query. These browsers and their doh ticks me off to no end.. I don't think you can view what the browser shows as IP for fqdn in chrome, but firefox you can.. And it should list your doh settings on the top example [image: 1657673107615-trr.jpg] See my nas.local.lan - and what doh mode I am in, and if it came from TRR or not.. 5 - Off by choice. This is the same as 0 but marks it as done by choice and not done by default. You can never trust these guys these days... I have all known doh IPs blocked in pfsense as well.. If you couldn't tell, not a fan of doh ;)
  • Unbound dns resolver stops resolving every few days after 22.05 upgrade

    14
    0 Votes
    14 Posts
    2k Views
    GertjanG
    @pajinha said in Unbound dns resolver stops resolving every few days after 22.05 upgrade: not sure how they managed to screw this one. The forum mentions a couple of 'DNS' issues since 22.05. But, what is a couple ? 22.05 has been downloaded and installed many thousands times (I can't tell, but I'm pretty sure). @pajinha said in Unbound dns resolver stops resolving every few days after 22.05 upgrade: ( removed my VPN outgoing interfaces ) If your DNS also goes over this VPN and the VPN is bad - as this can happen, they are not all equal and perfect - then, yeah, DNS looks bad. Because your uplink is bad. DNS is mostly UDP, these can get lost. unbound won't hammer away, and return a SERVFAIL. TCP get renegotiated and is far more resilient. For now, my DNS using 22.05 using default settings and no VPN is working as before. And don't tale my word for it, see for yourself.
  • NordVPN DNS servers seems to be down from my end but are apparently npt

    15
    0 Votes
    15 Posts
    1k Views
    P
    @bob-dig Make sense now that I read the tooltip differently. When the tooltip says "...if DNS Forwarder or Resolver is enabled" they mean enabled VS disabled from a service perspective and not on a per-interface basis.... That's what I misinterpreted. That's be nice to be able to NOT run unbound on an interface and serve system DNS servers. IMO the DHCP server should pass DNS servers in the following order: If DNS fields are populated use their settings; Otherwise If unbound is running on the interface use interface IP Else pass system DNS servers That's probably more of an improvement idea than anything else. For now (and probably forever) I have copied the system DNS servers onto the DHCP fields for DMZ and I'm back to normal. Sorry about the confusion. Funny how something can be interpreted differently... Thanks for your patience @Bob-Dig !
  • DNS can't find itself

    1
    0 Votes
    1 Posts
    246 Views
    No one has replied
  • Cant ping Lan <-> Opt 1 ?

    21
    0 Votes
    21 Posts
    2k Views
    S
    @johnpoz That makes more sense, I agree. You think that perhaps client (windows or mac) firewall deactivation only happened after a reboot ? If so that is bad behaviour, hope it doesn't do that when enabling it !
  • Domain name of pfsense via Cloudflare

    18
    0 Votes
    18 Posts
    2k Views
    johnpozJ
    @scroll_dp said in Domain name of pfsense via Cloudflare: that routing public IP to lan network That is a port forward.. You mean you want a "dmz host" like home routers allow you to do? You could do that with a 1:1 NAT - again BAD IDEA!!!
Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.