Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Redirect DNS: Question.

    Scheduled Pinned Locked Moved General pfSense Questions
    35 Posts 3 Posters 3.0k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • johnpozJ
      johnpoz LAYER 8 Global Moderator @yogi_en
      last edited by johnpoz

      @yogi_en dude while the redirection might be working your not going to be able to get any DNS..

      Your 2nd one is actually the one working, because you got an answer.

      If you don't want dns to 1.1.1.1 to work, then just block it vs redirecting it.

      Here I put the redirection back, and can see that pihole got it an answered it..

      query.jpg

      Maybe you just missed the log entry.. There can be a lot of them - so maybe you just didn't see it.. But your first setup is never going to work for dns since any sane client shouldn't accept that query.. Maybe your dns client of your os would? But do a simple query for redirection that only your local dns can answer.

      queryre.jpg

      An intelligent man is sometimes forced to be drunk to spend time with his fools
      If you get confused: Listen to the Music Play
      Please don't Chat/PM me for help, unless mod related
      SG-4860 24.11 | Lab VMs 2.8, 24.11

      Y 1 Reply Last reply Reply Quote 0
      • Y
        yogi_en @johnpoz
        last edited by

        @johnpoz

        Sorry, I am confused. In the first case the DNS is supposed to get redirected to 192.168.1.10. This works fine. I can browse , ping etc. All the queries gets redirected to 192.168.1.10 which I can see from the pihole logs.

        For the second case ( not working ), I expect all the DNS to get redirected to 192.168.5.25, which is not working. It still goes to 1.1.1.1 as shown by dig output. Also I do not see the queries in 192.168.5.25 DNS server.

        I didn't miss the log entry. I checked multiple times to ensure that.

        My question is not about blocking 1.1.1.1. I want to force certain clients to use only the DNS server which I provide. This works fine if clients and DNS server is on the same subnet ( working for the last couple of years with out any issue ). Issue started happening when I created a new DNS server in a different subnet.

        johnpozJ 1 Reply Last reply Reply Quote 0
        • johnpozJ
          johnpoz LAYER 8 Global Moderator @yogi_en
          last edited by johnpoz

          @yogi_en said in Redirect DNS: Question.:

          It still goes to 1.1.1.1 as shown by dig output. Also I do not see the queries in 192.168.5.25 DNS server.

          Why do you say that? The client asked 1.1.1.1 he doesn't know that your 5.25 box answered.. That exactly how it should look in a working redirection.

          While your dns on your os might accept that redirected query - it shouldn't!! that is why dig complains.. It sent the query to its gateway going to 1.1.1.1 mac address of the gateway. But it got a response from some other mac at a different IP other than its gateway. Any sane and secure dns client would complain about that and shouldn't work, jsut like dig is going - telling you hey something not right here!!

          Redirection to dns on another vlan works just fine.. As I have shown, do a sniff of the traffic you want.. But no your dig wouldn't complain about it, because the answer came back from the mac address it sent it too (pfsense).. So it thinks that answer came from who he asked 1.1.1.1

          another clue you were redirected - do you really think 1.1.1.1 answered in 4 ms?

          4ms.jpg

          If you got an answer from 1.1.1.1 in 4ms you have a really nice connection to the internet and are really freaking close to one of the anycast servers for cloudflare ;)

          I'm close and all with 14ms to 1.1.1.1

          quick.jpg

          But 4ms is a little too fast ;) again simple test query something to 1.1.1.1 that only local dns can respond with, some local fqdn.. that 1.1.1.1 would have no clue about.

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.8, 24.11

          Y 1 Reply Last reply Reply Quote 0
          • Y
            yogi_en @johnpoz
            last edited by

            @johnpoz

            Thanks. I can give you multiple example to show why the second is working.

            See the below dig. If the redirections works fine ( Second case ), I should see this logs in the DNS server of 192.168.5.25. However I see this query as part of 192.168.1.10.

            Screen Shot 2022-01-25 at 8.22.00 AM.png

            Second example:

            hps01 is local hostname only known 192.168.1.10 ( added via LocalDNS feature of pihole ). This resolves fine which means redirection to 192.168.5.25 is not working.

            Screen Shot 2022-01-25 at 8.24.08 AM.png

            johnpozJ 1 Reply Last reply Reply Quote 0
            • johnpozJ
              johnpoz LAYER 8 Global Moderator @yogi_en
              last edited by johnpoz

              @yogi_en dude I don't know how else I can explain it too you..

              But a query for hps01. should never work asking anything because its not a fqdn.. Plain and simple - that tells me your dns is borked to be honest.

              Query something only this 5.25 would know, now do a query to 1.1.1.1 after setting up redirection.. If your redirect is correct you would get an answer, if you ask 1.1.1.1 directly - then it would send back NX as I have shown multiple times already.

              See my edit - you got a answer from 1.1.1.1 in 4ms -- really?

              edit: Look in your state table when you do a query that should be redirected - example here is my client asking 8.8.8.8 you can see from the state table it was redirect to my pihole on 192.168.3.10

              statetable.jpg

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.8, 24.11

              Y 1 Reply Last reply Reply Quote 0
              • Y
                yogi_en @johnpoz
                last edited by

                @johnpoz

                OK. Thanks for the help and pointers. Let me do some more experiments before I get back to you.

                johnpozJ 1 Reply Last reply Reply Quote 0
                • johnpozJ
                  johnpoz LAYER 8 Global Moderator @yogi_en
                  last edited by

                  @yogi_en here to help - any questions just ask.. State table is quick easy verification to validate your redirection work. But also just asking something there is no way 1.1.1.1 would have an answer for is another, that only your local dns could answer.

                  Also response times in the really low ms range, like your 4ms you posted is another huge hint that it was redirected. If your getting 4ms response time from 1.1.1.1 that is crazy fast ;)

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                  Y 1 Reply Last reply Reply Quote 0
                  • Y
                    yogi_en @johnpoz
                    last edited by yogi_en

                    @johnpoz Some more info which might help us in debugging.

                    You are right about second scenario. It works in some situations. I have added a local DNS record hpss.localdomain in 192.168.5.25. Only 192.168.5.25 knows about this.

                    The following works as expected.

                    Screen Shot 2022-01-25 at 10.05.44 AM.png

                    However the below doesn't work as expected. Here I am expecting the redirection to happen. However DNS server used is still 192.168.1.10.

                    Screen Shot 2022-01-25 at 10.06.42 AM.png

                    Any thoughts?

                    johnpozJ 1 Reply Last reply Reply Quote 0
                    • johnpozJ
                      johnpoz LAYER 8 Global Moderator @yogi_en
                      last edited by johnpoz

                      @yogi_en said in Redirect DNS: Question.:

                      Any thoughts?

                      Not sure what your asking - looks to be working to me.

                      DNS server used is still 192.168.1.10.

                      Well yeah you clearly directly asked for 192.168.1.10 - if your on the same network, how would pfsense be involved in that conversation to redirect you.

                      Pfsense is never going to be involved in traffic between device the same network. It is a router, ie gateway off a network to get to other networks. When 192.168.1.x wants to talk to 192.168.1.y pfsense has nothing to do with that conversation. How could it ever possible redirect anything?

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                      Y 1 Reply Last reply Reply Quote 0
                      • Y
                        yogi_en @johnpoz
                        last edited by

                        @johnpoz

                        Thanks. My use case is like this.

                        I have a set of clients in LAN. I want all these clients to use DNS Server in LAN1 ( 192.168.5.25 ) no matter what the client's DNS settings are. Is there any way to achieve this in pfsense?

                        johnpozJ 1 Reply Last reply Reply Quote 0
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator @yogi_en
                          last edited by

                          @yogi_en yeah if the client is set to use something that is off your 192.168.1 network, then you could redirect them to who you want on pfsense. But if they happen to ask dns on the same 192.168.1 network there is nothing pfsense can do about that.

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                          Y 1 Reply Last reply Reply Quote 1
                          • Y
                            yogi_en @johnpoz
                            last edited by

                            @johnpoz

                            Thanks got it. Your replies were quite informative and I learned many things because of that. I have been trying to re-direct the DNS which is on the same subnet which I understood now is not possible. Appreciate the all your help and time.

                            johnpozJ 1 Reply Last reply Reply Quote 0
                            • johnpozJ
                              johnpoz LAYER 8 Global Moderator @yogi_en
                              last edited by

                              @yogi_en glad I could be of help.. Here all the time ;)

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.8, 24.11

                              Y 1 Reply Last reply Reply Quote 0
                              • Y
                                yogi_en @johnpoz
                                last edited by

                                @johnpoz

                                I have a totally unrelated question.

                                I need to use the latest version of unbound from FreeBSD. The version that is currently available with 2.5.2 doesn't support 'EDNS client subnet' as mentioned here https://redmine.pfsense.org/issues/11921. I need this feature to resolve the local IPs behind NAT when running the DNS server ( pihole ) in cloud.

                                Dnsmasq support this feature and it works well.

                                It looks like the FreeBSD version of unbound support this Couple of questions.

                                • How can I update unbound to the latest version from FreeBSD? Is there any risk associated with this?

                                • Or should I use BIND for this?

                                johnpozJ 1 Reply Last reply Reply Quote 0
                                • johnpozJ
                                  johnpoz LAYER 8 Global Moderator @yogi_en
                                  last edited by johnpoz

                                  @yogi_en so if the bind version that is part of 2.5.2 works for you - you could use that.

                                  But 2.6 which is out as RC and from my understanding of announcements should come out by end of Jan as release. There was mention of 22.01 dropping by end of the month, and "assume" 2.6 would be in line with that as well.

                                  2.6 rc currently has unbound 1.13.2

                                  As to risk of just using some freebsd version that is not in the pfsense repo, while that is always an "option" Prob not a good idea.. I know there was some "fixes" or improvements with edns and unbound 1.14, but I have not heard anything about when that might be included in pfsense. I am not currently doing anything with that or even played with it at all, so I am unsure if that is something you could do with a 1.13 version or if you need to be at least 1.14 of unbound?

                                  Just as a point of discussion, if there is something want/need that is not supported in some service be it dhcp or dns as examples in the version of pfsense that is current. Nothing saying you can not just fire up those services on a pi or vm or shoot even a docker, etc..

                                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                                  If you get confused: Listen to the Music Play
                                  Please don't Chat/PM me for help, unless mod related
                                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                                  Y 1 Reply Last reply Reply Quote 0
                                  • Y
                                    yogi_en @johnpoz
                                    last edited by

                                    @johnpoz

                                    Thanks again for the informative replies!. I think I will go ahead and use BIND. I was hesitant because, I have never used BIND earlier, so there is a learning curve for me.

                                    johnpozJ 1 Reply Last reply Reply Quote 0
                                    • johnpozJ
                                      johnpoz LAYER 8 Global Moderator @yogi_en
                                      last edited by

                                      @yogi_en looking at that redmine, it has target set to future. But looking at the output of unbound -V on my test 2.6RC I see this specifically called out

                                      --disable-subnet

                                       unbound -V
                                      Version 1.13.2
                                      
                                      Configure line: --with-ssl=/usr --with-libexpat=/usr/local --disable-dnscrypt --disable-dnstap --with-libnghttp2 --enable-ecdsa --disable-event-api --enable-gost --with-libevent --with-pyunbound=yes --with-pythonmodule=yes LDFLAGS=-L/usr/local/lib ac_cv_path_SWIG=/usr/local/bin/swig --disable-subnet --disable-tfo-client --disable-tfo-server --with-pthreads --prefix=/usr/local --localstatedir=/var --mandir=/usr/local/man --infodir=/usr/local/share/info/ --build=amd64-portbld-freebsd12.3
                                      Linked libs: libevent 2.1.12-stable (it uses kqueue), OpenSSL 1.1.1l-freebsd  24 Aug 2021
                                      Linked modules: dns64 python respip validator iterator
                                      
                                      BSD licensed, see LICENSE in source package for details.
                                      Report bugs to unbound-bugs@nlnetlabs.nl or https://github.com/NLnetLabs/unbound/issues
                                      

                                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                                      If you get confused: Listen to the Music Play
                                      Please don't Chat/PM me for help, unless mod related
                                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                                      Y 1 Reply Last reply Reply Quote 0
                                      • Y
                                        yogi_en @johnpoz
                                        last edited by

                                        @johnpoz
                                        That means 2.6 will not help me. Thanks for that.

                                        johnpozJ 1 Reply Last reply Reply Quote 0
                                        • johnpozJ
                                          johnpoz LAYER 8 Global Moderator @yogi_en
                                          last edited by

                                          @yogi_en possible 2.7? that is out in dev version already, but is that redmine you linked too doesn't future version set, prob not.

                                          I would chime in on that redmine if something you would like to see included..

                                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                                          If you get confused: Listen to the Music Play
                                          Please don't Chat/PM me for help, unless mod related
                                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                                          Y 1 Reply Last reply Reply Quote 0
                                          • Y
                                            yogi_en @johnpoz
                                            last edited by

                                            @johnpoz

                                            For the time being I will go ahead with BIND which should survive the upgrades. Based on my analysis so far BIND already supports EDNS client subnet. I will keep an eye on that redmine.

                                            Another question: Can we run multiple instances of dnsmasq in pfsense on different ports/interfaces?. Looks like this not possible, just want to confirm.

                                            johnpozJ 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.