Redirect DNS: Question.
-
Thanks. I can give you multiple example to show why the second is working.
See the below dig. If the redirections works fine ( Second case ), I should see this logs in the DNS server of 192.168.5.25. However I see this query as part of 192.168.1.10.
Second example:
hps01 is local hostname only known 192.168.1.10 ( added via LocalDNS feature of pihole ). This resolves fine which means redirection to 192.168.5.25 is not working.
-
@yogi_en dude I don't know how else I can explain it too you..
But a query for hps01. should never work asking anything because its not a fqdn.. Plain and simple - that tells me your dns is borked to be honest.
Query something only this 5.25 would know, now do a query to 1.1.1.1 after setting up redirection.. If your redirect is correct you would get an answer, if you ask 1.1.1.1 directly - then it would send back NX as I have shown multiple times already.
See my edit - you got a answer from 1.1.1.1 in 4ms -- really?
edit: Look in your state table when you do a query that should be redirected - example here is my client asking 8.8.8.8 you can see from the state table it was redirect to my pihole on 192.168.3.10
-
OK. Thanks for the help and pointers. Let me do some more experiments before I get back to you.
-
@yogi_en here to help - any questions just ask.. State table is quick easy verification to validate your redirection work. But also just asking something there is no way 1.1.1.1 would have an answer for is another, that only your local dns could answer.
Also response times in the really low ms range, like your 4ms you posted is another huge hint that it was redirected. If your getting 4ms response time from 1.1.1.1 that is crazy fast ;)
-
@johnpoz Some more info which might help us in debugging.
You are right about second scenario. It works in some situations. I have added a local DNS record hpss.localdomain in 192.168.5.25. Only 192.168.5.25 knows about this.
The following works as expected.
However the below doesn't work as expected. Here I am expecting the redirection to happen. However DNS server used is still 192.168.1.10.
Any thoughts?
-
@yogi_en said in Redirect DNS: Question.:
Any thoughts?
Not sure what your asking - looks to be working to me.
DNS server used is still 192.168.1.10.
Well yeah you clearly directly asked for 192.168.1.10 - if your on the same network, how would pfsense be involved in that conversation to redirect you.
Pfsense is never going to be involved in traffic between device the same network. It is a router, ie gateway off a network to get to other networks. When 192.168.1.x wants to talk to 192.168.1.y pfsense has nothing to do with that conversation. How could it ever possible redirect anything?
-
Thanks. My use case is like this.
I have a set of clients in LAN. I want all these clients to use DNS Server in LAN1 ( 192.168.5.25 ) no matter what the client's DNS settings are. Is there any way to achieve this in pfsense?
-
@yogi_en yeah if the client is set to use something that is off your 192.168.1 network, then you could redirect them to who you want on pfsense. But if they happen to ask dns on the same 192.168.1 network there is nothing pfsense can do about that.
-
Thanks got it. Your replies were quite informative and I learned many things because of that. I have been trying to re-direct the DNS which is on the same subnet which I understood now is not possible. Appreciate the all your help and time.
-
@yogi_en glad I could be of help.. Here all the time ;)
-
I have a totally unrelated question.
I need to use the latest version of unbound from FreeBSD. The version that is currently available with 2.5.2 doesn't support 'EDNS client subnet' as mentioned here https://redmine.pfsense.org/issues/11921. I need this feature to resolve the local IPs behind NAT when running the DNS server ( pihole ) in cloud.
Dnsmasq support this feature and it works well.
It looks like the FreeBSD version of unbound support this Couple of questions.
-
How can I update unbound to the latest version from FreeBSD? Is there any risk associated with this?
-
Or should I use BIND for this?
-
-
@yogi_en so if the bind version that is part of 2.5.2 works for you - you could use that.
But 2.6 which is out as RC and from my understanding of announcements should come out by end of Jan as release. There was mention of 22.01 dropping by end of the month, and "assume" 2.6 would be in line with that as well.
2.6 rc currently has unbound 1.13.2
As to risk of just using some freebsd version that is not in the pfsense repo, while that is always an "option" Prob not a good idea.. I know there was some "fixes" or improvements with edns and unbound 1.14, but I have not heard anything about when that might be included in pfsense. I am not currently doing anything with that or even played with it at all, so I am unsure if that is something you could do with a 1.13 version or if you need to be at least 1.14 of unbound?
Just as a point of discussion, if there is something want/need that is not supported in some service be it dhcp or dns as examples in the version of pfsense that is current. Nothing saying you can not just fire up those services on a pi or vm or shoot even a docker, etc..
-
Thanks again for the informative replies!. I think I will go ahead and use BIND. I was hesitant because, I have never used BIND earlier, so there is a learning curve for me.
-
@yogi_en looking at that redmine, it has target set to future. But looking at the output of unbound -V on my test 2.6RC I see this specifically called out
--disable-subnet
unbound -V Version 1.13.2 Configure line: --with-ssl=/usr --with-libexpat=/usr/local --disable-dnscrypt --disable-dnstap --with-libnghttp2 --enable-ecdsa --disable-event-api --enable-gost --with-libevent --with-pyunbound=yes --with-pythonmodule=yes LDFLAGS=-L/usr/local/lib ac_cv_path_SWIG=/usr/local/bin/swig --disable-subnet --disable-tfo-client --disable-tfo-server --with-pthreads --prefix=/usr/local --localstatedir=/var --mandir=/usr/local/man --infodir=/usr/local/share/info/ --build=amd64-portbld-freebsd12.3 Linked libs: libevent 2.1.12-stable (it uses kqueue), OpenSSL 1.1.1l-freebsd 24 Aug 2021 Linked modules: dns64 python respip validator iterator BSD licensed, see LICENSE in source package for details. Report bugs to unbound-bugs@nlnetlabs.nl or https://github.com/NLnetLabs/unbound/issues -
@johnpoz
That means 2.6 will not help me. Thanks for that. -
@yogi_en possible 2.7? that is out in dev version already, but is that redmine you linked too doesn't future version set, prob not.
I would chime in on that redmine if something you would like to see included..
-
For the time being I will go ahead with BIND which should survive the upgrades. Based on my analysis so far BIND already supports EDNS client subnet. I will keep an eye on that redmine.
Another question: Can we run multiple instances of dnsmasq in pfsense on different ports/interfaces?. Looks like this not possible, just want to confirm.
-
@yogi_en no I don't think so, you could run say unbound on port x, and then dnsmasq on port y and then even bind on port z I would think.
Don't forget the control port, 953 I think is both default for bind and unbound.. So one of those needs to be changed as well.
If it was me personally and I wanted to fire up different NS instances or software versions to be used by different things on my network. I would just fire them up on a vm or docker or a pi, etc. Vs trying to get them all to run on pfsense at the same time on different ports.
If you don't have say a nas or something you can run some low power vms on - pi's are cheap, and they sell neat little cluster sort of racks to mount them all together and can provide power to all of them via some usb power strip... I provide power to 4 of them with a little usb power thing from anker that can provide 60w, etc. And then little short usb cables.. All of that can be setup for very low budget.. You could prob even use pi zeros for such lower requirement sort of services..
Something like this for a bunch of pi zeros
-
Thanks. I do have a pi which runs pihole and Unifi Controller. I do have a home assistant server ( along with frigate for camera ) which also runs 24x7. I will see whether I can use any of these devices. My NAS is not on 24x7.
The cluster of pi zeros looks really interesting. Will explore that too.
-
@johnpoz
Another related question.Can I configure dnsmasq in pfsense ( via Advanced Options ) so that different clients uses different DNS servers?. As I understand this is also not possible because DHCP is not done by dnsmasq in pfsense. Is that correct?
