do you use DNS Forwarder or Resolver with a Lan Cache Server?

comet424

@stephenw10
so i got the unbound script... i didnt know there was another file to create it.. as i dont do much linux.. not anymore 20 yrs ago yes

here is the unbound for blizzard

server:
  local-zone: "cdn.blizzard.com" redirect
  local-data: "cdn.blizzard.com 30 IN A 192.168.0.33"
  local-zone: "blizzard.vo.llnwd.net" redirect
  local-data: "blizzard.vo.llnwd.net 30 IN A 192.168.0.33"
  local-zone: "blzddist1-a.akamaihd.net" redirect
  local-data: "blzddist1-a.akamaihd.net 30 IN A 192.168.0.33"
  local-zone: "blzddist2-a.akamaihd.net" redirect
  local-data: "blzddist2-a.akamaihd.net 30 IN A 192.168.0.33"
  local-zone: "blzddist3-a.akamaihd.net" redirect
  local-data: "blzddist3-a.akamaihd.net 30 IN A 192.168.0.33"
  local-zone: "blzddist4-a.akamaihd.net" redirect
  local-data: "blzddist4-a.akamaihd.net 30 IN A 192.168.0.33"
  local-zone: "dist.blizzard.com" redirect
  local-data: "dist.blizzard.com 30 IN A 192.168.0.33"
  local-zone: "dist.blizzard.com.edgesuite.net" redirect
  local-data: "dist.blizzard.com.edgesuite.net 30 IN A 192.168.0.33"
  local-zone: "edge.blizzard.top.comcast.net" redirect
  local-data: "edge.blizzard.top.comcast.net 30 IN A 192.168.0.33"
  local-zone: "edgecast.blizzard.com" redirect
  local-data: "edgecast.blizzard.com 30 IN A 192.168.0.33"
  local-zone: "level3.blizzard.com" redirect
  local-data: "level3.blizzard.com 30 IN A 192.168.0.33"
  local-zone: "llnw.blizzard.com" redirect
  local-data: "llnw.blizzard.com 30 IN A 192.168.0.33"
  local-zone: "nydus.battle.net" redirect
  local-data: "nydus.battle.net 30 IN A 192.168.0.33"

how can i import that though into resolver overrides.. but they dont break it down by host and domain though

ya so my i testing on my 1 comp
gateway and dns points to 192.168.0.1
and i fixed a couple of the domain host overrides so they not conflicting and they all point to 192.168.0.33

and i set the upstream dns to 1.1.1.1 so it wouldnt run in circles not getting internet by pointing to 192.168.0.1 on the lancache dns... but its also not working.. its like now i have those... now all internet access for blizzard launcher orgin launcher and epic launcher have no internet.. is there another check box i need to set to enable it.. and resolver is enabled.. as i use it for NordVPN

ive never used pihole and i was going to but from some videos they said pfsense is better then pihole and why use a raspberry pi if you got pfsense so never tried pihole...

so i not sure what you mean if i resolve from a host using pfsense for dns does it return 192.168.0.33...

if you mean if i try to use epic blizzard or orgin launcher.. no it doesnt... it actually seems to not allow it.. traffic graph shows nothing..

but if i set the computer ethernet connection from 192.168.0.1 dns to 192.168.0.33 then it goes back to working..

as im sure when you add those overrides... you set your computers to 192.168.0.1 as the dns like normally and redirection happens at pfsense level and goes to 192.168.0.33

thats what i guess..

so right now only way its working is like before i set up these over rides.. 192.168.0.33 in the windows ethernet dns...

stephenw10

Ok, great. So you can add those to Unbound in the custom config field like:

Screenshot from 2022-07-06 23-24-38.png

From your laptop that is using pfSense (192.168.0.1) as it's DNS server if you run nslookup cdn.blizzard.com it should return 192.168.0.33. If it does that means Unbound is working as expected.

The DNS lookup loop can only happen for domain overrides. For host overrides, like the example above, pfSense doesn't query the Lancache server.

@comet424 said in do you use DNS Forwarder or Resolver with a Lan Cache Server?:

if i set the computer ethernet connection from 192.168.0.1 dns to 192.168.0.33 then it goes back to working..

Ok, that implies DNS queries must go via Lancache for it to do whatever it does and that means host overides will not work. Only domain overrides will forward queries to Lancache.

Steve

comet424

@stephenw10
ok so this is working.. i added epic,blizzard,steam, and windows updates unbound to the custom

nslookup cdn.blizzard.com
Server:  pfSense2.localdomain
Address:  192.168.0.1

Name:    cdn.blizzard.com
Address:  192.168.0.33


nslookup amupdatedl5.microsoft.com
Server:  pfSense2.localdomain
Address:  192.168.0.1

Name:    amupdatedl5.microsoft.com
Address:  192.168.0.33


nslookup fastly-download.epicgames.com
Server:  pfSense2.localdomain
Address:  192.168.0.1

Name:    fastly-download.epicgames.com
Address:  192.168.0.33


nslookup update6.dota2.wmsj.cn
Server:  pfSense2.localdomain
Address:  192.168.0.1

Name:    update6.dota2.wmsj.cn
Address:  192.168.0.33

but if i try to use it.. like Blizzard,Epic, Steam it will not log in.. Errors
Windows Update seems to work.. well there is not errors but cant tell if there was an update or not
all i know it passed

is the reason its not working cuz i have the host overrides and domain overrides in there now.. and i should remove them cuz i using the custom section?

not sure what you mean by
"The DNS lookup loop can only happen for domain overrides. For host overrides, like the example above, pfSense doesn't query the Lancache server." but i believe ya as your smarter then me at this stuff...

and not sure what you mean here too
"Ok, that implies DNS queries must go via Lancache for it to do whatever it does and that means host overides will not work. Only domain overrides will forward queries to Lancache."

do i need to use the dns forwarder then? to forward queries.. and whats the difference between dns forwarder and resolver what do each do

least i know how to use unbond and where it goes (: always learning something new everyday (:

stephenw10

@comet424 said in do you use DNS Forwarder or Resolver with a Lan Cache Server?:

is the reason its not working cuz i have the host overrides and domain overrides in there now.. and i should remove them cuz i using the custom section?

No. The custom values are the same as adding host overrides.

not sure what you mean by
"The DNS lookup loop can only happen for domain overrides. For host overrides, like the example above, pfSense doesn't query the Lancache server." but i believe ya as your smarter then me at this stuff...

Host overrides cannot create a loop. Domain overrides can.

and not sure what you mean here too
"Ok, that implies DNS queries must go via Lancache for it to do whatever it does and that means host overides will not work. Only domain overrides will forward queries to Lancache."

When you are using the Lancache server as a DNS server in the client directly it works.
The only way to do that via pfSense is to use only domain overrides. I recommend you try that first.

do i need to use the dns forwarder then? to forward queries.. and whats the difference between dns forwarder and resolver what do each do

No Unbound can also forward queries. It can be set in forwarding mode to only forward queries but you don't need to do that.

Remove the host overrides and custom values.
Add domain overrides for the domains you need so that the Lancache server is resolving those and can then choose what to resolve as local.

Steve

comet424

so i found that doing it with the custom options and posting the code in there.. that works seems to work... when i did similar in the Host Override it didnt work just blocked it... and doing it "Domain Override" doesnt work

so putting this in the custom options works:

server:
  local-zone: "cdn.blizzard.com" redirect
  local-data: "cdn.blizzard.com 30 IN A 192.168.0.33"
  local-zone: "blizzard.vo.llnwd.net" redirect
  local-data: "blizzard.vo.llnwd.net 30 IN A 192.168.0.33"
  local-zone: "blzddist1-a.akamaihd.net" redirect
  local-data: "blzddist1-a.akamaihd.net 30 IN A 192.168.0.33"
  local-zone: "blzddist2-a.akamaihd.net" redirect
  local-data: "blzddist2-a.akamaihd.net 30 IN A 192.168.0.33"
  local-zone: "blzddist3-a.akamaihd.net" redirect
  local-data: "blzddist3-a.akamaihd.net 30 IN A 192.168.0.33"
  local-zone: "blzddist4-a.akamaihd.net" redirect
  local-data: "blzddist4-a.akamaihd.net 30 IN A 192.168.0.33"
  local-zone: "dist.blizzard.com" redirect
  local-data: "dist.blizzard.com 30 IN A 192.168.0.33"
  local-zone: "dist.blizzard.com.edgesuite.net" redirect
  local-data: "dist.blizzard.com.edgesuite.net 30 IN A 192.168.0.33"
  local-zone: "edge.blizzard.top.comcast.net" redirect
  local-data: "edge.blizzard.top.comcast.net 30 IN A 192.168.0.33"
  local-zone: "edgecast.blizzard.com" redirect
  local-data: "edgecast.blizzard.com 30 IN A 192.168.0.33"
  local-zone: "level3.blizzard.com" redirect
  local-data: "level3.blizzard.com 30 IN A 192.168.0.33"
  local-zone: "llnw.blizzard.com" redirect
  local-data: "llnw.blizzard.com 30 IN A 192.168.0.33"
  local-zone: "nydus.battle.net" redirect
  local-data: "nydus.battle.net 30 IN A 192.168.0.33"
server:
  local-zone: "cdn.unrealengine.com" redirect
  local-data: "cdn.unrealengine.com 30 IN A 192.168.0.33"
  local-zone: "cdn1.epicgames.com" redirect
  local-data: "cdn1.epicgames.com 30 IN A 192.168.0.33"
  local-zone: "cdn1.unrealengine.com" redirect
  local-data: "cdn1.unrealengine.com 30 IN A 192.168.0.33"
  local-zone: "cdn2.unrealengine.com" redirect
  local-data: "cdn2.unrealengine.com 30 IN A 192.168.0.33"
  local-zone: "cdn3.unrealengine.com" redirect
  local-data: "cdn3.unrealengine.com 30 IN A 192.168.0.33"
  local-zone: "download.epicgames.com" redirect
  local-data: "download.epicgames.com 30 IN A 192.168.0.33"
  local-zone: "download2.epicgames.com" redirect
  local-data: "download2.epicgames.com 30 IN A 192.168.0.33"
  local-zone: "download3.epicgames.com" redirect
  local-data: "download3.epicgames.com 30 IN A 192.168.0.33"
  local-zone: "download4.epicgames.com" redirect
  local-data: "download4.epicgames.com 30 IN A 192.168.0.33"
  local-zone: "epicgames-download1.akamaized.net" redirect
  local-data: "epicgames-download1.akamaized.net 30 IN A 192.168.0.33"
  local-zone: "fastly-download.epicgames.com" redirect
  local-data: "fastly-download.epicgames.com 30 IN A 192.168.0.33"
  local-zone: "cdn-patch.swtor.com" redirect
  local-data: "cdn-patch.swtor.com 30 IN A 192.168.0.33"
  local-zone: "lvlt.cdn.ea.com" redirect
  local-data: "lvlt.cdn.ea.com 30 IN A 192.168.0.33"
  local-zone: "origin-a.akamaihd.net" redirect
  local-data: "origin-a.akamaihd.net 30 IN A 192.168.0.33"

that covers windows ,epic,steam,blizzard that seems to work

when i remove the custom options .. and do the Domain Override it doesnt. i went and read each one of the unbound lines and took the web address and took it to the first period.. to be the domain... but found it didnt work

and if i put the custom options section back in and leave the domain override it will work...

maybe it has to do something with the "30 IN A" in the custom options that makes it work? not sure what that means

and what i was meaning about a loop in the one page i guess reddit says... the lancache causes a loop it doesnt make it to the internet... so if the router is 192.168.0.1 and your computer is set to 192.168.0.1 and router unbounds to 192.168.0.33 and when the lancache is 192.168.0.33 IP but its upstream is 192.168.0.1 i guess what it does it

router goes to 192.168.0.33 lancache goes to 192.168.0.1 the router goes to 192.168.0.33 then lancache goes to 192.168.0.1 like a do loop.. so never gets internet..
so they recomeneded to use like 1.1.1.1 as the upstream for the lancache upstream dns just to get out of the loop.

so what i found
Lancache (dns 192.168.0.1)
custom options: doesnt work
host override : doesnt work
domain override: doesnt work

lancache (dns 1.1.1.1)
custom options: works
host override : doesnt work
domain override: doesnt work

i wonder if that "30 IN A" makes all the difference as i found when i did the host override it seemed to block like epic,blizzard, steam... and the domain override didnt work at all either... what is that "30 IN A" must be magic lol

so i going to do some more testing.. so far only way it works is through custom options...

so isnt dns resolver same as forwarder? it sees the address and forwards it to the proper server?

stephenw10

For normal DNS queries Unbound (the resolver) in it's default mode resolves the IP addresses directly. In forwarding mode it forwards queries to some other DNS server.
Domain overrides (or the custom options) forward only queries for those domains to the specified server.

Steve

comet424

@stephenw10
ok seems to be working kinda ive run in the amazon page issue where it doesnt generate the page right on Non VPN clients

so at current... i deleted the Domain Overrides... they werent working... the Host Override actually started to work without the need of the custom options: weird i dunno
and im testing on the VPN side
so
192.168.0.1 is the Gateway and DNS for windows i using NordVPN and webpages work and epic blizzard steam all seem to be working for now lol
but i dont know if its truly working reason why is... Traffic Graph shows like "origin" is the traffic

now for the Non VPN
i also use
192.168.0.1 for Gateway and DNS i have a range like 192.168.0.20-40 is nonvpn and rest is vpn as example
same as above the blizzard epic steam seem to be working also just showing "origin" for downloading

but going to like Amazon.. the pages will not generate right why is that ? so you know graphics wont show... and its just like a 1990s webpage just text and text fields no graphics.

and the lancache upstream dns is set to 1.1.1.1

does it mean half dns is working when pages partially load?
is there some other settings i need to adjust?

stephenw10

So by VPN vs Non-VPN you mean clients on your LAN that are policy routed out via NordVPN?

What route does traffic from Lancache use?

It looks like you have Unbound set to the VPN for it's outbound queries.

Where you are going to see issues is when clients are opening connections from on a different WAN to the DNS queries. That's what many sites use to detect VPN use and block it.

Steve

comet424

so on my network i have is.... i dont have vlan capable or extra switchs to split things
so i use alias's and ranges.

192.168.0.30-49 WAN no vpn straight out the WAN connection avoid VPN
192.168.0.50-150 WAN but no internet thats for my wifi devices switchs,plugs,lights etc
192.168.0.151-254 VPN devices using NordVPN connection

thats basiclly my setup and 192.168.0.2-19 is behind vpn but they are for my server router wifi routers etc..

right now the lancache has an ip of 192.168.0.33 and an upstream inside the lancache dns is 1.1.1.1
i do not know which way it goes out the internet as i cant specify it.. this is a screen shot of unraid

ya to setup nordvpn i had to setup outbound to nordVPN ... i know i mentioned in past i was hoping that you could have like 2 dns's 1 for the vpn and 1 for nonvpn..

so what i wanted was
vpn clients & non vpn (wan) clients access pfsense and both use lancache to cache such as like windows updates... and go out there proper gateways.. like vpns go out nord, and nonvpns go straight out the wan..

but i thinking u cant do it flawlessly? probably say you need like 2 pfsenses running or something or you can only have 1 or the other you cant have both

but why do alot of webpages work fine... but pages like Amazon go all nuts and looking like 90s webpages.. what does amazon do that other pages dont do etc

stephenw10

Technically Unbound can support different 'views' for different source IPs but that's not something pfSense provides gui options for. You'd have to do it all in custom config.

You can choose to run both DNS services on the firewall allowing some variation in responses but for your setup you'd need to duplicate all the overrides.

I assume your system default gateway is via the WAN?

Anyway clients are going to be using DNS requests that go via a mix of both WANs and that will cause some issues.

Steve

comet424

ah ok so not so simple go figure.. and how would i do that in custom config?

and how would you run both dns services? so you could run one for WAN and 1 for NordVPN i figured there be an option like when you have VLANS and under dhcp youd have your own section .. i figured there would be a dns resolver there tab for WAN and another one for NordVPN and so on..
and i not sure how to run both dns services

ya my default gateway is the WAN...

ya so its not simple then to get wans and vpns to go out the same and use the same dns.. i guess mine is complicated setup even though seems simple i guess the work to get to this is a complicated setup..

and maybe that could be a future request? unbound to have different views for different gateways.. i know the downloading throught epic,blizzard,steam, that seems to be working.. its just darn websites ...

so its workable? but u need to do more custom.. nothing you can do in the Rules

cuz,... its too bad the dns resolver doesnt have tabs.. so for the nordvpn then the outbound be nordvpn interface.... and for WAN you could choose wan as the outbound interface..

how do you or others do it thenfor your business's as im sure i cant be only one that does it..
a seperate dns? like pihole... one that you specify the gateway? so its set to 192.168.0.1 as i have it set for its dns 1.1.1.1 so then it would force out wan connection... and then vpn connections it would still use 1.1.1.1 dns but it would go out the nordvpn

nothing is simple lol.. but least its partialy working so far what i wanted... and i really appreciate your help so far.. least i learning stuff..

stephenw10

See: https://unbound.docs.nlnetlabs.nl/en/latest/topics/filtering/tags-views.html#views

You can't run both DNS services on the same port so to have both running you need to set one to a non-default port and then add port forwarding to it for the clients you want to use it.
Then you can have one service (probably Unbound) use the VPN for queries while the other one uses the system default, WAN.

That still doesn't help queries that go via Lancache that all leave via whatever route 192.168.0.33 is given.

This is a complex setup that I would expect to require significant tuning and troubleshooting.

Steve

comet424

ah ok so its not really fesable..

so... now i kinda confused so if the lancache uses 1.1.1.1 shouldnt WAN and VPN have no issues as its contacting 1.1.1.1 for its dns service?

and would it help if i had 2 lancaches

192.168.0.32     dns 1.1.1.1   (WAN)
192.168.0.33    dns 192.168.0.1   (VPN)

or do you still fall in the trap that the dns resolver is only set to the nordvpn outbound.
but then you run in issue not using the same cache dns...

since its complex its best to scrap idea maybe

its only most like you need 3 pfsenses
1 to go out the wan
1 does vpn
1 down the wan on the LAN
and the 2 would access the one going out the WAN like a tree

are there better solutions? how does that work when like say your vpn or ISP offers 2 dns's would that be like 2 pfsenses...

and i guess there is no way to setup outbound to all interfaces.. but also have no vpn leakage. like a block rule..
but im guessing thats not possible..

i just thinking of ideas.. and probably they dont exisit lol

stephenw10

@comet424 said in do you use DNS Forwarder or Resolver with a Lan Cache Server?:

so... now i kinda confused so if the lancache uses 1.1.1.1 shouldnt WAN and VPN have no issues as its contacting 1.1.1.1 for its dns service?

Yes, queries to 1.1.1.1 will work via either route but will connect to different servers and hence resolve in different locations. Services you connect to can see approximately where it was resolved so it they see your traffic coming from the US but DNS queries resolving in Europe you get flagged.

and would it help if i had 2 lancaches
192.168.0.32     dns 1.1.1.1   (WAN)
192.168.0.33    dns 192.168.0.1   (VPN)

Yes, that would probably work since you can then route traffic from one via the VPN.

At that point though it's easier to just pass the correct Lancache IP to clients to use for DNS directly. That removes the entire problem.

You should have two subnets for this though. That would be the first thing I would do. Get a managed switch and setup two VLANs.

comet424

ah ok lot to learn here i thought the dns stuff it could know if i accessed from pfsense from the
WAN range in aliases it would then dns resolve through WAN port and if it sees VPN range in aslias it would dns resolve through the vpn keeping both seperated... but i guess thats too much over head for the pfsense software to seperate probably .. and no one hungry to tackle that lol

so ive never played with vlans except i made a couple in interface section.. so never even used it.. so how would 2 subnets work and using 1 lancache to serve both cuz thats what i wanted 1 cache handles it all... and is there a certain managed switch to get i have looked them up kinda and there are so many L1 L2 L3 level something i dunno i just stuck with regular switch no managed.. dont even know what brand is good for home use

and when you say pass the correct lancache ip to clients do you mean like

all the ips in dhcp would get 192.168.0.33 if so i did that too but i was running into i dunno the lancache was getting overloaded.. sometimes pages wouldnt be found so i had to restart the lancache server.... and i still ran in the problem on WAN side amazon pages wouldnt load.. so id change the dns to 192.168.0.1 or it was 1.1.1.1 to go out the wan so i could use amazon...

vicious circle... but ya id look into a managed switch but i wouldnt know how to go past it as all i done was set up 2 vlans and i saw them in rules and that was it lol
so 0 experience there

stephenw10

@comet424 said in do you use DNS Forwarder or Resolver with a Lan Cache Server?:

how would 2 subnets work and using 1 lancache to serve both cuz thats what i wanted 1 cache handles it all...

You would need 2 caches or configure a single server in some way to send upstream queries via different routes depending on the source. It probably can't do that though.

@comet424 said in do you use DNS Forwarder or Resolver with a Lan Cache Server?:

when you say pass the correct lancache ip to clients do you mean like
all the ips in dhcp would get 192.168.0.33

Yes exactly. And clients from the other subnet would get the other lancache server.

comet424

ah can you do this

lancache be say on a Vlan
so 192.168.10.2 that uses WAN

and then say the VPN and non VPN you set the dns to 192.168.10.2

or that wouldnt work because of dns resolver is set for vpn outbound.

reason i doing all this is my internet in country is only 5mb down 500k up if i get that so i try to cache my windows updates and games for my vpn and non vpn.. as i dont live in town so i dont get what people in town get there like 25gb or faster internet or whatever they get...

i wonder how companies do it? or they dont

and ill look into getting a managed switch see what computer store has

comet424

does this work?

modem
"---------
pfsense #1 192.168.0.1 and dhcp range and connects to 192.168.0.33 lancahce
goes out the modem on WAN
"----------
pfsense #2 192.168.1.1 dhcp range.. and connects to 192.168.0.33 lancahce and goes out the VPN through pfsense #1

does that work?

or both can use 19.168.0.x #1 would use range 1-100 and #2 would use 192.168.0.101-254

just a thought dunno if it would work but your expert and i just learn as i go (:

stephenw10

The problem you have is that you need DNS queries to use the same route out as traffic. But you also need to send DNS queries via the LAN cache server so it can intercept and redirect requests for files it has stored.
What DNS server is Lancache running? Is it resolving or forwarding? It sounds like it's forwarding only. That means any queries sent to it that are not intercepted are forwarded to whatever it has set (1.1.1.1) via whatever route out it uses. That can only ever be one way so it will only ever work correctly with clients that are also using that route.
No commercial installs would ever be doing this.

Steve

comet424

ah ok so its only worth while 1 or the other.. vpn or nonvpn .. i guess in a commerical setup youd have 2 lancaches.. 1 for vpn and 1 for nonvpn and cuz u guys would have like 10xs faster then my internet you could host 2 lancaches cuz u could download installs faster then me.. here i tried to get a setup that served both.. vpn and non vpn on a 5mbp connection as it takes bloody forever for som game updates.. several days so i was hoping a simple solution 1 cache server and could cover both flawless

and i dunno what dns server its running it.. its just an all 1 wonder one person made
the doc info from the unraid cache says


An all in one lancache docker providing a combination of the following three projects:
https://github.com/lancachenet/lancache-dns
https://github.com/lancachenet/monolithic
https://github.com/lancachenet/sniproxy


Thanks to cheesemarathon for their work on the SteamCacheBundle that inspired this and provided the grounding for the template. Note, however, that this Docker image does not run at all the same way and is strictly based on the original upstream logcache project.


On start, this image will download the latest domain list from https://github.com/uklans/cache-domains. This means no constant upgrading of the docker image is necessary in order to guarantee continued usability

beyond my scope of understanding lol
and i guess like when you have your ISP and you get the 2 dns. thats be like having 2 lancaches.. if 1 failes flips to the other.. just with me internet so slow u have to dup download everything..

is there other solutions like other cache services you know of i know i read something about squid but never tried... i did try something and pfsense killed my usb learned to install pfsense on a ssd i think that was logs burned it out in a month lol...

but what do commerical installs do?