Slow DNS after 22.05
-
@lohphat said in Slow DNS after 22.05:
where DNS is blocked/filtered
If dns is blocked how are you talking to 8.8.8.8 ;)
Yes there are scenarios where you would have to forward, say an ISP that only allows access to its dns.. Believe if your on SAT connection for example your limited to specific NS you can talk to..
My point in reworking that guide is could give the impression that you need dns, when out of the box you don't need to set anything.. Because out of the box unbound is resolver.. So unless you have some specific restrictions in place there is no need to put in anything..
Finding the piece that completes this puzzle - is it boxes on ARM? Is it only ARM that forward via TLS? There is some piece to this puzzle missing that would complete it and make sense.
All I can say is I have had zero issues with unbound resolving.. but I am not on arm, and I don't do anything like forwarding. Pretty much unbound out of the box config, other than I set a min ttl of 1 hour and serve zero.. I also do min for qname, but allow for fallback, because if you don't there are lots of cname stuff that ends up having issues - stupid ass MS with like chained cnames 7 deep and shit ;) I think there is some technet domains that fail if you don't allow for fallback on the qname stuff, etc.
-
@johnpoz said in Slow DNS after 22.05:
@lohphat said in Slow DNS after 22.05:
where DNS is blocked/filtered
If dns is blocked how are you talking to 8.8.8.8 ;)
...or an internal datacenter DNS server
We are in agreement that the docs do need a rework as do the info text blocks to document defaults and any dependencies on other settings.
I'd be all in for a single click "Return page (or package) settings to default values".
-
@lohphat said in Slow DNS after 22.05:
Without initial external DNS, does unbound have an initial list of hard-coded IPs for the root servers to bootstrap DNS?
Repeat with me :
@gertjan said in Slow DNS after 22.05:
unbound makes use of the "13 main Internet Root servers".
Resolvers like bind actually have a text file that is used to init these servers :
; This file holds the information on root name servers needed to ; initialize cache of Internet domain name servers ; (e.g. reference this file in the "cache . <file>" ; configuration file of BIND domain name servers). ; ; This file is made available by InterNIC ; under anonymous FTP as ; file /domain/named.cache ; on server FTP.INTERNIC.NET ; -OR- RS.INTERNIC.NET ; ; last update: February 17, 2016 ; related version of root zone: 2016021701 ; ; formerly NS.INTERNIC.NET ; . 3600000 NS A.ROOT-SERVERS.NET. A.ROOT-SERVERS.NET. 3600000 A 198.41.0.4 A.ROOT-SERVERS.NET. 3600000 AAAA 2001:503:ba3e::2:30 ; ; FORMERLY NS1.ISI.EDU ; . 3600000 NS B.ROOT-SERVERS.NET. B.ROOT-SERVERS.NET. 3600000 A 192.228.79.201 B.ROOT-SERVERS.NET. 3600000 AAAA 2001:500:84::b ; ; FORMERLY C.PSI.NET ; . 3600000 NS C.ROOT-SERVERS.NET. C.ROOT-SERVERS.NET. 3600000 A 192.33.4.12 C.ROOT-SERVERS.NET. 3600000 AAAA 2001:500:2::c ; ; FORMERLY TERP.UMD.EDU ; . 3600000 NS D.ROOT-SERVERS.NET. D.ROOT-SERVERS.NET. 3600000 A 199.7.91.13 D.ROOT-SERVERS.NET. 3600000 AAAA 2001:500:2d::d ; ; FORMERLY NS.NASA.GOV ; . 3600000 NS E.ROOT-SERVERS.NET. E.ROOT-SERVERS.NET. 3600000 A 192.203.230.10 ; ; FORMERLY NS.ISC.ORG ; . 3600000 NS F.ROOT-SERVERS.NET. F.ROOT-SERVERS.NET. 3600000 A 192.5.5.241 F.ROOT-SERVERS.NET. 3600000 AAAA 2001:500:2f::f ; ; FORMERLY NS.NIC.DDN.MIL ; . 3600000 NS G.ROOT-SERVERS.NET. G.ROOT-SERVERS.NET. 3600000 A 192.112.36.4 ; ; FORMERLY AOS.ARL.ARMY.MIL ; . 3600000 NS H.ROOT-SERVERS.NET. H.ROOT-SERVERS.NET. 3600000 A 198.97.190.53 H.ROOT-SERVERS.NET. 3600000 AAAA 2001:500:1::53 ; ; FORMERLY NIC.NORDU.NET ; . 3600000 NS I.ROOT-SERVERS.NET. I.ROOT-SERVERS.NET. 3600000 A 192.36.148.17 I.ROOT-SERVERS.NET. 3600000 AAAA 2001:7fe::53 ; ; OPERATED BY VERISIGN, INC. ; . 3600000 NS J.ROOT-SERVERS.NET. J.ROOT-SERVERS.NET. 3600000 A 192.58.128.30 J.ROOT-SERVERS.NET. 3600000 AAAA 2001:503:c27::2:30 ; ; OPERATED BY RIPE NCC ; . 3600000 NS K.ROOT-SERVERS.NET. K.ROOT-SERVERS.NET. 3600000 A 193.0.14.129 K.ROOT-SERVERS.NET. 3600000 AAAA 2001:7fd::1 ; ; OPERATED BY ICANN ; . 3600000 NS L.ROOT-SERVERS.NET. L.ROOT-SERVERS.NET. 3600000 A 199.7.83.42 L.ROOT-SERVERS.NET. 3600000 AAAA 2001:500:3::42 ; ; OPERATED BY WIDE ; . 3600000 NS M.ROOT-SERVERS.NET. M.ROOT-SERVERS.NET. 3600000 A 202.12.27.33 M.ROOT-SERVERS.NET. 3600000 AAAA 2001:dc3::35 ; End of fileunbound has these compiled in the code.
@mynet said in Slow DNS after 22.05:
System/General Settings/Advanced/DNS
Strange, that is System=> General Setup / DNS Server Settings for me.
"DNS Server Override" exists for ancient reasons, when a typical PPP uplink would give you a IP WAN, gateway and one or two upstream ISP DNS servers, as relaying through the old internet up to the main 13 ( see above ) root servers would take time, and caching wasn't a thing yet.These days you don't have to use the ISP DNS, or some Alphabet cache resolver any more.
And as already mentioned, there are still uplink connections like satellite ( the geo orbit ones ) that should rely use a DNS cache resolver as close as possible.
For 99,8 % or the the rest of us : no more DNS settings needed.The initialization configuration wizard of pfSense is makes you think you have to fill in something. It actually asks and mention DNS related stuff to "help" the 0,2 % of the users.
This DNS Server Override
This : "Allow DNS server list to be overridden by DHCP/PPP on WAN or remote OpenVPN server" is of course something you don't want in the vast majority of all cases.Here are the no-DNS-issues settings for the 99,8 % :
-
@gertjan said in Slow DNS after 22.05:
Strange, that is System=> General Setup / DNS Server Settings for me.
Not sure whee I got what I wrote previously. It is System => General Setup / DNS Server Settings for me as well.
I will replicate your settings and see what happens.
Interestingly, it won't let me delete both of the google servers. With both listed, there is a delete button by each. When I deleted the first one, the delete button for the second one disappeared. So I have 1 google server and have unchecked DNS Server Override.
-
@mynet said in Slow DNS after 22.05:
When I deleted the first one, the delete button for the second one disappeared
well if your forwarding in unbound, don't think it will let you delete your dns that it would be forwarding too.
-
@johnpoz said in Slow DNS after 22.05:
well if your forwarding in unbound, don't think it will let you delete your dns that it would be forwarding too.
I'm not forwarding (at least I don't think I am). In Services/DNS Forwarder, Enable DNS Forwarder is unchecked.
I don't want to lose sight of the topic of the thread though, and regardless of my settings, it's still the case that it worked on 22.01 (with these settings) and doesn't (intermittently) on 22.05. As I said though I have not had issues with Windows though I am on my phone or iPad more than that computer so maybe I just have gotten lucky there.
Given that there haven't been any new reports in the last day or so, perhaps I will go back up and try some of the suggested settings.
(Having said all of that, I do appreciate the feedback and background. I assumed I either needed to provide the DNS servers or rely on the ISP's, for example.)
-
@mynet I think I know what is happening... If you only have 1 set, you can not delete it because that is where you would put 1 if you wanted one.
Just clear it out and hit save..
example
Just delete the numbers and then hit save at the bottom.
-
-
Super interesting thread and a lot of knowledge here.
So if I understand correctly (which is a big if!), are these assumptions correct?
pfSense uses the 13 root servers by default and will only use the defined DNS servers (in general settings) for the firewall if local DNS fails AND you have fall back to remote set, OR if you have use remote ignore local set in DNS Resolution Behaviour?
DNS servers listed in general settings are only used by client devices if you enable DNS forwarding and/or DNS Query Forwarding (and your not using DNS Server Override)?
DNS Server Override will (typically) use your ISP's DNS servers rather than the 13 root servers unless you're using OpenVPN?
From a security standpoint I'm assuming it makes no sense to use anything other than local and to block remote failback?
The only question I'd have here is whether the 13 root servers all support DNSSEC etc.Assuming one really only wanted to use external DNS servers such as Cloudflare or Quad9 for both the firewall and client devices, would the process would be to:
- Add the DNS servers in general settings
- Enable use remote, ignore local in resolution behaviour
- Enable dns forwarding and dns query forwarding
Excuse anything I may have misunderstood above, just trying to get my head around it all as I definitely misunderstood these features previously (and may still do).
-
@kempain said in Slow DNS after 22.05:
The only question I'd have here is whether the 13 root servers all support DNSSEC etc.
Your not understanding the use of the 13 roots, those are just to get the ball rolling, they point to the gltld servers, ie which servers to talk to for the different tlds.
;com. IN NS ;; ANSWER SECTION: com. 86400 IN NS d.gtld-servers.net. com. 86400 IN NS i.gtld-servers.net. com. 86400 IN NS c.gtld-servers.net. com. 86400 IN NS a.gtld-servers.net. com. 86400 IN NS e.gtld-servers.net. com. 86400 IN NS l.gtld-servers.net. com. 86400 IN NS j.gtld-servers.net. com. 86400 IN NS g.gtld-servers.net. com. 86400 IN NS h.gtld-servers.net. com. 86400 IN NS b.gtld-servers.net. com. 86400 IN NS k.gtld-servers.net. com. 86400 IN NS f.gtld-servers.net. com. 86400 IN NS m.gtld-servers.net. ;; QUESTION SECTION: ;org. IN NS ;; ANSWER SECTION: org. 3600 IN NS b0.org.afilias-nst.org. org. 3600 IN NS b2.org.afilias-nst.org. org. 3600 IN NS c0.org.afilias-nst.info. org. 3600 IN NS d0.org.afilias-nst.org. org. 3600 IN NS a0.org.afilias-nst.info. org. 3600 IN NS a2.org.afilias-nst.info.etc...
When you resolve you walk down the tree..
Hey roots who should I talk to for .net
hey .net servers who should I talk to for domain.netHey NS for domain.net what is the A record for www.domain.net
But yes roots have dnssec, but that doesn't mean all tlds support dnssec, nor does it mean the authoritative ns for domain.net has enabled dnssec.
If you want to use quad9, you wouldn't setup ignore local unless you didn't want to resolve any local sources. But yeah you would have to setup forwarding in unbound, or use the forwarder vs unbound.
As to the roots all supporting dnssec..
https://www.stackscale.com/blog/root-dnssec-ksk-ceremony/
The 13 roots servers are only authoritative for the root zone " . " this zone has the NS records for all the tlds NS..
Keep in mind it doesn't have to do this every time you ask for whatever.somedomain.tld - once it has asked the roots for NS of .tld then it caches those, and doesn't have to ask roots again for somethingelse.tld, it just asks .tld servers for ns of whateverdomain.tld until the TTL of those NS has expired.
Once it knows the NSers for whateverdomain.tld, it just ask one of the NS when you ask for www.whateverdomain.tld or serverX.whateverdomain.tld, etc.
The "roots" are only talked to get the NS for the .tld your asking about.
-
60 minutes to understand how the most important part of the internet works.
Remove the "how you think it works", replace it for : how it really works.
As soon as you understand something, you can 'see' where an issue is, change it, and do other, more interesting things.
= You win !!If there are still 'DNS' questions or issues after these video's : stop dealing with DNS. Become a painter, or make bread, or help Boeing make the MAX or TLS better. Take your pick.
Most of these are understandable for a 12 year old. Most videos are available in most languages.
@Kempain I promise you : it's way more easier as you think. It's 'old' technology from the '60 and '70, last century. No nuclear fusion tricks are involved. There is a boatload of 'keep it simple' going on here.
-
@gertjan said in Slow DNS after 22.05:
It's 'old' technology from the '60 and '70
Its not quite that old hehe, 1983 was when dns was created.. But yeah it's been around long time..
-
True. Should have to consult that low number RFC again ;)
Most probably 'they' have taken a phone book, read it, and uses it as an example.
Family names => phone numbers.
Easy.They've add some other stuff also.
-
@gertjan yeah in a nutshell sure dns is like a phone book.
Just different books.. The roots being the first book, saying hey if your looking for .tld X go look in book 1, if your looking for .tld Y go look in book 2
This next book lists the domain part of the fqdn, which says hey if your looking domainX look in book A1, if your looking for domainY go look in book A2, etc.
In that book will be the host part of the fqdn,
There might only be 3 books you need to look in, or there could be 6 books, depending on delegation, if cname that references a completely different book all the way back up to the tld, etc.
Generally speaking dns is not all that complicated, but there are quite a few moving parts. But sure the analogy of a phone book is pretty freaking close. DNS is the phonebook of the internet.
Forwarding is you just asking billy, hey could you look up kevins phone number for me.. Sure I could just look in the books myself, but I am lazy ;)
-
And the day Billy isn't up to the task, not present, not reachable, on holiday, on strike, or whatever, you won't be calling any one any more.
When Billy looks up a number, but send you another one (to error is human) you have an issue.
Added to that : Billy knows who you are in contact with ;)
-
@gertjan yup all true statements
-
L lohphat referenced this topic on
-
L lohphat referenced this topic on
-
L lohphat referenced this topic on
-
Anyone experiencing this issue got anywhere with fixing it?
I've tried reverting to OOTB DNS settings but still experience the same issue.I'm going to try a full re-install tonight to see if that helps at all.
-
I am also encountering this problem with DNS running on a pfSense VM running on my Proxmox server. Randomly hostnames, like facebook.com, will stop resolving, and then start up again after a brief period of time. No rhyme or reason. No pattern I can find.
As a temporary workaround, I installed a pihole container on proxmox to provide DNS services to my LAN, serve the pihole DNS address to my clients via DHCP. No issues at all after that, everything works fine.
Definitely something in the pfSense DNS.
-
I encountered the same issues wit the upgrade to 22.05. After trying some suggestions ont this forum topic and reverting back after comming to the conlusion that noting realy resorted the problem, i have enabled the option: DNS Query Forwarding. After i set this my problems seemed to have been resolved. Any other setting is set to the standard "pfsense" defaults.
-
@mikymike82 @Kempain @tentpiglet
If you have to forward to some DNS resolver then the quality of your DNS depends on what this DNS server is answering you.
If you decide to use the pfSense default DNS setting, pfSense resolves for you using the 13 ( ! ) available root servers, then DNS will work fine.
I can tell, as I'm using the settings Netgate proposes by default : never had an issue for the last 10+ years.These settings (first and third) are not default :
"for historical reasons".
