pfsense blocking certain/some sites

stephenw10

@gurveer said in pfsense blocking certain/some sites:

its resolves in diag>dns lookup

What is the actual result of that test? All configured DNS servers respond? In a timely manner?

If pfSense can resolve that (on all it's comfigured servers) and your client cannot then the only conclusion is that your client is not using pfSense for DNS.

Steve

Gurveer

@viragomann thanks it worked (tho disabled dns resolver )btw what does this dns forwarding means ?

Gurveer

@stephenw10 @bingo600 @rcoleman-netgate @viragomann thanks alot you guys for helping and bearing me so long

viragomann

@gurveer
I tried to explain above in a view words.
By default the DNS Resolver used root DNS servers (https://www.iana.org/domains/root/servers) to resolve DNS requests.

However, in forwarding mode it sends request to the servers you've stated in general setup, to 1.1.1.1 in your case.

There should be reason for the root servers not working. Maybe restrictions in your country, I don't know.

bingo600

@gurveer

On the screenshot above this is clearly in error

linux:~$ host 1.1.1.1
1.1.1.1.in-addr.arpa domain name pointer one.one.one.one.

linux:~$ host cloudflare-dns.com
Host cloudflare-dns.com not found: 3(NXDOMAIN)

And as suggested
~~Disable forwarding~~ , Remote DNS servers and let pfSense resolve directly.

stephenw10

@gurveer said in pfsense blocking certain/some sites:

it worked (tho disabled dns resolver )

You mean you disabled the resolver (Unbound) and enabled the forwarder (DNSMasq)?

If so that shouldn't be required and probably indicates some underlying issue.

Steve

stephenw10

@bingo600 said in pfsense blocking certain/some sites:

On the screenshot above this is clearly in error

Ah, well spotted. Yes if DoT is enabled that would be an issue. Though I would expect it to break everything not just that site

Gurveer

@bingo600 removed the cloudflare-dns.com but nothing happened site still not working (enabled dns resolver ,disabled forwarder)

bingo600

@gurveer
Remove the 1.1.1.1 too

@stephenw10
1: I'd expect the "bad domain" to affect all DOT lookups.

2:
As i read it , with the current selection , the local (127.0.0.1) should take precedence , and just use the 1.1.1.1 stuff if the local fails to resolve correct ?
Since pfSense should be able to resolve, the 1.1.1.1 stuff should not be used at all.

@Gurveer
The DNS Resolver is also called "Unbound ... The program name"
The settings are here Services --> DNS Resolver

What does your config look like there ??

All of it ?

Gurveer

@bingo600 still same , stopped resolving portal.bsnl.in and portal.bsnl.in but opens using https://117.239.179.10/

bingo600

@gurveer
Read my "above post" again , i asked something else.

What is the ip address of the PC , that is not resolving ?
Is it located within your Lan ip range ?

Gurveer

@bingo600 it ditto same as yours

bingo600

@gurveer
But there is MUCH more below

Show it all

Gurveer

@bingo600 ya its in lan ip range and non of device opens this site

bingo600

@gurveer
If you don't show the Full Resolver config, we have no way of helping you further.

See : https://forum.netgate.com/post/1064462

And in Status --> Services is unbound running (the Green Dot)

stephenw10

That. Also please show the full output of Diag > DNS Lookup against one of the failing sites.

That test checks all configured DNS servers, so Unbound resolving locally plus any you added in Sys > Gen. Setup plus anything passed by DHCP. But clients only use Unbound (by default).
So if Diag > Lookup succeeds but clients cannot resolve it's probably because Unbound is failing but some other server is allowing pfSense to resolve that. The full output would show it.

Steve

Gurveer

@bingo600 ya its in lan ip range and non of device opens this site also if its fine by you i have no problem giving remote access !
Screenshot 2022-10-04 at 12.09.25 AM.png Screenshot 2022-10-04 at 12.10.05 AM.png Screenshot 2022-10-04 at 12.15.41 AM.png Screenshot 2022-10-04 at 12.16.19 AM.png Screenshot 2022-10-04 at 12.17.41 AM.png