help with Gateway/DNS configuration
-
For your clients to use 1.1.1.1 via unbound on pfsense. You would need to set 1.1.1.1 in your dns, do not let dhcp override and then set unbound to forwarder mode.
would i do this in the DNS forwarder or DNS resolver? in host overrides or domain overrides?
-
@fox95 its not a domain override... Out of the box pfsense uses unbound in resolver mode. If you want it to forward, then you have to set it to forward mode, and you set the dns you want it to forward to in the dns setup under general.
If your going to forward its good idea to uncheck do dnssec in the resolver. Since when you forward where you forward to either does dnssec or not. That setting becomes moot and can cause issues if left checked when forwarding.
-
@johnpoz said in help with Gateway/DNS configuration:
@fox95 its not a domain override... Out of the box pfsense uses unbound in resolver mode. If you want it to forward, then you have to set it to forward mode, and you set the dns you want it to forward to in the dns setup under general.
If your going to forward its good idea to uncheck do dnssec in the resolver. Since when you forward where you forward to either does dnssec or not. That setting becomes moot and can cause issues if left checked when forwarding.
ok, i'll skip this for now, this is not a issue just more of my wanting to understand how things work.
the more important issue is why the gateway is listed as offline. I will need some direction on the steps on how to fix this.
-
Yes, in System > Routing > Gateways edit the WAN_DHCP gateway and set a different monitoring IP. You could use 1.1.1.1 since you're using that for DNS anyway.
Add that DNS server in System > General Setup.
Steve
-
@fox95 if you manually to be online - does it work?
-
@johnpoz said in help with Gateway/DNS configuration:
@fox95 if you manually to be online - does it work?
yes, i checked both boxes (disable gateway monitoring and disable gateway monitoring action) that changed the gateway to online now(green).
but i have realised that I do have a DNS issue.
devices connected to the lan cannot get to the internet unless you manually configure DNS addresses in them. example in my iphone wifi setting i have to set DNS to manual and enter in 1.1.1.1 for it to get to any web sites.
and in my PC i have to set the ethernet adaptor DNS manaully for it to get to the internet.
so somewhere i missing a setting in the config
-
By default pfSense will pass it's own interface IP via DHCP for clients to use for DNS. Have you changed that?
And also by default the Unbound DNS service running in pfSense will answer those queries. have you changed the DNS Resolver settings from their defaults?
-
so in DNS resolver I checked "enable forwarding mode"
and now things appear to work as expected......without the manual dns entry in the devices.
not sure if this is right or not?
im still fuzzy on when to use the DNS resolver or DNS forwarder?
i guess my question is, these are settings i never changed so why dont the defaults of pfsense out of the box work for me?
-
@fox95 said in help with Gateway/DNS configuration:
im still fuzzy on when to use the DNS resolver or DNS forwarder?
Normally out of the box you should just resolve, this is pfsense default.. Everything should work out of the box, clients via dhcp would auto get handed pfsense as their gateway and dns. Unbound would resolve what you want to go to.
If you want to forward.. Is the only time you should have to change anything. That choice of resolving or forwarding is up to you.
If your going to forward, I would suggest you uncheck use dnssec support. It serves no purpose if your forwarding.
-
@johnpoz said in help with Gateway/DNS configuration:
If your going to forward, I would suggest you uncheck use dnssec support. It serves no purpose if your forwarding.
Yup, that^.
-
@fox95 said in help with Gateway/DNS configuration:
i guess my question is, these are settings i never changed so why dont the defaults of pfsense out of the box work for me?
Go here, and read the message at the top ;)
Additional information : A resolver like unbound, used by pfSense, uses these root servers. The list with their host names and, more important, their IPv4 and IPv6 addresses, are build ('compiled') into unbound.
These rarely (if ever) change. And if one doesn't answer, another is used. There are 13 of them, so pretty redundant.If pfSense (unbound) can't reach any of the 'root servers', you have a severe "connection to the Internet" issue.
You can test that yourself : ping, using their IP addresses, them all.
