a few website are being blocked?
-
@mkubiak402 said in a few website are being blocked?:
i have the DNS set with
8.8.8.8 google
9.9.9.9 quad9.net
1.1.1.1 CloudflareIs that the answer to this question :
@stephenw10 said in a few website are being blocked?:
... what is that client using for it's upstream DNS server? That's what's failing to resolve it.
?
If you've set 8.8.8.8 9.9.9.9 1.1.1.1 on a client, then it will use any of these to get DNS anwers.
This means that pfSense is bypassed - or : is not involved at all in any DNS requests coming from this client.Still strange, because :
[23.01-RC][root@pfSense.mynetwork.tld]/root: dig @8.8.8.8 a2heaven.com +short 91.196.124.110 [23.01-RC][root@pfSense.mynetwork.tld]/root: dig @1.1.1.1 a2heaven.com +short 91.196.124.110 [23.01-RC][root@pfSense.mynetwork.tld]/root: dig @9.9.9.9 a2heaven.com +short 91.196.124.110In other words : when I ask 1.1.1.1 or 8.8.8.8 or 9.9.9.9 to resolve "a2heaven.com", they all have an answer for me.
Btw : If I want to know what my PC (or iPhone, or TV, or dindong, or whatever) is using as its DNS, I'll ask it : example :
C:\Users\Gertjan>ipconfig /all .......... Serveurs DNS. . . . . . . . . . . . . : 2a01:cb19:907:beef::1 192.168.1.1and guess what : 192.168.1.1 == pfSense (2a01:cb19:907:beef::1 is the other IP).
If you have entered 1.1.1.1 8.8.8.8 9.9.9.9 like this :
then tell us if you are forwarding or resolving.
In other words : did you check "DNS Query Forwarding" (on the Services > DNS Resolver > General Settings page )
?
-
-
@mkubiak402
The Resolver can also forward.
You didn't show what you've set here :
If you didn't check the "DNS Query Forwarding", you can safely remove 1.1.1.1 8.8.8.8 9.9.9.9 from the System >General Setup page, as they are not used / needed.
What do you see when you do this :
As you can see, my pfSEnse (== 127.0.0.1 = the resolver) took 200 msec to resolve a2heaven.com to "91.196.124.110".
If it didn't gave that answer, stop/de activate pfBlockernd-devel, and to the DNS lookup again.
-
Still check the DNS servers in use on the client itself. It may have something else configured there.
-
Yeah, @mkubiak402, don't forget to show the output of "ipconfig /all", or equivalent, as shown above.
-
-
Ok, so Unbound cannot resolve it. Do you have any sort of filtering for DNS queries setup there? pfBlocker DNSBL?
Since it appears to be a single IP address you could workaround this by just adding a host override for it. But that would break if the IP ever changed.
-
@stephenw10 said in a few website are being blocked?:
pfBlocker DNSBL
Well i have it installed now.. but this is an problem before that.
I am working on building new PFsense box and ill having to see if there is a change.
here is the block log its all my Wifes phone from her online games.
-
I saw in you image (first line) :
I also use the StevenBlack DNSBL in pfBlockerng-devel - let's try :
So, my unbound - the resolver (127.0.0.1) took 7 ms to answer 0.0.0.0 as this is for me the default when it found a host name 'krk.kargoo.com' that is listed on a DNSBL.
You don't have an answer, the Result block, so I presume unbound fails to resolve.
What do you see when you visit :
This should be a huge page with thousands of hostnames unbound resolved recently, depening a bit on how many devices you have on your LAN(s).
Can you also show what this page shows : Status >System Logs >System > DNS Resolver - the last 30 40 lines or so.
-
-
Is it because these are not actual hostnames here?
-
@terryzb do you have TLS enabled? If so try disabling it. If you are forwarding DNS disable DNSSEC.
-
Wrong tests always give wrong answers :
Good test :
krk.kargoo.com = does not exist.
The right colom doesn't say : fill in some random description.
It says :
Hostname
Enter the DNS Server Hostname for TLS Verification in the DNS Resolver (optional).= If you use TLS, enter the host name of 8.8.8.8 1.1.1.1 and 9.9.9.9
No TLS ? You can leave (should ?) these empty.
That will be :
dns.google one.one.one.one and dns9.quad9.net -
Yeah, you entered a url and it must be a hostname there.
But also that hostname doesn't resolve. Not a pfSense issue.
-
-
IDK I have done new Clean installs it works fine if i just use my Linksys router
can I sent you my backup settings?
its just strange that some odd webpages just don't work. I'll just have to deal with it or just though this thing in the trash.
-
So what exactly is not working at this point?
-
These :
are not needed at all.
For info : Internet worked just fine before these existed - and will work just fine when they go extinct. Keep the DNS Resolver settings page all to default, and DNS will work just fine.Only if your are sure that your ISP is filtering your DNS requests, you might considering DNS forwarding.
No "help me" PM's please. Use the forum, the community will thank you.
Edit : and where are the logs ?? -
a2heaven.com is not working. there is some others that I have gotten complaints about before too bout I did not note them down.
i live in a double and rent the other half main reason I'm using this is to split the networks so I can share the internet.
-
@gertjan said in a few website are being blocked?:
are not needed at all.
Exactly... Also that choice is bad anyway even if using them.. google doesn't filter while quad9 does. And so does that opendns one, and 76.76.2.0 is some sort of freedns - do they filter or not?
If your not forwarding those dns settings wouldn't be used by any client on your network, only pfsense if checking for say updates or packages, or trying to resolve something like ntp server or you click resolve an IP in the firewall log, etc.
If your going to forward, you should make sure all that your forwarding to either filter or don't filter.. And to be honest forwarding to different dns that filters differently is bad as well.. Does quad9 filter the exact same stuff that cloudflare does? I doubt it very much.
When you forward to more than 1 ns you have no idea which one might be used.. So they need to be doing the same stuff, be it filter or not filter, etc. If you ask googledns hey you get a response because not filtered, but you ask quad9 you don't get an answer because its filtered.. You really have no control over which one will be asked when, etc.
For all you know browser is using doh..
First step in troubleshooting any dns related problem is actually understanding what name server is being asked.. If your browser is using doh, or the client has their own dns set and not pointing to pfsense - what you have set in pfsense for dns be it forwarding or resolving has nothing to do with the clients problem.
