Settings for the most responsive browsing?

Octopuss

Gertjan

These 5 examples show that DNS 'server' replies, or web server replies can take their time to come over to you. What your not seeing (and can't see) is the time the info took to reach that DNS or web server. When the requested info starts coming back; its loaded in a few msecs.

A friend of my sees the same thing, he is using a satellite connection (not Starlink).

Octopuss

@gertjan But what is the takeaway from that? Do I have a problem or are some sites simply behing too complicated networks or...?

Gertjan

@octopuss said in Settings for the most responsive browsing?:

Do I have a problem ...

Remove 'pfSense' ( and all the VM overhead) from the equitation for some tests.
Hook up your PC to your ISP connection directly - and re test.
And if possible : test with pfSense on real hardware - nearly any small ancient PC will dual NIC will do.

Octopuss

@gertjan I doubt virtualization plays any role, because the server is basically doing nothing most of the time, but yes, I'll try direct.
I don't have a spare PC though, so I can only try this.

johnpoz

@octopuss that raceface.com is a cname

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.raceface.com.              IN      A

;; ANSWER SECTION:
www.raceface.com.       86400   IN      CNAME   shops.myshopify.com.
shops.myshopify.com.    3600    IN      A       23.227.38.74

;; Query time: 146 msec
;; SERVER: 192.168.3.10#53(192.168.3.10)
;; WHEN: Mon Mar 13 04:52:50 Central Daylight Time 2023
;; MSG SIZE  rcvd: 91

Now do trace.. and since its a cname - you will have manually follow it.. Do you show where in the trace your having a problem?

But since your not resolving and forwarding - any time to get an answer for what you ask for is on who you forward to, or you connection to them.. If I query say quad9 for that I get..

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;www.raceface.com.              IN      A

;; ANSWER SECTION:
www.raceface.com.       43200   IN      CNAME   shops.myshopify.com.
shops.myshopify.com.    58      IN      A       23.227.38.74

;; Query time: 44 msec
;; SERVER: 9.9.9.9#53(9.9.9.9)
;; WHEN: Mon Mar 13 04:56:34 Central Daylight Time 2023
;; MSG SIZE  rcvd: 91

Pfsense can not answer your dns query any faster than it gets a reply.. Turn on logging of queries and replies in unbound..

This is in the custom options box of unbound.

server:
log-queries: yes
log-replies: yes

Octopuss

@johnpoz It's always the first time I open a website that's slow. I have no idea why. Also I restarted pfSense and raceface.com still loads instantly.
I guess this is way above what I am supposed to dig in.

Octopuss

Oh and btw what option am I supposed to use in "DNS Resolution Behavior"?

johnpoz

@octopuss said in Settings for the most responsive browsing?:

It's always the first time I open a website that's slow.

who exactly are you forwarding too? When you forward you are at the mercy of how fast they respond, there is nothing pfsense can do about that.

I would suggest you turn on logging so you can see how long it takes to get a response..

Once its been looked up then pfsense would cache it.. If it takes 2 seconds to get a response.. That is how long it takes, and pfsense can do nothing about that..

"DNS Resolution Behavior"?

Default is fine.. That is pretty meaningless to anything other than pfsense.. That has nothing to do with what happens when a client on your network asks pfsense for something.

Octopuss

@johnpoz I use my ISP's DNS server for logical reasons. They have a really good network and the servers are like 1km away, unlike whatever else I might be using, like Google DNS that are located in who knows what hole.

Octopuss

@octopuss Oh and I have no idea what unbound is and where to find it, sorry.

johnpoz

@octopuss said in Settings for the most responsive browsing?:

s DNS server for logical reasons

And its quite possible their dns just blows.. If it takes you 2 seconds to get a response asking for www.raceface.com for example.

Why don't you try just resolving vs forwarding.. Or forward to a major player quad9, cloudflare, google, etc..

When you forward how fast something is answered is completely on who you asked.. If they do not have it cached, they have to resolve it before they answer you, etc.

If you enable logging you can get an idea on how long it takes to get responses for stuff. you could use something like dnsbench to test how fast your isp dns is in general, etc.

It is the resolver in pfsense - the one you stated you have set to forward.

Gertjan

@octopuss
My fault.

'unbound' is the name of the program that does the DNS resolving, or forwarding.
Its like people that say 'apache' or 'nginx' when they talk about their web server.
Or "Microsoft Word 365" when they talk about their text editor.
Or, very known, 'iptables' when they talk about their firewall (on a Linux OS).

It's this process that listens in your LAB interfaces for DNS requests, and talks to the 'Internet' DNS servers, or the DNS servers you want to forward to, like the ISP DNS servers

Octopuss

@johnpoz Uh, ok, why is it called something else than what's in the web config I do not understand, but it's confusing as hell.

My other reasoning for using their DNS servers is that the "local" ones are most likely to work 24/7 even if there is an outage somewhere in the world and whatever else I might add might not be available.
But I am of course open to suggestions.
I try to avoid anything Google like plague, so what else is out there that's fast and available in most countries? OpenDNS maybe?

P.S. Why does raceface.com open immediatelly despite rebooting pfSense and the main switch? I thought that should reset it to the default slowness.

Gertjan

@octopuss said in Settings for the most responsive browsing?:

I try to avoid anything Google like plague, so what else is out there that's fast and available in most countries? OpenDNS maybe?

What about : just resolve ?!!
The default DNS setup, the one that came with pfSense, with you adding nothing, will work just fine - out of the box.

Octopuss

@gertjan Sure, but I have no idea what the defaults are, having changed a ton of settings since installing the thing :D

Octopuss

@johnpoz said in Settings for the most responsive browsing?:

server:
log-queries: yes
log-replies: yes

So what do I do with this? I have it set, but where do I go in the logs and what should I see?

johnpoz

@octopuss in the log section.. Let me enable logging, I don't leave it setup.. Lot of logs for no reason unless troubleshooting something.

edit:

Mar 13 05:50:21 	unbound 	8231 	[8231:2] info: 192.168.9.100 www.raceface.com. A IN NOERROR 0.139835 0 91
Mar 13 05:50:21 	unbound 	8231 	[8231:2] info: 192.168.9.100 www.raceface.com. A IN

There is my client asking, and the response.

Octopuss

@johnpoz ok I don't know where this is.
All I found is Status-System Logs-System-DNS Resolver, where it looks like this:

johnpoz

@octopuss and what is it that your not understanding.. you see your client ask.. see the gdprcdn.b-cdn.net A IN, that is 1.100 asking for that..

Then above that you see where the reply and how long it took to lookup .004280 or 4ms

see there at the end where took 1.76 and 1.72 those taking long time to get answer

Most likely since you didn't get a response it was asked for multiple times..

I would prob run dnsbench against your ISP dns your using to see what sort of responses you get to random stuff being asked.. But if you asked your dns, and it took 1.7 seconds to get an answer.. There is nothing pfsense can do about that..