Settings for the most responsive browsing?
-
@octopuss said in Settings for the most responsive browsing?:
I try to avoid anything Google like plague, so what else is out there that's fast and available in most countries? OpenDNS maybe?
What about : just resolve ?!!
The default DNS setup, the one that came with pfSense, with you adding nothing, will work just fine - out of the box. -
@gertjan Sure, but I have no idea what the defaults are, having changed a ton of settings since installing the thing :D
-
@johnpoz said in Settings for the most responsive browsing?:
server:
log-queries: yes
log-replies: yesSo what do I do with this? I have it set, but where do I go in the logs and what should I see?
-
@octopuss in the log section.. Let me enable logging, I don't leave it setup.. Lot of logs for no reason unless troubleshooting something.
edit:
Mar 13 05:50:21 unbound 8231 [8231:2] info: 192.168.9.100 www.raceface.com. A IN NOERROR 0.139835 0 91 Mar 13 05:50:21 unbound 8231 [8231:2] info: 192.168.9.100 www.raceface.com. A INThere is my client asking, and the response.
-
@johnpoz ok I don't know where this is.
All I found is Status-System Logs-System-DNS Resolver, where it looks like this:
-
@octopuss and what is it that your not understanding.. you see your client ask.. see the gdprcdn.b-cdn.net A IN, that is 1.100 asking for that..
Then above that you see where the reply and how long it took to lookup .004280 or 4ms
see there at the end where took 1.76 and 1.72 those taking long time to get answer
Most likely since you didn't get a response it was asked for multiple times..
I would prob run dnsbench against your ISP dns your using to see what sort of responses you get to random stuff being asked.. But if you asked your dns, and it took 1.7 seconds to get an answer.. There is nothing pfsense can do about that..
-
@johnpoz Your log looks completely different and is readable. What I have on my end makes no sense to me.
But this gets me nowhere anyway.I'll try connecting my PC directly to the AP and try different DNS servers too.
-
@octopuss its the same log..
I just did a copy of specific record as text..
I hid my work vpn info there - freaking stupid work laptop queries for that like crazy..
-
@octopuss said in Settings for the most responsive browsing?:
But this gets me nowhere anyway.
It shows that it took pfsense 1.7 seconds to get an answer for that fqdn.. That is on where your asking, not pfsense..
Look in your status for resolver - are you seeing timeouts, what is the RTT and RTO etc..
I resolve so I see all the ns I am talking to - you forward so you will only see where your forwarding too..
-
I have tried to replace the ISP's DNS servers with Cloudflare, and the resolution, as seen in the browser console, is anything from a few miliseconds to half a second.
I don't know, I guess this is just how it works.
I won't bother with it anymore. -
@johnpoz said in Settings for the most responsive browsing?:
I resolve so I see all the ns I am talking to - you forward so you will only see where your forwarding too..
What happens if I don't enable forwarding? I won't be able to specify what DNS servers to use, right? What's used in that situation then?
-
@octopuss said in Settings for the most responsive browsing?:
What's used in that situation then?
Unbound resolves... Which means it talks to the actual authoritative ns for whatever domain your looking for.
This is the default setting.. Works like this
Hey root server what is the NS for .com tld, ok thanks
Hey NS for .com, what is the NS for domain.com, ok thanks
Hey NS for domain.com what is the A record for www.domain.com
This info is cached.. It now knows the NS for any .com, it knows the ns for domain.com if you then go and say lookup otherthing.domain.com it will just directly as one of the authoritative NS for domain.com If you want to look up otherdomain.com it already knows the NS for .com and ask them for otherdomain.com
Once the NS for a domain are known, it will ask them directly for what your looking for, the only time it talks to roots is to look up the NS for another tld, it only talks to gltd servers when it needs to look up NS for a different domain that those servers know about, there are different gtld serves for all the tlds, ie .com, .net, .org, .info, etc.
Resolving has to happen somewhere to look up anything... if you forward to your ISP and he doesn't have it cached, it has to be resolved.. Either the isp has a resolver, or they have to forward to somewhere else, there has to be a resolver somewhere in the chain..
Maybe your isp dns resolving sucks, or maybe they are forwarding else where, and they resolve.. When you use unbound as a resolver you just cut out all the middle men, and just talk directly to the roots and the authoritative ns for what your wanting to look up.
-
@johnpoz I see. So if I don't enable forwarding, pfSense will choose a random DNS server it finds by some algorithm or what?
Cloudflare is, judging by what I can google up, the fastest and best, but unless I enable forwarding, I can't use it. That sounds like something noone wants? -
@octopuss said in Settings for the most responsive browsing?:
will choose a random DNS serve
There is nothing random about it..
The root servers hold all the info for the NS for the tlds
. 85063 IN NS e.root-servers.net. . 85063 IN NS g.root-servers.net. . 85063 IN NS k.root-servers.net. . 85063 IN NS m.root-servers.net. . 85063 IN NS j.root-servers.net. . 85063 IN NS i.root-servers.net. . 85063 IN NS d.root-servers.net. . 85063 IN NS a.root-servers.net. . 85063 IN NS f.root-servers.net. . 85063 IN NS l.root-servers.net. . 85063 IN NS b.root-servers.net. . 85063 IN NS c.root-servers.net. . 85063 IN NS h.root-servers.net.These global tld servers know about all the domains in .com
com. 172800 IN NS a.gtld-servers.net. com. 172800 IN NS b.gtld-servers.net. com. 172800 IN NS c.gtld-servers.net. com. 172800 IN NS d.gtld-servers.net. com. 172800 IN NS e.gtld-servers.net. com. 172800 IN NS f.gtld-servers.net. com. 172800 IN NS g.gtld-servers.net. com. 172800 IN NS h.gtld-servers.net. com. 172800 IN NS i.gtld-servers.net. com. 172800 IN NS j.gtld-servers.net. com. 172800 IN NS k.gtld-servers.net. com. 172800 IN NS l.gtld-servers.net. com. 172800 IN NS m.gtld-servers.net.These know about .org domains.
org. 3600 IN NS d0.org.afilias-nst.org. org. 3600 IN NS b2.org.afilias-nst.org. org. 3600 IN NS a2.org.afilias-nst.info. org. 3600 IN NS c0.org.afilias-nst.info. org. 3600 IN NS a0.org.afilias-nst.info. org. 3600 IN NS b0.org.afilias-nst.org.the NS for your raceface.com are
;; QUESTION SECTION: ;raceface.com. IN NS ;; ANSWER SECTION: raceface.com. 86400 IN NS ns3.linode.com. raceface.com. 86400 IN NS ns1.linode.com. raceface.com. 86400 IN NS ns5.linode.com. raceface.com. 86400 IN NS ns4.linode.com. raceface.com. 86400 IN NS ns2.linode.com. -
@johnpoz Sorry, I don't know anything about this. I have no idea what "talk directly to the roots" mean. Or root servers. I am not a networking guy.
I won't waste anymore of your time. Internet works, so I guess it's as good as it gets.
-
@octopuss if your having issues with your ISP dns, try one of the major player quad9, google, cloudflare.. Or just try resolving vs forwarding.
1.7 seconds to look up something from your ISP is a bit long..
