Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    DNS unresponsive to clients

    Scheduled Pinned Locked Moved DHCP and DNS
    30 Posts 5 Posters 3.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • RobbieTTR
      RobbieTT @johnpoz
      last edited by

      @johnpoz said in DNS unresponsive to clients:

      And why would you have it listen on your wan? You serving up dns off your wan interface? When it talks outbound, that traffic would be natted to your public IP anyway, etc.

      That was my thought too. As to why it included WAN - well that is the default set in pfSense.

      localhost makes much more sense and what I had set on previous non-pfSense routers. ๐Ÿ‘

      โ˜•๏ธ

      johnpozJ 1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator @RobbieTT
        last edited by

        @robbiett I think they have it listen on all as default because you never know what users might setup, or add etc. so with all its a given that it will listen on all interfaces..

        But you could prob have a discussion about outbound default to localhost...

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.8, 24.11

        RobbieTTR 1 Reply Last reply Reply Quote 0
        • RobbieTTR
          RobbieTT @johnpoz
          last edited by

          @johnpoz Setting the actual network interfaces for my 3 LAN/VLANs didn't go so well:

           2023-05-21 at 19.59.13.png

          โ˜•๏ธ

          johnpozJ 1 Reply Last reply Reply Quote 0
          • johnpozJ
            johnpoz LAYER 8 Global Moderator @RobbieTT
            last edited by johnpoz

            @robbiett where is your local host in your listen?

            listen.jpg

            Its hard to see can you not expand that box?

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.8, 24.11

            RobbieTTR 1 Reply Last reply Reply Quote 0
            • S
              SteveITS Galactic Empire @markster
              last edited by SteveITS

              @markster https://redmine.pfsense.org/issues/5413
              (Hope towards the bottom) ;)

              Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
              When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
              Upvote ๐Ÿ‘ helpful posts!

              1 Reply Last reply Reply Quote 0
              • RobbieTTR
                RobbieTT @johnpoz
                last edited by

                @johnpoz said in DNS unresponsive to clients:

                @robbiett where is your local host in your listen?
                Its hard to see can you not expand that box?

                Small walk of shame for me as I didn't know the box could be simply dragged to expand it. ๐Ÿคท

                 2023-05-22 at 08.42.44.png

                [Using Safari in screenshot]

                โ˜•๏ธ

                1 Reply Last reply Reply Quote 0
                • RobbieTTR
                  RobbieTT @johnpoz
                  last edited by RobbieTT

                  @johnpoz said in DNS unresponsive to clients:

                  I bind my outgoing to loopback.. That never goes down ;)

                  And why would you have it listen on your wan? You serving up dns off your wan interface? When it talks outbound, that traffic would be natted to your public IP anyway, etc.

                  @johnpoz Just to say thank-you and that I set my resolver as per your advice:

                  20230616-pfSense-DNS Resolver-Revised and Restricted Interfaces.png

                  โ˜•๏ธ

                  [yes, I nearly forgot about it...]

                  GertjanG 1 Reply Last reply Reply Quote 0
                  • GertjanG
                    Gertjan @RobbieTT
                    last edited by

                    @RobbieTT

                    For these two images - what about this one :
                    Trust your firewall.
                    Do not trust the admin.

                    Select for both : "All", save, apply, and call it a day.

                    Netgate delivered pfSense with the "both All" selected and said : that's "ok and save and useful".
                    Nowhere they say that you need (have to) to modify it.

                    If doubt : Contact Netgate and try to learn them 'networking' ๐Ÿ˜Š
                    ( and please, tell us how that went ๐Ÿ˜Š ๐Ÿ˜Š )

                    No "help me" PM's please. Use the forum, the community will thank you.
                    Edit : and where are the logs ??

                    RobbieTTR johnpozJ 2 Replies Last reply Reply Quote 0
                    • RobbieTTR
                      RobbieTT @Gertjan
                      last edited by

                      @Gertjan said in DNS unresponsive to clients:

                      Nowhere they say that you need (have to) to modify it.

                      If doubt : Contact Netgate and try to learn them 'networking' ๐Ÿ˜Š
                      ( and please, tell us how that went ๐Ÿ˜Š ๐Ÿ˜Š )

                      Dude, I followed sensible advice from @johnpoz. I don't need to bother Netgate - they put the option in their documentation:

                      The network interface(s) to which the DNS Resolver will bind when listening for queries from clients.

                      By default the DNS Resolver listens on every available interface and IPv4 and IPv6 address. This option limits the interfaces where the DNS Resolver will accept and answer queries. This can be used to increase security in addition to firewall rules.

                      โ˜•๏ธ

                      1 Reply Last reply Reply Quote 0
                      • johnpozJ
                        johnpoz LAYER 8 Global Moderator @Gertjan
                        last edited by

                        @Gertjan said in DNS unresponsive to clients:

                        Nowhere they say that you need (have to) to modify it.

                        Nope nothing saying you need to modify it.. You do you - if you like all, then use all.. Is that the most secure setup or best optimal setup? What I would say is its the "safest" setup for when yo don't know what the network setup will actually be.. So its a valid "default" setup.

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                        1 Reply Last reply Reply Quote 2
                        • First post
                          Last post
                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.