Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    DNS forwarders not validating

    Scheduled Pinned Locked Moved pfBlockerNG
    4 Posts 4 Posters 2.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • BartballonB
      Bartballon
      last edited by

      Hello there, I'm stuck with a question. So I am currently setting up an Addblock / content block system for our school. Our school runs 2 pfsense in the 2 buildings (192.168.200.1 and 192.168.201.1). We also run 2 AD DCs (172.16.0.0 and 172.20.0.0). So now I am trying to use pfBlockerNG to block things with DNSBL. So if I want to use this, I need to turn on Unbound DNS Resolver. But every time I do this, I get the following error on my domain controllers when I set my forwarders to my pfsense. "Unknown error while validating server". I also then notice that the blocks don't work. It is first time I am touching pfSense and this system, anyone who can help me?

      Big thanks in advance!6.png Screenshot 2023-06-19 234112.png Screenshot 2023-06-19 234213.png Screenshot 2023-06-19 234232.png

      johnpozJ S JonathanLeeJ 3 Replies Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator @Bartballon
        last edited by

        @Bartballon and what rules do you have on the interfaces the DCs would talk to pfsense on?

        How are they getting to your pfsense boxes for dns, when their networks 172.16 and 172.20 - what is routing the traffic to pfsense 192.168.x addresses?

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.8, 24.11

        1 Reply Last reply Reply Quote 0
        • S
          SteveITS Galactic Empire @Bartballon
          last edited by

          @Bartballon What John asked, but also there is a checkbox in the Windows DNS settings to use root servers if forwarders are unavailable, which is presumably why DNS is working for you.

          You may also want to block DNS Servers on the Internet, and/or DoH, if you want to force everyone to use the block lists.

          Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
          When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
          Upvote 👍 helpful posts!

          1 Reply Last reply Reply Quote 1
          • JonathanLeeJ
            JonathanLee @Bartballon
            last edited by JonathanLee

            @Bartballon hello let me try to help, how is the PfSense configuration set to resolve is it going to WAN 8.8.8.8 or 1.1.1.1 or the domain controller? Do you have a host override for a proxy also?

            Also I found
            "If unbound does not start correctly after entering custom options, add server: on a line at the top of the custom options text area."

            Ref:
            https://docs.netgate.com/pfsense/en/latest/services/dns/resolver-config.html

            I found another post on this with a working version of what you want to do, user was asking how to make it resolve faster. Maybe this will help?

            https://forum.netgate.com/topic/144091/ad-domain-controller-as-local-dns-forwarding-to-pfsense/10

            https://forum.netgate.com/topic/140346/forward-dns-queries-to-active-directory-dns-server/9

            Make sure to upvote

            1 Reply Last reply Reply Quote 0
            • First post
              Last post
            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.