Error: dns_probe_started
-
@coxhaus ill try this config. But everything works fine with my config, just this random error happens eventually.
-
@Tzvia now i remember why i did this way.
All social media are blocked in pfBlocker. Some hosts need to have access to social media.
So what I did is: Hosts that can have access to social media, I use NAT to OpenDNS (those hosts dont need to resolve internal stuff). If I use ur configuration, pfBlocker will deny all access.
-
@guile said in Error: dns_probe_started:
@Tzvia now i remember why i did this way.
All social media are blocked in pfBlocker. Some hosts need to have access to social media.
So what I did is: Hosts that can have access to social media, I use NAT to OpenDNS (those hosts dont need to resolve internal stuff). If I use ur configuration, pfBlocker will deny all access.
PFBlocker doesn't really choose what to block; you do by the feeds you choose. I am running PFSense at home- and users yes do use stuff like Facebook, Twitter and I am using probably 28 different feeds, some DNSBL and some IP based. We have no problems here. All you have done was setup PFBlocker, then not use it by having everyone go from PFSense > AD DNS > an internet DNS provider, jumping OVER what you have set in PFSense/PFBlocker. That's not fixing the issue. If you use a feed that blocks social media, well, use another feed that doesn't, and add domains to the DNSBL whitelist as needed.
EDIT: on second read- you want to block some users but not others.... Realize that jumping OVER PFSense DNS with those users takes PFBlocker out of the equation entirely. -
@guile do you use IPv6 ? My ISP has not IPv6 so it's set to none. I noticed I had to add advanced options to DNS resolver for unbound to only resolve A records and ignore AAAA records. Even with it set to none for IPv6 on LAN and WAN interfaces the unbound was still resolving and handing out AAAA records.
Make sure to upvote
-
@JonathanLee said in Error: dns_probe_started:
set to none for IPv6 on LAN and WAN interfaces the unbound was still resolving and handing out AAAA records.
because AAAA records can be resolved over IPv4. if your client asks for AAAA then it will be resolved. Would depend on your client if it asks for AAAA, I found that firefox for example even when the client has no viable IPv6 GUA it will still ask for AAAA.
you can disable that in firefox with setting in about:config
network.dns.disableIPv6
Set it to true and firefox no longer asks for AAAA
I get it maybe the resource is local, and AAAA will resolve to some link local address? But what about when the client machine firefox is running doesn't even have a link-local IPv6 address.. Why would it ask for AAAA?
Connection-specific DNS Suffix . : local.lan Description . . . . . . . . . . . : Killer E2600 Gigabit Ethernet Controller Physical Address. . . . . . . . . : B0-4F-13-0B-FD-16 DHCP Enabled. . . . . . . . . . . : Yes Autoconfiguration Enabled . . . . : Yes IPv4 Address. . . . . . . . . . . : 192.168.9.100(Preferred) Subnet Mask . . . . . . . . . . . : 255.255.255.0 Lease Obtained. . . . . . . . . . : Friday, June 30, 2023 8:53:43 AM Lease Expires . . . . . . . . . . : Thursday, July 6, 2023 8:53:43 AM Default Gateway . . . . . . . . . : 192.168.9.253 DHCP Server . . . . . . . . . . . : 192.168.9.253 DNS Servers . . . . . . . . . . . : 192.168.3.10 NetBIOS over Tcpip. . . . . . . . : Enabled -
@Tzvia nah.. i NEED to block social media in my work. But some users can access. Thats why im using pfBlocker.
-
@JonathanLee i dont use ipv6.. i just set to none in the configuration. Ill try what u said.
-
@guile This is mine, I do have some redundant settings per johnpoz.
(now my DNS resolves only A records)I also block DoH with my proxy. Now it only resolves to A records.
-
This post is deleted! -
Just happened again. The problem is DNS related, but I can ping and nslookup Google:
-
@guile said in Error: dns_probe_started:
The problem is DNS related, but I can ping and nslookup Google:
well then its Not dns related. Its your browser, most likely trying to do doh that is the problem.. clearly dns is working if you can do a nslookup and ping the name and it gets an IP.
-
@guile notice what is resolved first it's a IPv6 you got to fix that in your resolver.
-
@johnpoz i mean.. the problem says: dns_probe_started. Thats why im supossing is DNS related.
I tested on all browsers: Chrome, Firefox, Opera and Edge.. all the same error. Maybe is DNS related, because im blocking DoH with pfBlocker.
pfBlocker > IP > IPV4:
DNSBL Safesearch:
-
@guile if you do a nslookup to pfsense IP and it resolves, ie answers your fqdn query. then how is it dns related - unless your browser is not using pfsense for its dns..
Unless your unbound is restarting and your browser asks, and fails, and by time you ask via your nslookup it has restarted. Look in your log, is unbound restarting a lot?
Do a query like this to see how long its been running.
[23.05.1-RELEASE][admin@sg4860.local.lan]/: unbound-control -c /var/unbound/unbound.conf status version: 1.17.1 verbosity: 1 threads: 4 modules: 2 [ validator iterator ] uptime: 94572 seconds options: control(ssl) unbound (pid 3856) is running... [23.05.1-RELEASE][admin@sg4860.local.lan]/:So my unbound has been running for 94500 seconds, or 26 some hours.. Which makes sense because I had restarted it yesterday a few times playing with something else for another thread.
If you weren't using doh, then blocking doh would have no effect.. If you were blocking doh and the browser was trying to use it - then it would always fail.. But from your ping and nslookup dns is working, so maybe its restarting a lot - which if your registering dhcp that can be a problem, etc
-
I had this same issue when I updated to the new PfSense. To resolve it I had to add in the custom settings in DNS resolver for unbound. It was like my IPv4 was trying to connect to IPv6 websites intermittently even with DoH blocked. That custom setting fixed it for me as I have no IPv6 from the ISP
-
My unbound status:
[2.6.0-RELEASE][admin@firewall.local.com]/root: unbound-control -c /var/unbound/unbound.conf status version: 1.13.2 verbosity: 1 threads: 2 modules: 2 [ validator iterator ] uptime: 7006 seconds options: control(ssl) unbound (pid 39208) is running...I restarted the service when the error ocurred. Ill keep checking the status using the command.
Im not using DoH, im just trying to block users to use DoH. All the configurations I posted, can I disable them all?
-
@JonathanLee ill try ur config. This config, right?
server:include: /var/unbound/pfb_dnsbl.*conf do-ip4: yes prefer-ip4: yes do-ip6: no prefer-ip6: no private-address: ::/0 dns64-ignore-aaaa: *.* do-not-query-address: :: do-not-query-address: ::1 do-not-query-address: ::/0 -
@guile said in Error: dns_probe_started:
uptime: 7006 seconds
So its only been running for not even 2 hours.. Did you on purpose restart it for something..
I would check that, next time you have a problem.. Did unbound just restart.. that should just run and run and run.. I have seen mine run for months without a restart, etc. My restarts when I restart it for say adding a host override or something, etc.
-
@johnpoz yea, I manually restarted when the error occurred. ill check the uptime, next time when the error appear. But probably is not the case, because when the error appears takes like 5 minutes to internet comes back. And a service restart takes like 10 seconds.
-
@guile add it into GUI under custom options inside DNS resolver towards the bottom. Let me know if it fixes it. For me all the sudden I had all my machines trying to connect to AAAA records (IPv6) again I only have IPv4 from my ISP, so it will not connect to any IPv6 urls. No big deal most all have IPv4
