Internally route devices to WAN

johnpoz

@VioletDragon dude here.. this took 30 seconds to setup..

Only devices on my 192.168.3 network get back the 81 address I put in, stuff on my 192.168.9 network gets back the actual public IP.

This is basic to setup and basic to test with a simple query with your fav dns tool, dig, host, nslookup doggo, etc..

Do your clients need to resolve something else in this domain? Static zone type would not be correct then - you would use a transparent zone type most likely, etc.

And it sure is not going to break pfblocker.. Unless unbound doesn't actually start because you have a typo in your commands or something.. But if you do - it would warn you when you save, etc.

maybe what your using to see what gets looked up isn't using pfsense for dns? Are you testing with some browser using doh? Does your local client have it cached?

VioletDragon

@johnpoz yes it works but all sub domains under that domains no longer work, I have more subdomains under that domain. Pfblockerng stops working on devices under the VLAN I have views configured with.

How do you do transparent views?

johnpoz

@VioletDragon see where its static after the domain name, set it to transparent.

I don't use pfblocker to block anything, I use it to create lists - if there is something weird with views and pfblocker I am not aware of it.. But that would be pfblocker issue.. This is just simple view.. All pfblocker does is put records into unbound.. A simple view wouldn't have anything to do with that.

edit: here so when I was static I couldn't lookup another record in that zone, that wasn't a local record.. So I set the zone type to transparent and now can lookup another RR in that domain from public

VioletDragon

@johnpoz Yeah I change Static to transparent but same problem, Subdomains under that domains no longer work. Could be a DNS Caching problem maybe will have a another look.

johnpoz

@VioletDragon what record are you trying to lookup?? I just did example test with ftp that returned IP.. see my edit above

VioletDragon

@johnpoz I have zabbix running under a subdomain with zabbix.violetdragonsnetwork.co.uk but with the view in place it resolves that subdomain.violetdragonsnetwork.co.uk straight to the WAN IP does this for other domains too that I am hosting.

johnpoz

@VioletDragon this view has ZERO to do with that domain, that is not a subdomain of this domain.. That is completely different domain, it would have ZERO to do with what view you created for mailview domain.

If you want to do something sim with that domain, then create another view..

VioletDragon

@johnpoz well it affects all the other domains under that VLAN. So no idea it is doing stuff it shouldn't be i know that for sure whether it is a bug or not but all internal stuff is all being routed to that WAN IP when the View is in place.

johnpoz

@VioletDragon said in Internally route devices to WAN:

well it affects all the other domains under that VLAN

No it doesn't not sure what you have done exactly.. But this is simple view that says have if a client asks me for something in domainx.tld and he comes from my access list - hand this record vs looking it up.. It has zero to do with any other dns that the client might ask for..

Here - my 192.168.3 box that view would effect, looking up other shit no problem

if you need it to look up other stuff that is in the same domain from public, ie outside the local-data you put in the view, then set it as transparent vs static.

VioletDragon

@johnpoz This is what I added as shows,

access-control-view: 10.10.10.0/24 mailview
view:
name: "mailview"
local-zone: "mail.violetdragons.co.uk" transparent
local-data: "mail.violetdragons.co.uk. 3600 IN A 81.150."

I tested with local-zone: "violetdragons.co.uk" transparent this worked for mail how ever a server which resolves to violetdragons.co.uk was broken, browser kept saying this page can't be resolved although dig in Linux how it resolves to 81.150. I changed to mail.violetdragons.co.uk which fixed the server which resolves to violetdragons.co.uk.

However other Domains were affected on my phone. It is very strange how other domains were affected.

johnpoz

@VioletDragon said in Internally route devices to WAN:

It is very strange how other domains were affected.

Yeah it is strange because that simple view has zero to do with other domains - ZERO..

Your zone and data there is WRONG btw.. the zone would be violetdragons.co.uk, the RR mail.violetdragons.co.uk. is in that zone..

As to not resolving that its because it doesn't resolve on the public internet

;; QUESTION SECTION:
;violetdragons.co.uk.           IN      A

;; AUTHORITY SECTION:
co.uk.                  3600    IN      SOA     dns1.nic.uk. hostmaster.nominet.org.uk. 1315457221 900 300 2419200 10800

Did you create a local record in unbound for it? with either a host override, or a local-data record? If you want your local clients to resolve it?

VioletDragon

@johnpoz hi yes that domain doesn’t exist they are just examples.

johnpoz

@VioletDragon well I can not help you figure out what is going on if I can not actually see what resolves or doesn't resolve public, etc.

This is pretty basic stuff. I have gone over explicit examples of how to use a view to resolve something different for specific IP or network, etc.

Without some actual something to work with so I could see what your actually running into, I can not help you.. PM the actual info if you don't want to post it here..

VioletDragon

@johnpoz yeah sorry just a bit worried of sharing information I will PM information over to you if that’s okay. Will be later on this afternoon.

Regards.