Pfsense and hostname resolution

rjcab

@viragomann said in Pfsense and hostname resolution:

DNS Query Forwarding

I did everything, but same issue :(

rjcab

@johnpoz
My conf of dns resolver

<unbound>
	<enable></enable>
	<dnssec></dnssec>
	<active_interface>all</active_interface>
	<outgoing_interface>all</outgoing_interface>
	<custom_options>c2VydmVyOmluY2x1ZGU6IC92YXIvdW5ib3VuZC9wZmJfZG5zYmwuKmNvbmY=</custom_options>
	<hideidentity></hideidentity>
	<hideversion></hideversion>
	<dnssecstripped></dnssecstripped>
	<port></port>
	<tlsport></tlsport>
	<sslcertref>65d11843d78d1</sslcertref>
	<regdhcpstatic></regdhcpstatic>
	<system_domain_local_zone_type>transparent</system_domain_local_zone_type>
</unbound>

Yes I use

johnpoz

@rjcab do you have it set to register static?

this says you don't

rjcab

but when I choose DNS Query ForwardingEnable Forwarding Mode I got:

The following input errors were detected:

At least one DNS server must be specified under System > General Setup to enable Forwarding mode.

rjcab

:-)

johnpoz

@rjcab ok - if your in forwarding mode, you have to have something to forward too..

rjcab

@johnpoz

I follow the advice :-)

johnpoz

@rjcab well that is some bad wording it seems.

If you want pfsense to ask 8.8.8.8 for dns, that is forwarding mode, and yes your 8.8.8.8 needs to be in dns settings. Unbound in forwarding mode - and turn off dnssec in unbound.. Using dns when you forward is going t be nothing but problems.

Clients should be asking pfsense for dns, you would not hand the clients 8.8.8.8 in dhcp. by default dhcp hands out pfsense on that interface to clients for dns.

That settings is for pfsense itself, and has nothing to do with clients on your network.

rjcab

@johnpoz thanks for the clarification. So new am a bit lost, I follow only your advice but not working so far.
When I look at what I want it seems very easy but actually tricky to configure :(

Gertjan

@rjcab said in Pfsense and hostname resolution:

When I look at what I want it seems very easy but actually tricky to configure :(

Starting from a pfSense with 100 % default settings :

don't activate the new KEA DHCP server - make sure that ISC DHCO is active. [ so basicly, do nothing ]
option A) On the unbound / resolver main settings page, make sure this option is set :

(the first DHCP Registration)

Or, Option B) don't cehck "DHCP Registration", as Static DHCP is already checked : add for every device a DHCP MAC Lease like this :
On the DHCP server page, at the bottom.

And now you're good.
Remember : don't switch to KEA.

Notice : don't need to forward - why would you ? (can you tell me why you think you have to forward to some DNS server like 8.8.8.8 ? ) no need to add 1.1.1.1 or 8.8.8.8 etc.
Everything works

rjcab

Well done :-)
I missed that

johnpoz

@rjcab what are you doing normal dhcp, or your previous posted image showed static reservations. You do not need to register dhcp if your doing reservations for all your devices.

This is a reservation, and they are loaded when unbound starts..

And they will resolve be it the client is on or off, or has gotten its reservation or not..

Now if you want to resolver xyz.yourdomain.tld that is some dhcp client that you have not set a reservation for - then yes you would have to register dhcp clients.

Leon Straathof

@johnpoz I did come here too when my config went to shit. I changed several configurations and then FQDN just broke and also DNS registrations between different networks. Why the hell do they scare you too go to KEA when the damn thing is not finished at all. Because i did other configuration in custom options i did think it was me that made a mistake in configuration and pulled my hair out for 2 hours. But it works out to be pfSense devs pushing shit out that ain't ready yet.

rjcab

thanks a lot for your support

rjcab

Now I have another issue:

I got 502 Bad Gateway, nginx message so I did 16) Restart PHP-FPM and it works for several minutes and then down again.
I went to the log files and I saw a lot of:

could not connect to /var/run/php-fpm.socket pfsense

I found on internet and some guys are talking about ethernet drivers. I have one interface LAN embedded with the NUC and I have an USB ethernet plug (WAN).

 WAN (wan)       -> ue0        -> v4: 192.168.10.253/24
 LAN (lan)       -> re0        -> v4: 192.168.1.1/24

When I unplug the usb it seems working. The USB plug is well recognised.

If you have an idea :-)

rjcab

Hello,

One again. My previous post, I don't know but is work with a fresh install except for DNS Resolver.

I did as below:

If I remove the DNS 8.8.8.8 because it cannot resolve IP/Hostname I don't have internet anymore but hostname resolving works.

I one again made a mistake :(

SteveITS

@rjcab if you enable forwarding you need to uncheck the option to use DNSSEC.

Gertjan

@rjcab said in Pfsense and hostname resolution:

except for DNS Resolver

Why ?
Ok, it's a free world, but why do you have to give all your DNS requests to Alphabet ?
What's in it for you ??

Also, Netgate decided to use the Resolver and made it resolve ... because that's what is best since the invention of DNS way back, in the last century. If any (commercial of not) other resolver was better, they would have made it 'default'. Notice this : they didn't. And I trust their choice.
Better : 8.8.8.8 is a ... a resolver. So why would a resolver (put in forwarding mode) has to ask a resolver what it can do itself ?

Again : forwarding isn't bad, and I can image their are for some scenarios even some advantages.
But out of the box, DNS of pfSense works fine, and you get the free DNSSEC as a bonus.

So, why ?

rjcab

I haven't explained correctly.

I am newbie with pfsense and I just want to be able to resolve hostname within my LAN.
with the above conf it doesn't work :(

johnpoz

@rjcab well no duh... How would 8.8.8.8 know about your local resources?

If you want to resolve your local stuff - you need your client to point to pfsense for dns.. So you can register your static/reservations of your dhcp clients. Or manually create records.. Then you can have unbound/dnsmasq forward or resolve for your internet stuff. But pointing your clients to 8.8.8.8 or any other external dns is never going to be able to resolve your local stuff.

Remove that from your dhcp options, let your clients renew their lease so they point to pfsense IP for dns - then you will be able to resolve local resources.