DNS Query from Some Workstations Not Resolving

Gareth 0

This post is deleted!

Gertjan

@Gareth-0 said in DNS Query from Some Workstations Not Resolving:

From a specific Linux VM (172.17.20.250/24) it can ping the psfense device (172.17.20.1/24), but when I perform an nslookup I get the error:
root@pve:~# nslookup ibm.com
;; communications error to 172.17.20.1#53: timed out
;; communications error to 172.17.20.1#53: timed out
;; communications error to 172.17.20.1#53: timed out
;; no servers could be reached

172.17.20.1 is your pfSense, right ?

Check if the resolver is actually running;, this says something :

This is better :

[23.09.1-RELEASE][root@pfSense.bhf.tld]/root: ps ax | grep 'unbound'
....
60596  -  Ss       0:10.50 /usr/local/sbin/unbound -c /var/unbound/unbound.conf
....

and this checks what process is listing on port '53' :

[23.09.1-RELEASE][root@pfSense.bhf.tld]/root: sockstat -4 | grep ':53'
unbound  unbound    60596 5   udp4   *:53                  *:*
unbound  unbound    60596 6   tcp4   *:53                  *:*
unbound  unbound    60596 18  udp4   192.168.10.4:7656     150.171.16.34:53
avahi    avahi-daem 70288 13  udp4   *:5353                *:*

The first two lines tell me that unbound is listening on every interface, for IPv4 and IPv6, on port 53 using TCP and UDP.

The LAN firewall rules have to permit UDP (and TCP !!) traffic to port 53. The default LAN firewall rule will do the job.

If any of these conditions is false, no 'DNS' for you on LAN.

@Gareth-0 said in DNS Query from Some Workstations Not Resolving:

dig @1.1.1.1 ibm.com
;; communications error to 1.1.1.1#53: connection refused
;; communications error to 1.1.1.1#53: connection refused
;; communications error to 1.1.1.1#53: connection refused

Which means : from your device, you cant' reach "1.1.1.1".
Or no traffic to port '53' is allowed .....