Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    DNS and ISP provider

    Scheduled Pinned Locked Moved DHCP and DNS
    44 Posts 5 Posters 2.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • A
      Antibiotic @The Party of Hell No
      last edited by

      @The-Party-of-Hell-No Yea but me using vpn only for one interface also using other interface without vpn. But anyway after did forwarding to mullvad dns in general setting and set tls over dns. Outgoing IN DNS RESOLVER set to only local Inernet start working.

      pfSense plus 24.11 on Topton mini PC
      CPU: Intel N100
      NIC: Intel i-226v 4 pcs
      RAM : 16 GB DDR5
      Disk: 128 GB NVMe
      Brgds, Archi

      T 1 Reply Last reply Reply Quote 0
      • T
        The Party of Hell No @Antibiotic
        last edited by The Party of Hell No

        @Antibiotic
        You are making progress - I have to post my own difficulties with DNS so I can try and resolve my own thinking.

        There are ways to make multiple openvpn interfaces and I am sure Mullvad allows this. If it is wireguard you can do that also - just not as easy.

        When I made multiple openvpn interfaces I copied the first interface and just changed the "Server Host or Address" to another server provided by the vpn service and save.

        Another thing if you want to use both mullvad DNS servers - in case one goes down - just add it as another DNS server. The only time you run into problems if you try to send it out the same gateway. if you do not specify a gateway it will allow you to add the second.

        Not sure if this is correct - I wait to be corrected, By only selecting the pfsense dns server 127.0.0.1 if it cannot resolve there is no higher DNS server to refer to.

        A 2 Replies Last reply Reply Quote 0
        • A
          Antibiotic @viragomann
          last edited by

          @viragomann said in DNS and ISP provider:

          Anyway, I saw a thread here, where an ISP blocked the DNS root servers

          Oh, this is answer for blocking, i think

          pfSense plus 24.11 on Topton mini PC
          CPU: Intel N100
          NIC: Intel i-226v 4 pcs
          RAM : 16 GB DDR5
          Disk: 128 GB NVMe
          Brgds, Archi

          1 Reply Last reply Reply Quote 0
          • A
            Antibiotic @The Party of Hell No
            last edited by Antibiotic

            @The-Party-of-Hell-No said in DNS and ISP provider:

            There are ways to make multiple openvpn interfaces

            What the reason? Like a back up server in case main is felt down? But in this case you need all time to make new route to this gateway again?

            2c02e602-3321-46dc-9fc6-d3155d275657-image.png

            4807cce0-53d6-453b-993a-3dcf2f880be4-image.png

            pfSense plus 24.11 on Topton mini PC
            CPU: Intel N100
            NIC: Intel i-226v 4 pcs
            RAM : 16 GB DDR5
            Disk: 128 GB NVMe
            Brgds, Archi

            johnpozJ 1 Reply Last reply Reply Quote 0
            • johnpozJ
              johnpoz LAYER 8 Global Moderator @Antibiotic
              last edited by

              @Antibiotic yeah you can create failover, vpn is just another wan interface as far as pfsense is concerned. So yeah if you loose connectivity to a specific pop you could use another one you have setup.

              https://docs.netgate.com/pfsense/en/latest/multiwan/load-balance-and-failover.html

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.8, 24.11

              A 1 Reply Last reply Reply Quote 0
              • A
                Antibiotic @The Party of Hell No
                last edited by

                @The-Party-of-Hell-No said in DNS and ISP provider:

                Another thing if you want to use both mullvad DNS servers - in case one goes down - just add it as another DNS server

                They are use anycast, only one is ok. If he is going down the next one close to your location will use!

                pfSense plus 24.11 on Topton mini PC
                CPU: Intel N100
                NIC: Intel i-226v 4 pcs
                RAM : 16 GB DDR5
                Disk: 128 GB NVMe
                Brgds, Archi

                1 Reply Last reply Reply Quote 0
                • A
                  Antibiotic @johnpoz
                  last edited by Antibiotic

                  @johnpoz So, I have 3 Nic's and two of them use VPN interface and one use WAN interface. This setting will correct?

                  ea2529c5-a911-4e44-bde0-7e26cdb2194a-image.png

                  or How to setup only failover for VPN only inetfaces?
                  adjust WAN to never? But in this case will WAN interface even use for non VPN nic?

                  pfSense plus 24.11 on Topton mini PC
                  CPU: Intel N100
                  NIC: Intel i-226v 4 pcs
                  RAM : 16 GB DDR5
                  Disk: 128 GB NVMe
                  Brgds, Archi

                  johnpozJ 1 Reply Last reply Reply Quote 0
                  • johnpozJ
                    johnpoz LAYER 8 Global Moderator @Antibiotic
                    last edited by

                    @Antibiotic of the top of my head no that wouldn't be right.. If your going to policy route out some vpn connection(s) those would be your gateway group you setup.. Your normal wan would not be in that group.

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                    A 1 Reply Last reply Reply Quote 0
                    • A
                      Antibiotic @johnpoz
                      last edited by Antibiotic

                      @johnpoz Misunderstanding, WAN should not appear in group or should set to never?In case set up failover for OpenVPN and second question this spare VPN gateway will route auto, because me set NAT gateway and LAN gateway to first VPN gateway?

                      pfSense plus 24.11 on Topton mini PC
                      CPU: Intel N100
                      NIC: Intel i-226v 4 pcs
                      RAM : 16 GB DDR5
                      Disk: 128 GB NVMe
                      Brgds, Archi

                      T 1 Reply Last reply Reply Quote 0
                      • T
                        The Party of Hell No @Antibiotic
                        last edited by

                        @Antibiotic
                        The Wan can be used, however the purpose of the VPN Gateways is to see all traffic is routed out the vpn tunnels. So if this is your intent the WAN_DHCP should be never. Adjust the two VPN's to Tier 1 and Tier 2.

                        When the Gateway Group is created, return to the LAN rules page, go to the bottom to the default allow to any rule. Using the edit button open it up, scroll down and click on the advanced options and scroll down to Gateway, it probably says WAN_DHCP click on the down arrow and select the Gateways Group you created and save. This routes the LAN out the Gateways Group rather than the WAN.

                        1 Reply Last reply Reply Quote 0
                        • GertjanG
                          Gertjan @Antibiotic
                          last edited by

                          @Antibiotic said in DNS and ISP provider:

                          to be in Europe

                          Can you be more precise ?
                          In Europe, there are places where 'entities' intercept DNS. I think about schools, prisons, and some hotel owners using pfSense 😊
                          All the other can not exist, as no one would chose them as an ISP.
                          And a VPN ISP is yet another ISP like supplier.

                          No "help me" PM's please. Use the forum, the community will thank you.
                          Edit : and where are the logs ??

                          A 1 Reply Last reply Reply Quote 0
                          • A
                            Antibiotic @Gertjan
                            last edited by

                            @Gertjan In Europe. it mean me like a simple user at home whom censuring simple city ISP according simple stupid goverment

                            pfSense plus 24.11 on Topton mini PC
                            CPU: Intel N100
                            NIC: Intel i-226v 4 pcs
                            RAM : 16 GB DDR5
                            Disk: 128 GB NVMe
                            Brgds, Archi

                            GertjanG 1 Reply Last reply Reply Quote 0
                            • GertjanG
                              Gertjan @Antibiotic
                              last edited by

                              @Antibiotic

                              If your ISP is intercepting / doing things with your DNS traffic, then you have a good reason to use a VPN, or DNS Forward over TLS.

                              But, because it's Europe, I wouldn't be a client of this ISP in the first place.

                              No "help me" PM's please. Use the forum, the community will thank you.
                              Edit : and where are the logs ??

                              A 1 Reply Last reply Reply Quote 0
                              • A
                                Antibiotic @Gertjan
                                last edited by

                                @Gertjan MullvadVPN fine for privacy, I do not like VPN whom belong to KAPE alienses, like ExpressVPN for example

                                pfSense plus 24.11 on Topton mini PC
                                CPU: Intel N100
                                NIC: Intel i-226v 4 pcs
                                RAM : 16 GB DDR5
                                Disk: 128 GB NVMe
                                Brgds, Archi

                                T 1 Reply Last reply Reply Quote 0
                                • T
                                  The Party of Hell No @Antibiotic
                                  last edited by

                                  @Antibiotic
                                  Ignorant American - what is "KAPE alienses?"

                                  A 1 Reply Last reply Reply Quote 0
                                  • A
                                    Antibiotic @The Party of Hell No
                                    last edited by Antibiotic

                                    @The-Party-of-Hell-No
                                    Formerly know as Crossrider

                                    the notorious creator of some pernicious data-huffing ad-ware, Crossrider. The UK-based company was cofounded by an ex-Israeli surveillance agent and a billionaire previously convicted of insider trading who was later named in the Panama Papers. It produced software which previously allowed third-party developers to hijack users' browsers via malware injection, redirect traffic to advertisers and slurp up private data.

                                    You can check : https://www.kape.com/
                                    What vpn belong to this

                                    Now, they are promote yourself as Privacy Is Our Priority)))) Funny
                                    Ex company which developed malware now doing VPN services)))

                                    pfSense plus 24.11 on Topton mini PC
                                    CPU: Intel N100
                                    NIC: Intel i-226v 4 pcs
                                    RAM : 16 GB DDR5
                                    Disk: 128 GB NVMe
                                    Brgds, Archi

                                    T 1 Reply Last reply Reply Quote 0
                                    • T
                                      The Party of Hell No @Antibiotic
                                      last edited by The Party of Hell No

                                      @Antibiotic thank you for the information. Better than Google and private.

                                      Wow, very interesting, multiple vpn providers besides expressvpn. Hokey web site.

                                      A 1 Reply Last reply Reply Quote 0
                                      • A
                                        Antibiotic @The Party of Hell No
                                        last edited by

                                        @The-Party-of-Hell-No
                                        Yep))) The world is crazy

                                        pfSense plus 24.11 on Topton mini PC
                                        CPU: Intel N100
                                        NIC: Intel i-226v 4 pcs
                                        RAM : 16 GB DDR5
                                        Disk: 128 GB NVMe
                                        Brgds, Archi

                                        1 Reply Last reply Reply Quote 0
                                        • First post
                                          Last post
                                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.