DNS Resolver doesn't work

johnpoz

@orphen76 you could also have a issue where pfsense gets its dns from dhcp on its wan. And can use that to check for updates when resolving doesn't work. But your clients asking pfsense for dns, unbound would resolve out of the box, and possible that is blocked upstream.

stephenw10

So can we assume you can connect by IP from a LAN side client? Like 'ping 8.8.8.8' ?

When you add a bridge you may need more firewall rules. What rules have you added?

orphen76

@Gertjan I obtained a DHCP lease from pfSense,always
@stephenw10 Yes, Can I ping without issue, Rule on bridge only one, pass all
@johnpoz How can I check this?

johnpoz

@orphen76 well from your clients can you do a dns query?

use your fav tool, nslookup, dig, host, doggo, etc. etc.

To see if the resolver is working pfsense.. you could use the dns lookup tool, in pfsense diagnostic.. Do you see an answer from 127.0.0.1

orphen76

@johnpoz YES

johnpoz

@orphen76 yes to what? your clients are resolving, pfsense is resolving?

If you can ping an external ip, and you can resolve the some external fqdn to its IP.. What exactly is not working?

Gertjan

@orphen76

Was this a Yes, I did this from my device, like a PC, and I ran "nslookup" and it worked just fine.
Or Yes, .... but I did something else but I can't tell you what I did
Or Yes, I have these tools
Or Yes ....

?

orphen76

@johnpoz said in DNS Resolver doesn't work:

Do you see an answer from 127.0.0.1

yes

Gertjan

@orphen76

You should do the test on a device that is attached to the pfSense LAN.

Example : on windows PC :

nslookup www.google.com

example :

C:\Users\Gauche>nslookup www.google.com
Serveur :   pfSense.bhf.tld
Address:  2a01:cb19:dead:beef:92ec:77ff:fe29:392c

Réponse ne faisant pas autorité :
Nom :    www.google.com
Addresses:  2a00:1450:4006:80c::2004
          142.250.200.196

Btw : "2a01:cb19:dead:beef:92ec:77ff:fe29:392c" is my pfSense LAN IP.
Also known as "192.168.1.1" in the old days.

orphen76

@Gertjan said in DNS Resolver doesn't work:

nslookup www.google.com

nslookup www.google.com
Server: UnKnown
Address: 103.86.96.100

Risposta da un server non autorevole:
Nome: www.google.com
Address: 192.0.0.88

Gertjan

@orphen76 said in DNS Resolver doesn't work:

Address: 103.86.96.100

Who is that 103.86.96.100 ?
Not your pfSense, right ?

What was the DNS IP your PC got from pfSense (see the ipconfig /all command shown above )?
More something like 192.168.1.1, right ? wrong ?

edit : anyway, your PC got an answer : 192.0.0.88 so that must be Google. That's all a browser needs to connect to 'Google : that IP.
The thing is : that IP is, IMHO, not Google ...

johnpoz

@Gertjan said in DNS Resolver doesn't work:

The thing is : that IP is, IMHO, not Google ...

hahaha - yeah I would concur.. that is not google ;) hehah

stephenw10

That's a NordVPN DNS server. So your client might be using a VPN dircetly. Or you might have added it to pfSense etc....

Gertjan

@stephenw10

He ? what ? where is nordvpn coming from ?

johnpoz

If nord is involved yeah I would say your dns is borked.. They started intercepting a while back, per other threads..

That 103 address is a packethub IP.. But as so eloquently stated by @Gertjan 192.0.0.88 is not google.. hehehe, still giggling.. Love it!

stephenw10

https://www.reddit.com/r/nordvpn/comments/13ii3zk/nordvpn_dns_servers_resolve_googlecom_into_a/

Gertjan

@johnpoz said in DNS Resolver doesn't work:

would say your dns is borked.

Wasn't NordVPN intercepting 'all DNS' requests as seen in some recent forum threads ??
And now it is replying with Pure-BS ?!

@stephenw10 Don't need to go that far, we've got all the resources on board : https://forum.netgate.com/topic/186580/dns-suddenly-broken-on-some-vlans/60?_=1726676960650

johnpoz

@Gertjan yeah they were intercepting all dns from test had one user do, they were getting answer from 1.2.3.4, which sure and the hell is not providing dns.. So right there is smoking gun that interception and redirection is happening.

I wouldn't trust those idiots with anything.. VPN service intercepting something as basic as dns is not what they are suppose to be about.. Most people use a vpn to make sure their isp isn't seeing or intercepting their dns..

orphen76

@stephenw10 yes sory on a host.
below from a clean host:

nslookup www.google.com
Server: UnKnown
Address: 172.16.24.1

johnpoz

@orphen76 said in DNS Resolver doesn't work:

Server: UnKnown

that points to a problem to be honest, is that not pfsense? pfsense should always be able to resolve its own name.