DNS Forwarder Custom Options always gives "Invalid custom options"
-
I've tried using this to create interface-bound DNS forwarders using something like this:
server=x.x.x.x@vtnet0
server=x.x.x.x@vtnet1
server=x.x.x.x@vtnet2
server=x.x.x.x@vtnet3I ger the error message
"Invalid custom options"
I tried some of the examples from the documentation to ensure that it wasn't just my config., like max-ttl=30 or other settings. I think this is a bug, but wanted to check here first.
-
So you're adding those option in the DNS Forwarder (DNSmasq)?
What exactly are you trying to achieve?
What pfSense version are you running?
-
@stephenw10 Mostly, I wanted to use different forwarders per interface. My "guest" network and "kids" network uses policy on Cloudflare Zero Trust Gateway, which is a different IP from the "main" network, which has less restrictive content policy. I realize that I can do that with DNS settings on DHCP, but I also want to use the captive portal, which needs DNS Forwarder or DNS Resolver.
But this is beside the point.
Setting something like "max-ttl=30" or other settings results in the same thing. If it's a bug, then fine. I'll use something else. DNS Resolver maybe or perhaps Bind 9.
Thanks
-
Using 2.7.2-RELEASE btw
-
Ok so you want to forward different subnets to different upstream DNS servers?
Not sure I've seen that with DNSmasq but it should be possible to add custom options.
-
Forwarding to different servers doesn't work how users think it does.. Because of a common cache - I am not aware of dnsmasq doing different caches. So you run into this problem user A forwards to X and site abc.com is blocked. But user B forwards to Y and abc.com is allowed. So if B asks for abc.com first, then A asks it would be in the cache and they would get an answer.
Better solution is to just have user A use X directly, and B use Y directly vs trying to put a caching ns locally.
What are you wanting to accomplish by pointing different users or networks to different NSers?
-
Right.
However I will say it starts just fine for me in 2.7.2 with max-ttl=30 set:
[2.7.2-RELEASE][admin@t70.stevew.lan]/root: ps -auxwwd | grep dnsmasq root 68012 0.0 0.1 12752 2076 0 S+ 02:14 0:00.00 | `-- grep dnsmasq nobody 98016 0.0 0.2 17896 4128 - I 02:11 0:00.00 |-- /usr/local/sbin/dnsmasq -C /dev/null --port=5353 --no-resolv --all-servers --max-ttl=30 --dns-forward-max=5000 --cache-size=10000 --local-ttl=1The option is added correctly.
I don't think that 'servers' option does what you think it does either.
You probably want to use views in Unbound.
-
@johnpoz I'm not really looking for a solution to the issue. What I'm trying to do should work according to the documentation for DNSMasq. I really want to know if what I'm experiencing is a bug or something else, because it looks like a bug, especially when using more benign examples.
-
@stephenw10 Is there a way to tell exactly what it doesn't like? I am wondering if it's a browser issue or something else like that that is messing up the line ending or some odd issue like that. I'll try Edge and FF to see if lets me edit the same thing. It really does look like a bug though because adding max-ttl or similar settings should be benign.
-
@stephenw10 Doesn't look like a browser issue, either.
-
@blaize what exactly are you putting in because per the man page for dnsmaq
The optional string after the @ character tells dnsmasq how to set the source of the queries to this nameserver. It should be an ip-address
I set this and it works
-
Man page says this:
--server=[/[<domain>]/[domain/]][<server>[#<port>]][@<interface>][@<source-ip>[#<port>]]
@interface is the name of the interface.
But that's not the problem. It doesn't matter what I put in. I get that "not valid" error message.
-
@blaize vtnet0 that is a proxmox thing is it not? That is sure not an interface name you would see on pfsense on hardware.
As @stephenw10 showed it works with that simple max-ttl=30 command.. And it works for me using your command and a source IP. Guess I could try it with the interface name.
So it is not working with interface name on 2.7.2, I tried with actual interface name em0, tried with LAN, etc. But that server option works just fine IP address. Possible pfsense is only parsing for IP and not the interface name?
But your saying you can not even get max-ttl=30 working. Where the option box is clear and and only the max-ttl=30 in there?
[2.7.2-RELEASE][admin@test.mydomain.tld]/root: ps -auxwd | grep dnsmasq nobody 3335 0.0 0.5 17900 4568 - I 23:16 0:00.00 |-- /usr/local/sbin/dnsmasq -C /dev/null --no-resolv --all-servers --max-ttl=30 --server=8.8.8.8@192.168.9.34 --dns-forward-max=5 root 55093 0.0 0.0 436 264 0 R+ 23:17 0:00.00 | `-- grep dnsmasq [2.7.2-RELEASE][admin@test.mydomain.tld]/root:I can't duplicate that problem, it works with max-ttl=30 no problem.. But yeah its not taking name for the interface, but it works with IP just fine.
Not sure why your having issues with just the max-ttl, I tried adding spaces in front, after and it still worked, blank line in front even. Your on 2.7.2 right.. Yeah that is what running test on..
Shows its running
[2.7.2-RELEASE][admin@test.mydomain.tld]/root: dnsmasq -v Dnsmasq version 2.89 Copyright (c) 2000-2022 Simon KelleyI tired running the command manually
[2.7.2-RELEASE][admin@test.mydomain.tld]/root: /usr/local/sbin/dnsmasq -C /dev/null --no-resolv --all-servers --max-ttl=30 --server=8.8.8.8@em0 --dns-forward-max=5 dnsmasq: bad command line options: interface binding not supportedAnd it doesn't like using name.. But if use IP it takes it
[2.7.2-RELEASE][admin@test.mydomain.tld]/root: /usr/local/sbin/dnsmasq -C /dev/null --no-resolv --all-servers --max-ttl=30 --server=8.8.8.8@192.168.9.34 --dns-forward-max=5 [2.7.2-RELEASE][admin@test.mydomain.tld]/root:That sort of says it not just a parsing of the options box issue.
-
Mmm, that looks like the issue.
But even if it did work that option would simply tell dnsmasq to use em0 when connecting out to 8.8.8.8. It does not tell it to forward queries from em0 to 8.8.8.8.
-
@stephenw10 true, but just because option doesn't do what he thought it did is not really relevant to his issue. Curious what he has going on that he can't do max-ttl even? Unless he hasn't really tried that all by itself?
-
I think it is a bug. I stopped the daemon in the UI and ran the command in the console like it supposed to be my adding --max-ttl to the command.
/usr/local/sbin/dnsmasq -C /dev/null --rebind-localhost-ok --stop-dns-rebind --no-resolv --server=2600:1701:44d:6000::1 --server=192.168.1.254 --all-servers --dns-forward-max=5000 --cache-size=10000 --local-ttl=1 --max-ttl=30
Works fine. Something about the UI is not taking that parameter. It does not appear to be an issue with dnsmasq per se, rather the UI/backend trying to validate the option before starting the daemon.
-
@johnpoz All that to say, the --server parameter is supposed to specify the upstream server for a filter (ip address, domain name, interface, etc.) while everything else is local unless you suppress it. According to the docs:
"Specify upstream servers directly. Setting this flag does not suppress reading of /etc/resolv.conf, use --no-resolv to do that. If one or more optional domains are given, that server is used only for those domains and they are queried only using the specified server. This is intended for private nameservers: if you have a nameserver on your network which deals with names of the form xxx.internal.thekelleys.org.uk at 192.168.1.1 then giving the flag --server=/internal.thekelleys.org.uk/192.168.1.1 will send all queries for internal machines to that nameserver, everything else will go to the servers in /etc/resolv.conf."
But as I said, my problem looks more like an issue with the UI itself. I'm not sure what's going on there.
-
What exactly does your custom options field look like? I can't replicate the issue here in 2.7.2.
-
@stephenw10 nor can I.. And I tried all kinds of weirdness in how I put max-ttl=30 in the box.. blank lines before it, spaces before and after it etc.. It always took it just fine.
-
@stephenw10 Here's the screenshots.
