Alias resolution somewhat cripple

lifeboy

I have noticed this before and would like to see if something can be done about this.

When an alias is added to pfSense, it seems that the name gets randomly resolved if there's more than one A record. An example:

$ dig  httpredir.debian.org

; <<>> DiG 9.10.3-P4-Ubuntu <<>> httpredir.debian.org
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 15753
;; flags: qr rd ra; QUERY: 1, ANSWER: 5, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;httpredir.debian.org.		IN	A

;; ANSWER SECTION:
httpredir.debian.org.	3464	IN	CNAME	static.debian.org.
static.debian.org.	164	IN	A	5.153.231.4
static.debian.org.	164	IN	A	149.20.4.15
static.debian.org.	164	IN	A	130.89.148.14
static.debian.org.	164	IN	A	128.31.0.62

;; Query time: 6 msec
;; SERVER: 192.168.121.1#53(192.168.121.1)
;; WHEN: Tue Sep 12 15:12:00 SAST 2017
;; MSG SIZE  rcvd: 144

So if I add httpredir.debian.org, it doesn't work most of the time in a firewall rule and I have to manually add each ip address to the alias to get the desired result.

If would be really beneficial if a simple lookup could be done when a name (instead of an ip) is added to an alias and the appropriate records added. Then one could have a refresh of the name (manually) or at startup or some other event to refresh records that have changed.

Mikrotik RouterOS has such a capability when one creates firewall address-lists. You enter the name and the system resolves the records and add one or more to the list as may be required. This really makes life so much easier.

Is something like this is the works or could it be added to a list of feature to be expanded?

thanks and regards

Roland

johnpoz

not sure what your talking about when create the alias all 7 IPs get listed.. See attached, there are IPv6 as well.

aliases are refreshed every 5 minutes.. unless you change it.
https://doc.pfsense.org/index.php/Aliases#Aliases_and_Hostnames

Maybe whatever your trying to do is not working because of the IPv6 addresses and your not allowing or blocking that in your rules and the client is using the IPv6

aliastable.png_thumb

jimp

If the DNS records for a host are returned randomly, any method you use will be an ugly hack. You can't rely on anything like aliases to resolve and get the same answer as clients.

Your best bet might be to set the alias refresh timer to lower than the TTL of a record and hope your cached result in unbound matches what is in the alias.

lifeboy

Thanks for your responses!

I rechecked the aliases vs the results of a dig / drill of the name and it does indeed add all the addresses correctly. I had quite some problems with this in the past, but I never really figured out how I could check the resolution. I didn't know about diagnostics | tables.

johnpoz

"and it does indeed add all the addresses correctly."

So then what is the exact problem your having?