Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Logging DNS queries

    Scheduled Pinned Locked Moved DHCP and DNS
    110 Posts 7 Posters 11.6k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • johnpozJ
      johnpoz LAYER 8 Global Moderator @Octopuss
      last edited by johnpoz

      @Octopuss really odd.

      But if you set to all on network and either just all or wan on outbound it works?

      edit: if network set to all, and it works or both set to all - that is a viable setup. And what it is out of the box. So if that works, and you can turn off dnssec that no need to reinstall that is for sure.

      edit2: btw I just connected to my screen copy of dnstop I am running on my wan interface.. So still have about 8 hours til 24 hours.. And currently showing hair under 11k total outbound queries from box..

      Your isp saying your too high with 16k in a day is just nuts. Maybe all his other users have 1 pc and turn it off when they are not using it? ;)

      An intelligent man is sometimes forced to be drunk to spend time with his fools
      If you get confused: Listen to the Music Play
      Please don't Chat/PM me for help, unless mod related
      SG-4860 24.11 | Lab VMs 2.8, 24.11

      O 1 Reply Last reply Reply Quote 0
      • O
        Octopuss @johnpoz
        last edited by Octopuss

        @johnpoz Network on all and outgoing on WAN works.

        I'm just curious why is it acting like that. I know for a fact I didn't enable DNSSEC in past and the settings were otherwise the same.

        johnpozJ 1 Reply Last reply Reply Quote 0
        • johnpozJ
          johnpoz LAYER 8 Global Moderator @Octopuss
          last edited by johnpoz

          @Octopuss yeah something is odd as you can see mine is set to just lan and localhost, and only localhost on wan.

          Your setting of lan,wifi,wifi-sep,local host on network and just localhost on outgoing should be a viable sane setup.

          But you should be good now, min ttl at 3600, no dnssec.. Your daily outbound queries should be reduced from that 16k your isp was complaining about.

          edit: I would start a dnstop on your wan.. So you have your own record of how many outbound dns queries you did to his Namerserver in a 24h period.

          edit2: if he still complains the only thing you could really do different is up the min ttl to like 7200 or something, and you could prob cut your queries in half if could stop all queries for AAAA. I will have to fire up bind and look at their no AAAA option to see if it prevents outbound queries when a client asks for it.

          The trick of not handing them back to clients with private-address: ::/0 doesn't stop unbound from looking them up if asked, it just doesn't hand the answer back to the clients that asked for them... I will have to see if they have maybe added something that could stop it the outbound queries for AAAA in unbound.

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.8, 24.11

          O 1 Reply Last reply Reply Quote 0
          • O
            Octopuss @johnpoz
            last edited by

            @johnpoz I really don't care about their complaint, I just want to know what the hell is wrong with pfSense. But I guess I won't be able to find out.
            I was thinking perhaps some firewall rules were missing (I don't understand that at all and never touched that, and when I had to add something it was lots of googling and trial and error), but then I didn't have any either back when DNSSEC was disabled.

            johnpozJ 1 Reply Last reply Reply Quote 0
            • johnpozJ
              johnpoz LAYER 8 Global Moderator @Octopuss
              last edited by johnpoz

              @Octopuss something is odd that setting is sane, the specific interfaces you want unbound to bind too and local host, because pfsense points to that to ask unbound to lookup something for pfsense.

              The only thing I can think of is one of the interfaces you have selected is not coming up fast enough, and so unbound doesn't bind to anything other than localhost.. I would think if an interface is not up it should still bind to the others that are.. Maybe if your interfaces take a while to come up it just shits the bed? If you have it set to all it wouldn't really have to wait til interfaces are up.. It would just bind like this.

              [2.7.2-RELEASE][admin@test.mydomain.tld]/root: netstat -anl | grep .53
              tcp4       0      0 127.0.0.1.953                                 *.*                                           LISTEN     
              tcp4       0      0 *.53                                          *.*                                           LISTEN     
              tcp6       0      0 *.53                                          *.*                                           LISTEN     
              udp4       0      0 *.53                                          *.*                                           
              udp6       0      0 *.53                                          *.*          
              

              But if for some reason the interfaces are not up when unbound starts - that really should be logged.

              edit: all and all is default.. That way sure dns is listening and works on all interfaces of pfsense - and could help users that maybe pick the wrong interfaces, etc. and then wonder why dns isn't working, etc.

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.8, 24.11

              O 1 Reply Last reply Reply Quote 0
              • O
                Octopuss @johnpoz
                last edited by

                @johnpoz Well the WAN interface is a gateway for wifi AP on the roof, but that's always on, there's no reason why there should be delays. On the other hand, when pfSense boots up, I see the gateway reports massive packetloss and/or latency for whatever reason, but then again - it has always been like that, so it makes no sense why disabling DNSSEC would cause any problems.

                johnpozJ 1 Reply Last reply Reply Quote 0
                • johnpozJ
                  johnpoz LAYER 8 Global Moderator @Octopuss
                  last edited by johnpoz

                  @Octopuss yeah it shouldn't that is for sure. And packetloss, you would think it still up?

                  So is your interface for wan actually a wifi interface in pfsense? But lets say your wan was just down, or had no ip yet.. sure ok dns can't work - but unbound should still be able to bind to your lan.. and local host. It shouldn't come up just showing bound to localhost.

                  Or is it a wire that runs to box that gets your internet from wifi.. But like said even if wan was down.. unbound should still bind to the lan interface not just localhost.

                  Maybe I will try and simulate by turning off the interface on wan before I reboot it in my VM..

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                  O 2 Replies Last reply Reply Quote 0
                  • O
                    Octopuss @johnpoz
                    last edited by

                    This post is deleted!
                    1 Reply Last reply Reply Quote 0
                    • O
                      Octopuss @johnpoz
                      last edited by

                      @johnpoz I don't think the WAN/gateway is the problem here, it hasn't changed for years.
                      It's a wifi (or wireless if that's not the same thing) AP on the roof, and the cable goes directly into the router.
                      I guess I am using the wrong terminilogy because I don't understand networking.

                      johnpozJ 1 Reply Last reply Reply Quote 0
                      • johnpozJ
                        johnpoz LAYER 8 Global Moderator @Octopuss
                        last edited by johnpoz

                        @Octopuss ok - have to do a some changes, add an interface to my vm that I can then stop from coming up.. to try and simulate an interface not coming up that unbound wants to bind too..

                        But what I did notice on a reboot of my vm, to see if gave warning if my wan dhcp didn't work

                        You are showing 1.18.0 for your unbound on 2.7.2, and I am showing 1.19.1

                        [2.7.2-RELEASE][admin@test.mydomain.tld]/root: unbound-control -c /var/unbound/unbound.conf status
                        version: 1.19.1
                        verbosity: 1
                        threads: 1
                        modules: 1 [ iterator ]
                        uptime: 141 seconds
                        options: control(ssl)
                        unbound (pid 83956) is running...
                        [2.7.2-RELEASE][admin@test.mydomain.tld]/root: 
                        

                        You posted

                        [2.7.2-RELEASE][admin@rozcestnik.lan]/root: unbound-control -c /var/unbound/unbound.conf status
                        version: 1.18.0
                        

                        That seems odd??? Why would be on different version?

                        Could you run a pkg upgrade, and see if that updates your unbound.. I just ran it and have some things it will update on mine

                        [2.7.2-RELEASE][admin@test.mydomain.tld]/root: pkg upgrade
                        Updating pfSense-core repository catalogue...
                        Fetching meta.conf:   0%
                        Fetching packagesite.pkg:   0%
                        pfSense-core repository is up to date.
                        Updating pfSense repository catalogue...
                        Fetching meta.conf:   0%
                        Fetching packagesite.pkg:   0%
                        pfSense repository is up to date.
                        All repositories are up to date.
                        Checking for upgrades (3 candidates): 100%      3 B   0.0kB/s    00:01    
                        Processing candidates (3 candidates): 100%      3 B   0.0kB/s    00:01    
                        The following 2 package(s) will be affected (of 0 checked):
                        
                        Installed packages to be UPGRADED:
                                pfSense-pkg-pfBlockerNG-devel: 3.2.0_8 -> 3.2.0_20 [pfSense]
                                rsync: 3.2.7 -> 3.4.0 [pfSense]
                        
                        Number of packages to be upgraded: 2
                        
                        The operation will free 1 MiB.
                        2 MiB to be downloaded.
                        
                        Proceed with this action? [y/N]: 
                        

                        I am wondering if at some point I had ran that back awhile ago where there were some issues with unbound? I thought at one point they had made an upgrade to unbound kind of behind the scenes.. I would have to dig through forum to find those discussions. But I do recall something about 18.0 to 18.1 or or 19 or something..

                        edit: ok there was an update from 18 to 19, here is one thread that was talking about it because of CVE

                        https://forum.netgate.com/topic/186145/unbound-cve-2023-50387-and-cve-2023-50868?_=1738403211860

                        I would be curious if you ran pkg upgrade if you would update to 1.19.1, maybe you won't see the problem then when selecting specific interfaces?

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                        O 1 Reply Last reply Reply Quote 0
                        • O
                          Octopuss @johnpoz
                          last edited by

                          @johnpoz Unfortunately no difference after an update.

                          94893eea-96d1-422f-b4bd-09ea11b454e6-image.png

                          GertjanG 1 Reply Last reply Reply Quote 0
                          • GertjanG
                            Gertjan @Octopuss
                            last edited by

                            @Octopuss said in Logging DNS queries:

                            difference after an update.

                            And system or at least unbound restart ?

                            unbound-control -c /var/unbound/unbound.conf status
                            

                            Does it show 1.19.1 now ?

                            No "help me" PM's please. Use the forum, the community will thank you.
                            Edit : and where are the logs ??

                            O 1 Reply Last reply Reply Quote 0
                            • O
                              Octopuss @Gertjan
                              last edited by Octopuss

                              @Gertjan Of course, I rebooted to see whether the update made any difference.

                              So yes and yes.
                              78c0f52b-3f55-4d1f-817d-e85025761563-image.png

                              johnpozJ 1 Reply Last reply Reply Quote 1
                              • johnpozJ
                                johnpoz LAYER 8 Global Moderator @Octopuss
                                last edited by johnpoz

                                @Octopuss My only theory is for whatever reason it takes a bit for your interfaces to come up, and unbound having a problem binding when you don't select all.

                                Why that is, not sure..

                                I have never seen it personally on any of my gear.. But again I rarely reboot pfsense.. Just no reason to. Maybe my system does it too? or could.. But sure not seeing it on my test VMs..

                                I want to try and duplicate like disabling the interface in my VM host, but not quite sure if I can without actually removing the interface from pfsense, ie it won't even see the interface which is different than say pulling the wire on it, or connection to switch takes a while because it's not set to portfast or something.

                                So where exactly do your lan and wifi interfaces go? Some AP for your wifi ones, Are they just vlans on your lan that is plugged into a switch and then your AP(s) plugged into that switch.. What switch?

                                So on one hand - yes like to understand why when you boot you only see bind to localhost if you do not select all.. On the other hand just leaving it on all you don't see the problem. So all is the default, it works - we could call it a day.

                                An intelligent man is sometimes forced to be drunk to spend time with his fools
                                If you get confused: Listen to the Music Play
                                Please don't Chat/PM me for help, unless mod related
                                SG-4860 24.11 | Lab VMs 2.8, 24.11

                                O 1 Reply Last reply Reply Quote 0
                                • O
                                  Octopuss @johnpoz
                                  last edited by

                                  @johnpoz The cable from the AP goes directly inthe pfSense box, and the LAN port is connected to a managed switch (TP-Link T1700G-28TQ).

                                  The Wifi interface on pfSense is just a VLAN where all the wifi devices go, and their APs.

                                  johnpozJ 1 Reply Last reply Reply Quote 1
                                  • johnpozJ
                                    johnpoz LAYER 8 Global Moderator @Octopuss
                                    last edited by

                                    @Octopuss well the only thing that makes any sense at all is when unbound goes to start one of your lan side interfaces is not up and so it has a problem binding to that IP.. Only theory I have that would explain the symptoms.

                                    Maybe if you could watch is boot from console or something.. And maybe spot something..

                                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                                    If you get confused: Listen to the Music Play
                                    Please don't Chat/PM me for help, unless mod related
                                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                                    O 1 Reply Last reply Reply Quote 0
                                    • O
                                      Octopuss @johnpoz
                                      last edited by

                                      @johnpoz Is the boot process being logged? There's so much going on and it scrolls so fast I don't think I could see anything even if I was staring at it.

                                      johnpozJ 1 Reply Last reply Reply Quote 1
                                      • johnpozJ
                                        johnpoz LAYER 8 Global Moderator @Octopuss
                                        last edited by

                                        @Octopuss there is boot log yes, under

                                        osboot.jpg

                                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                                        If you get confused: Listen to the Music Play
                                        Please don't Chat/PM me for help, unless mod related
                                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                                        O 1 Reply Last reply Reply Quote 0
                                        • O
                                          Octopuss @johnpoz
                                          last edited by Octopuss

                                          @johnpoz
                                          Great, I can't post the log, it is getting flagged as spam.
                                          This forum software... 🙄

                                          johnpozJ 1 Reply Last reply Reply Quote 1
                                          • johnpozJ
                                            johnpoz LAYER 8 Global Moderator @Octopuss
                                            last edited by

                                            @Octopuss I bumped your rep to 5 points, try it now.

                                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                                            If you get confused: Listen to the Music Play
                                            Please don't Chat/PM me for help, unless mod related
                                            SG-4860 24.11 | Lab VMs 2.8, 24.11

                                            O 1 Reply Last reply Reply Quote 1
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.