Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Is this normal behavior for the Resolver to act that way?

    Scheduled Pinned Locked Moved General pfSense Questions
    51 Posts 4 Posters 4.0k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • johnpozJ
      johnpoz LAYER 8 Global Moderator @marchand.guy
      last edited by

      @marchand-guy your previous post was missing this one

      missing.jpg

      An intelligent man is sometimes forced to be drunk to spend time with his fools
      If you get confused: Listen to the Music Play
      Please don't Chat/PM me for help, unless mod related
      SG-4860 24.11 | Lab VMs 2.8, 24.11

      M 1 Reply Last reply Reply Quote 0
      • M
        marchand.guy @johnpoz
        last edited by

        @johnpoz I know. That's why I reposted it. I should have guessed that you would make the effort of looking at it 😀

        1 Reply Last reply Reply Quote 0
        • johnpozJ
          johnpoz LAYER 8 Global Moderator @marchand.guy
          last edited by johnpoz

          @marchand-guy said in Is this normal behavior for the Resolver to act that way?:

          "Set DNS Resolution Behavior to Use local DNS (127.0.0.1), ignore remote DNS Servers"

          yeah technically that is true - or you could have a scenario where pfsense directly talks to servers you have in general without the tls. So guess you have to live with the ::1 listed as NS you could talk to ;) Or you could run into a scenario where pfsense doesn't use tls to talk to your remote tls server you want to talk to. When itself wants to resolve something - like is there an update available, need to pull the list of available packages.. etc. but clients talking to pfsense IP for dns would not.

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.8, 24.11

          M 1 Reply Last reply Reply Quote 0
          • stephenw10S
            stephenw10 Netgate Administrator
            last edited by

            Yup that's why I mentioned it since you would normally only see local host there if you have followed the guide.

            But importantly you should not see anything that's present and unresponsive.

            M 1 Reply Last reply Reply Quote 0
            • M
              marchand.guy @stephenw10
              last edited by

              @stephenw10 said in Is this normal behavior for the Resolver to act that way?:

              you would normally only see local host there if you have followed the guide.

              Not according to the doc at https://docs.netgate.com/pfsense/en/latest/recipes/dns-over-tls.html#figure-dot-servers

              But maybe I misunderstand what you are meaning.

              What I see on the dashboard is:
              c1bf0912-a5fb-4e02-acb3-0a97bbc0fc4b-image.png

              1 Reply Last reply Reply Quote 0
              • M
                marchand.guy @johnpoz
                last edited by marchand.guy

                @johnpoz said in Is this normal behavior for the Resolver to act that way?:

                but clients talking to pfsense IP for dns would not.

                And I made sure of that with this NAT:
                220b79a6-d521-4ca5-bcf3-d9697bf9e226-image.png
                (and yes, I tried without it)

                And I go further withe these rules (and yes, I tried without them):
                69e73926-364e-4f1e-b1bc-a9a5fa242393-image.png
                cd99837a-68fb-4990-9340-d4d17602a44b-image.png

                1 Reply Last reply Reply Quote 0
                • stephenw10S
                  stephenw10 Netgate Administrator
                  last edited by

                  Oh, you're right it does still test them from Diag > DNS Lookup even if it ignores them for real resolution.

                  1 Reply Last reply Reply Quote 0
                  • M
                    marchand.guy
                    last edited by marchand.guy

                    UPDATE:
                    After stripping the FW of all packages, openVPN client, NAT and rules associates, it turns out that the openVPN client installation is causing the problem. I suspect it has something to do with the DNS it is trying to use, as I am not allowing it to use it's own resolver. I will read further on that and try in making it work. Thank you all.

                    Correction: This morning stripping th FW did not correct the problem. Until unbound restarts.

                    johnpozJ 1 Reply Last reply Reply Quote 1
                    • johnpozJ
                      johnpoz LAYER 8 Global Moderator @marchand.guy
                      last edited by

                      @marchand-guy your problem is most likely you are routing all traffic out your vpn - even your tls dns..

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                      M 1 Reply Last reply Reply Quote 1
                      • M
                        marchand.guy @johnpoz
                        last edited by

                        @johnpoz Not according to pftop. I have rules that specify when going thru the VPN interface.

                        1 Reply Last reply Reply Quote 0
                        • stephenw10S
                          stephenw10 Netgate Administrator
                          last edited by

                          But is the client allowing the remote server to pass it a default route?

                          M 1 Reply Last reply Reply Quote 0
                          • M
                            marchand.guy @stephenw10
                            last edited by

                            @stephenw10 I don't think so:
                            4d61a475-8474-4df7-b4c6-9347261be985-image.png

                            1 Reply Last reply Reply Quote 0
                            • stephenw10S
                              stephenw10 Netgate Administrator
                              last edited by

                              I usually just set don't pull routes. But it's easy enough to check what's happening there in the routing table.

                              You can't policy route traffic from the firewall itself so it will just use the system default route at that point. I'd bet that's what's happening.

                              M 2 Replies Last reply Reply Quote 0
                              • M
                                marchand.guy @stephenw10
                                last edited by

                                @stephenw10 I will try.
                                Thank you.

                                johnpozJ 1 Reply Last reply Reply Quote 0
                                • johnpozJ
                                  johnpoz LAYER 8 Global Moderator @marchand.guy
                                  last edited by

                                  @marchand-guy yeah a peak at your routing table will tell you - you could also look here

                                  routing.jpg

                                  the gateway you have set for your vpn should not be the default.

                                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                                  If you get confused: Listen to the Music Play
                                  Please don't Chat/PM me for help, unless mod related
                                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                                  M 1 Reply Last reply Reply Quote 0
                                  • M
                                    marchand.guy @johnpoz
                                    last edited by

                                    @johnpoz Looks good:
                                    e7dcbd4f-c1b9-4e07-ac3c-c534b7f1cc81-Screenshot from 2025-05-30 11-56-16.png file:///home/guy/Downloads/Screenshot%20from%202025-05-30%2011-56-16.png

                                    1 Reply Last reply Reply Quote 0
                                    • M
                                      marchand.guy @stephenw10
                                      last edited by

                                      @stephenw10 I tried the openvpn client seeting on not pulling route. It did not clear the problem. Furthermore, the gateway monitoring function for the vpn interface stopped working properly.
                                      But your suggestion remains valid concerning the routing. Still investigating.

                                      johnpozJ 1 Reply Last reply Reply Quote 0
                                      • johnpozJ
                                        johnpoz LAYER 8 Global Moderator @marchand.guy
                                        last edited by johnpoz

                                        @marchand-guy not sure what there is to "investigate" just look in your routing table. take all of 2 seconds

                                        routes.jpg

                                        Unless you have a more specific route for your NS your pointing to - its going to go out the default route.

                                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                                        If you get confused: Listen to the Music Play
                                        Please don't Chat/PM me for help, unless mod related
                                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                                        M 1 Reply Last reply Reply Quote 0
                                        • M
                                          marchand.guy @johnpoz
                                          last edited by

                                          @johnpoz said in Is this normal behavior for the Resolver to act that way?:

                                          @marchand-guy not sure what there is to "investigate"
                                          Semantics...

                                          Looks fine to me but we don't have the same version, so:
                                          69d1cf2e-abb4-4e31-aa03-c1a47a304b3b-Screenshot from 2025-05-30 12-54-37.png file:///home/guy/Downloads/Screenshot%20from%202025-05-30%2012-54-37.png

                                          johnpozJ 1 Reply Last reply Reply Quote 0
                                          • johnpozJ
                                            johnpoz LAYER 8 Global Moderator @marchand.guy
                                            last edited by

                                            @marchand-guy well from that there its not routing traffic out any vpn..

                                            I have 2.8 running now and could test.. But I can tell you with like 99.9% certainty I will not be able to duplicate it.. Because if 2.8 broke dns resolution with users that use vpn - the forums would be on fire with people complaining. So pretty sure whatever your issue is unique to your setup.

                                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                                            If you get confused: Listen to the Music Play
                                            Please don't Chat/PM me for help, unless mod related
                                            SG-4860 24.11 | Lab VMs 2.8, 24.11

                                            M 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.