Is this normal behavior for the Resolver to act that way?
-
@marchand-guy not sure what there is to "investigate" just look in your routing table. take all of 2 seconds
Unless you have a more specific route for your NS your pointing to - its going to go out the default route.
-
@johnpoz said in Is this normal behavior for the Resolver to act that way?:
@marchand-guy not sure what there is to "investigate"
Semantics...Looks fine to me but we don't have the same version, so:
file:///home/guy/Downloads/Screenshot%20from%202025-05-30%2012-54-37.png -
@marchand-guy well from that there its not routing traffic out any vpn..
I have 2.8 running now and could test.. But I can tell you with like 99.9% certainty I will not be able to duplicate it.. Because if 2.8 broke dns resolution with users that use vpn - the forums would be on fire with people complaining. So pretty sure whatever your issue is unique to your setup.
-
@johnpoz Agreed!
Thank you, again
-
It only happens after reboot though and restarting unbound after boot corrects it. So that suggests that the default route is wrong when Unbound initially opens the outbound state during boot only. For some reason!
-
@stephenw10 Exactly. Still investigating.
-
@stephenw10 So, I removed every packages, every openvpn clients (and associated interface, NAT and rules. Every rules and NAT forwarding related to DoT.
What remained for me was to put the NAT rules to automatic instead of manual. Since I upgraded to 2.8 CE from 2.7.2 the rules went from (forget the VPN1 interface, it was removed. this is an old picture):
To:
I then made sure to only select the DNS interfaces as follow:
Network interface LAN, Localhost
Outgoing network interface WAN, LocalhostAnd rebooted the FW.
This setting breaks the resolution sevice on the LAN side, as no internet sites are acessible via browser or apps.
Until I manually restart the unbound service. Then everything works.
At this point, I'm troying the towel and leaving the interfaces used for DNS at their defaul values; which is "All" for both settings. Everything works after that with a reboot.
F**k you OCD monkey!
-
Hmm, so it still failed at boot with outbound NAT set to automatic?
-
@stephenw10 said in Is this normal behavior for the Resolver to act that way?:
Hmm, so it still failed at boot with outbound NAT set to automatic?
I wonder if you have ever seen this in the system log after a boot or reboot
php-fpm 589 /rc.newwanipv6: Gateway, NONE AVAILABLE
I have every time and I only have one wan;gateway;ISP set DHCP. -
Yeah that's normal if you don't have a v6 gateway defined. It shouldn't cause a problem.
-
@stephenw10 System/routing/gateways default gateway set Automatic
and also tried WAN_DHCP both get no default route found and the no gateway. Also, have outbound mode set on Automatic outbound NAT rule too.
If I wait long enough (1-5mins) it just finds a route/gateway by itself usually. Until it does dns queries fail which is a problem. -
For IPv6 specifically?
-
@stephenw10 Yes. pfSense plus 24.11 seems not to like the wan to be set DHCP.
-
Specifically IPv6 set to DHCP though?
How is your DNS configured? By default Unbound resolves directly and will use IPv4.
-
@stephenw10 unbound is set forwarding mode and use ssl/tls with outgoing network interfaces set to all. Should I set outgoing network interfaces to WAN only ipv4 and ipv6 interface instead when forwarding ?
-
Do you have an IPv6 address at all? I'm not sure quite what problem you're seeing here?
If you set the default IPv6 gateway to automatic and don't have a valid IPv6 connection then that log entry is expected.
Obviously for for IPv6 outbound NAT normally doesn't come into play (assuming you do have a valid v6 IP). For for ther 4 or v6 Unbound itself should use the public IP without NAT.
-
@stephenw10 After every reboot or cold boot there is always a wait before there is a IPv6 gateway. LAN is set track interface(WAN) Router Advertisements is set unmanaged should it be Assisted? IPv6 gateway also breaks when DHCP lease expire(WAN/ISP DHCP server) for IPv6 and the get new IP is ignored. pfsense DHCP6c never changes the IP treats DHCP like its static then things like streaming break/stop. Yes the ISP sucks but setting DHCP should be dynamic not static. Still on version 24.11
-
Sounds like you might want/need to set 'do not wait for RA' in the dhcpv6 client settings on the WAN. Otherwise you will only see it connect after the ISP sends an RA and that can vary a lot.
