WAN connected after default install, but no access from LAN
-
If pfsense can access foreign hosts by name, but internal hosts can't (but can by IP), they are not getting DNS. What are you setting for DNS for the LAN hosts?
-
I figured as much after try wallabybob's small tests, I just didn't touch it for fear of messing it up.
At the moment, DNS is empty with the "Allow DNS server list to be overridden by DHCP/PPP on WAN" checked. I previously had the local DNS server's address (which is also the DHCP and the PDC).
What do you suggest?
-
No, that wasn't my point. It doesn't matter what pfsense has set for DNS if the LAN hosts are set wrong. What is your DHCP server giving hosts for DNS?
-
The local DNS/PDC address which is part of the same subnet. Worked fine with ISA, why not with pfsense?
-
And where is IT getting its DNS from?
-
It only has the domain DNS zone (forward lookup only). I am pretty sure it does not update or reflect or retrieve anything from the internet.
-
I am confused then. If it is not pointed at outside name servers, how would you ever expect name resolution to work? Some host inside your LAN needs to be querying outside DNS! Did that use to be the ISA? If so, set the pfsense to allow WAN DNS and have it serve up the DNS to hosts.
-
Your client appears to be attempting to use an invalid name server, OR the name server itself can no longer get the information it requires.
You could use the Linux nslookup utility to see what name server is being invoked by your Linux client.
On the name server itself, can it resolve www.google.com?
Earlier you said you checked the clients had the correct DNS address. How did you check? How did you decide it was correct? (If I understand you correctly, you want the clients to use pfSense as the gateway and the WIN2K3 box as the DNS.)
It only has the domain DNS zone (forward lookup only). I am pretty sure it does not update or reflect or retrieve anything from the internet.
So how will this name server resolve something like www.google.com if it doesn't get it from the internet?
-
We now come to the crux of my lack of knowledge.
danswartz:
I thought the name resolution for external name servers was automatic. Very naive of me now that I think about it. I think it was ISA. The reason I don't know this stuff because about 3 weeks ago, the guy that was here before me passed away in a car accident and he hadn't left much that could explain what is doing what. Just to be completely sure, you mean System > General Setup > Allow DNS server list to be overwritten, correct?wallabybob:
nslookup gives me the google name servers 74.125.0.0/16 , the local DNS cannot resolve names.When I said I checked the DNS, I checked for the local one and I did that by an nslookup, trying to resolve the names of local servers.
Earlier you said you checked the clients had the correct DNS address. How did you check? How did you decide it was correct? (If I understand you correctly, you want the clients to use pfSense as the gateway and the WIN2K3 box as the DNS.)
Precisely.
So how will this name server resolve something like www.google.com if it doesn't get it from the internet?
I hadn't thought of that. I'm not a sys admin by trade, I'm a developer, but I'm loving the lessons I'm getting here. Out of curiosity, where would I be able to find out more about how to get the local DNS server to do just that?
-
Someone else will have to help with the Windows setup because I don't have that sort of experience.
I'd setup pfSense to act as the DNS server and DHCP server but I'm not aware of the implications of that for your particular requirements.
pfSense has a single configuration file (including DNS and DHCP configuration) that is easily backed up so its pretty easy to get a pfSense system running again after (say) a hard drive problem and it can probably be done a lot more quickly than restoration of a Windows server. This could be an important consideration if (say) your Windows server has some sort of problem preventing it booting and you want to surf the internet for clues about suitable recovery action. If you are relying on the Windows server for DHCP and DNS you'll need some special inspiration to surf the net looking for a solution.
-
DHCP being moved to something else is perfectly alright _, but regarding Windows DNS I don't have the slightest clue. Looks like I'm going to have to phone up someone.
Thanks a million though._
-
After reading and looking at the network diagram I would recommend letting your pfSense box do the dns and dhcp. If the Win2k3 ain't doing anything but dns and dhcp it's wast of power imo.
As you are non profit it could be a solution for you.
Free email
Free websiteJust my 2 cent.
-
Is it possible to let pfsense handle the dns? Even if the dns box is also providing AD and PDC? Where would I find information on how to do that?
Many thanks for the links dude :)
-
Then it's correct to use win2k3 for DNS when AD is in play.
Is the DNS server ip's correct in Windows Server DNS Forwarders?
-
without knowing about the server, it is hard to say.
-
http://www.petri.co.il/install_and_configure_windows_2003_dns_server.htm
The "Enable DNS Forwarding for Internet connections" part
-
Ugh, my experience with windows is pretty much zero (certainly for something like this.) Sorry…
-
The server is currently running with ISA as a firewall. Its forwarding fine and its working fine. It is my intention to swap ISA with pfsense for the simple reasons that ISA's demo license will expire soon and it has proven to be a very complicated tool that is liable to bring the whole network to a halt. When I connect through pfsense, dns forwarding is not working, but connecting through ISA, everything works like a charm. I know I'm doing something wrong, I'm just not sure what it is; its regarding dns forwarding, but that's the extent of what I know is wrong.
-
okay that is clearer now. i had gotten the impression you needed pfsense AND the ISA box. it really is not a good idea to try to have both at the same time. if all the ISA is doing is dhcp and dns for LAN hosts, i would wait until off-hours, shut it down, and replace it with the pfsense. put the pfsense in with WAN and LAN interfaces set appropriately, enable the DHCP as you need it to be set, enable DNS forwarder, and check the "allow override" box. i know this sounds like a lot, but it really is not feasible to give you a 'become an IT guy in 5 minutes" lesson :(
-
OK, I got it working after much deliberation with friends, google and trial and error.
ISA was the problem. Brought it down, let pfsense handle DHCP, altered the values for the DNS on W2K3 and updated the gateway IPs on the clients.
Is beautiful when things are going like clock work! :D
Thanks to every one!