Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    DNSSEC on pfSense

    Scheduled Pinned Locked Moved 2.0-RC Snapshot Feedback and Problems - RETIRED
    178 Posts 18 Posters 71.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • W
      wagonza
      last edited by

      @ToxIcon:

      sorry guys I seem to be having a problem loosing access to the internet when I enable Unbound it work for about 20 minutes then I loose all internet connection cannot access any webpages then I have to disable Unbound and reboot the firewall to restore internet access.

      Here is my settings

      Enable Unbound

      lan Lan1

      Enable DNSSEC

      Enable forwarding mode

      Private Address support

      Register DHCP static mappings

      Enable DNS forwarder disable

      I see you have forwarding enabled. So when this problem happens can you then query your name servers that have been defined in General. If those answer can you then query Unbound (using dig) and see what it's response is i.e. dig @pfsense_ip www.pfsense.org

      Then let me know what it sees. Also have a log at /var/log/unbound/log (cmd is clog /var/log/unbound.log).

      Follow me on twitter http://twitter.com/wagonza
      http://www.thepackethub.co.za

      1 Reply Last reply Reply Quote 0
      • W
        wagonza
        last edited by

        @adrianhensler:

        I can confirm that unbound has crapped out for me at least twice in the past 4 days.   I haven't had time to look at it at all, but restarting it from services page fixed it for me both times.

        Hopefully next time it happens I'll have a minute to take a look at the logs.

        If you could do the same please - when it happens try query, using dig, and see what its answers with. Then when you do have time see if /var/log/unbound.log contains anything useful.

        Follow me on twitter http://twitter.com/wagonza
        http://www.thepackethub.co.za

        1 Reply Last reply Reply Quote 0
        • J
          jlepthien
          last edited by

          I tried using Unbound again and everything seems to be working fine except one small thing…
          I have one domain override configured but I cannot resolve the hostname. Not on the pfSense box itself and not on any LAN/WLAN interface.  Any info on how/what to test?

          Here is the part of the config:

          # Domain overrides
          stub-zone:
          	name: "ip"
          	stub-addr: 192.168.2.1
          	stub-prime: no
          

          And there should be my modem with a dns name of speedport.ip which is on vr1 (my external interface). This works with dnsmasq but not with Unbound yet…

          Edit: the speedport.ip entry also is missing from /etc/hosts on my pfSense box...

          | apple fanboy | music lover | network and security specialist | in love with cisco systems |

          1 Reply Last reply Reply Quote 0
          • johnpozJ
            johnpoz LAYER 8 Global Moderator
            last edited by

            I just tried putting in a domain override, and restarted unbound - and its not showing up in the unbound config.

            Domain overrides

            Remote Control Config

            So I have the below domain set to override and use 192.168.1.4, I even stopped and restarted unbound service - just not showing up in the config??

            But to your question, for a host to resolve with your domain .ip the nameserver you point to for .ip would have to have that host record.

            overridedomain.jpg
            overridedomain.jpg_thumb

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.8, 24.11

            1 Reply Last reply Reply Quote 0
            • J
              jlepthien
              last edited by

              @johnpoz:

              I just tried putting in a domain override, and restarted unbound - and its not showing up in the unbound config.

              Domain overrides

              Remote Control Config

              So I have the below domain set to override and use 192.168.1.4, I even stopped and restarted unbound service - just not showing up in the config??

              But to your question, for a host to resolve with your domain .ip the nameserver you point to for .ip would have to have that host record.

              For me it shows up in the config. And it hasn't to be the hostname, just the domain. That way it works with dnsmasq. Try just setting the domain there.

              | apple fanboy | music lover | network and security specialist | in love with cisco systems |

              1 Reply Last reply Reply Quote 0
              • johnpozJ
                johnpoz LAYER 8 Global Moderator
                last edited by

                What modem you have?  When I do a search for speedport.ip I see stuff about this modem

                Speedport W 701V

                Thanks just your modem resolving to itself is all, thats not what you would do to if you want unbound to resolve speedport.ip to the 192.168.2.1 address of your modem.

                From the manual of that modem, its in german but translates too

                Type in the address bar of Internet browsing, "speedport.ip" or "192.168.2.1"and confirm.

                This just means that if using your modem (really a router) as your dns, that would resolve speedport.ip to itself.  And then would work if you were forwarding dns to the router, ie 192.168.2.1 – but with unbound its doing the actual dns lookups, speedport.ip is never going to resolve in the real world.. You would have to have a dns server that thinks owner of the .ip tld and then a A record for speedport in it.

                If you want to resolve speedport.ip using unbound, just add a host record for that, and then it will resolve it to whatever IP you want.

                so for example. I add it in mine to speedport.ip to 192.168.2.1

                As you can see from the attachments -- but even with restart its not reading that entry in??  but it has all my other entries??  Im not on the current snap - but don't want to upgrade while not there.. So will have to do when I get back.. But that is what take your problem is for this speedport.ip.

                It resolves my other local hosts just fine
                ;; QUESTION SECTION:
                ;quad-w7.local.lan.            IN      A

                ;; ANSWER SECTION:
                quad-w7.local.lan.      3600    IN      A      192.168.1.100

                ;; Query time: 4 msec
                ;; SERVER: 192.168.1.253#53(192.168.1.253)
                ;; WHEN: Mon Jan 10 15:44:50 2011
                ;; MSG SIZE  rcvd: 51

                But his new one I just added for speedport.ip its not??

                ;; QUESTION SECTION:
                ;speedport.ip.                  IN      A

                ;; AUTHORITY SECTION:
                .                      86400  IN      SOA    a.root-servers.net. nstld.verisi        gn-grs.com. 2011011000 1800 900 604800 86400

                ;; Query time: 52 msec
                ;; SERVER: 192.168.1.253#53(192.168.1.253)
                ;; WHEN: Mon Jan 10 15:44:37 2011
                ;; MSG SIZE  rcvd: 105

                When I look at the status tab is not showing that new entry, even upon start and stop of unbound service..  Will update the snap when I get home and see if that fixes it, currently on
                2.0-BETA5 (i386)
                built on Sat Jan 8 01:01:27 EST 2011

                edithost.jpg
                edithost.jpg_thumb
                myhosts.jpg
                myhosts.jpg_thumb

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.8, 24.11

                1 Reply Last reply Reply Quote 0
                • J
                  jlepthien
                  last edited by

                  Yeah okay. But I wanted to add that whole .ip domain so I added a whole domain overwrite, not just for the host…

                  | apple fanboy | music lover | network and security specialist | in love with cisco systems |

                  1 Reply Last reply Reply Quote 0
                  • johnpozJ
                    johnpoz LAYER 8 Global Moderator
                    last edited by

                    If you want that resolve whole .ip domain – then you need another nameserver that would be authoritative for the .ip tld -- and this nameserver would have to house all the records of hosts in that domain.

                    example

                    speedport.ip
                    hostA.ip
                    hostB.ip
                    etc..

                    So does your modem at 2.1 allow you to put in other hosts that would resolve to with .ip domain?

                    A domain override would be used if you want to have some other nameserver resolve for say yourdomain.com vs root servers point to for example.  Or you have some nameserver that is authoritative for an invalid tld like .ip

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                    1 Reply Last reply Reply Quote 0
                    • J
                      jlepthien
                      last edited by

                      I know. The point is that it works that way with dnsmasq so why not now with Unbound?

                      | apple fanboy | music lover | network and security specialist | in love with cisco systems |

                      1 Reply Last reply Reply Quote 0
                      • J
                        jlepthien
                        last edited by

                        Ok now I changed it the way you used it and it works…

                        | apple fanboy | music lover | network and security specialist | in love with cisco systems |

                        1 Reply Last reply Reply Quote 0
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator
                          last edited by

                          Because to be honest I doubt that speedport router is actually a nameserver that would resolve speedport.ip like a normal nameserver would

                          Simple enough to test, using either nslookup or dig – do a query to that ip 192.168.2.1

                          nslookup

                          server 192.168.2.1
                          speedport.ip

                          does that work?  I doubt it

                          Or with dig

                          dig @192.168.2.1 speedport.ip

                          If those work then your domain override should work, if not then no it would never work.  So just having your unbound resolve speedport.ip to whatever IP you want is the way to do it.

                          Now currently mine does not seem to be reading in the additions I make to either hosts or domain overrides - but once it does, then I will point it to my other nameserver and verify it works like it should.  But for now, if you don't mine do either the nslookup or dig test and post the results.. If that works then your right the override for .ip to go ask 192.168.2.1 should resolve speedport.ip for you.

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                          1 Reply Last reply Reply Quote 0
                          • T
                            ToxIcon
                            last edited by

                            wagonza

                            I tried with forwarding enabled and disable and both times lost connection
                            internally but the pfsense still can reach the outside, I test it by updating
                            snort and squidguard but the systems behind pfsense cannot reach the internet.

                            here are the logs

                            $ dig zone @192.168.2.9

                            ; <<>> DiG 9.6.2-P2 <<>> zone @192.168.2.9
                            ;; global options: +cmd
                            ;; Got answer:
                            ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 1390
                            ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

                            ;; QUESTION SECTION:
                            ;zone. IN A

                            ;; AUTHORITY SECTION:
                            . 86400 IN SOA a.root-servers.net. nstld.verisign-grs.com. 2011011000 1800 900 604800 86400

                            ;; Query time: 81 msec
                            ;; SERVER: 192.168.2.9#53(192.168.2.9)
                            ;; WHEN: Mon Jan 10 21:26:00 2011
                            ;; MSG SIZE  rcvd: 97

                            $ dig @192.168.2.9 www.pfsense.org

                            ; <<>> DiG 9.6.2-P2 <<>> @192.168.2.9 www.pfsense.org
                            ; (1 server found)
                            ;; global options: +cmd
                            ;; Got answer:
                            ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 3625
                            ;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 2, ADDITIONAL: 0

                            ;; QUESTION SECTION:
                            ;www.pfsense.org. IN A

                            ;; ANSWER SECTION:
                            www.pfsense.org. 3600 IN CNAME pfsense.org.
                            pfsense.org. 3600 IN A 69.64.6.21

                            ;; AUTHORITY SECTION:
                            pfsense.org. 3600 IN NS ns17.domaincontrol.com.
                            pfsense.org. 3600 IN NS ns18.domaincontrol.com.

                            ;; Query time: 177 msec
                            ;; SERVER: 192.168.2.9#53(192.168.2.9)
                            ;; WHEN: Mon Jan 10 21:22:18 2011
                            ;; MSG SIZE  rcvd: 118

                            clog.txt

                            1 Reply Last reply Reply Quote 0
                            • johnpozJ
                              johnpoz LAYER 8 Global Moderator
                              last edited by

                              OK so I updated my snap, and now its showing my domain overrides.

                              Domain overrides

                              stub-zone:
                              name: "test.ip"
                              stub-addr: 192.168.1.4
                              stub-prime: no

                              But I agree its not working like it should.. So there is a server at 192.168.1.4 running bind with a zone for test.ip

                              see – if I query it directly authoritative for the host3 record I created.


                              ; <<>> DiG 9.7.2-P3 <<>> @192.168.1.4 host3.test.ip
                              ; (1 server found)
                              ;; global options: +cmd
                              ;; Got answer:
                              ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 15037
                              ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1

                              ;; QUESTION SECTION:
                              ;host3.test.ip.                 IN      A

                              ;; ANSWER SECTION:
                              host3.test.ip.          21600   IN      A       192.168.1.101

                              ;; AUTHORITY SECTION:
                              test.ip.                21600   IN      NS      p4-28g.local.lan.

                              ;; ADDITIONAL SECTION:
                              p4-28g.local.lan.       21600   IN      A       192.168.1.4

                              ;; Query time: 5 msec
                              ;; SERVER: 192.168.1.4#53(192.168.1.4)
                              ;; WHEN: Mon Jan 10 23:32:39 2011
                              ;; MSG SIZE  rcvd: 93


                              Now if I ask the pfsense box that has an override set to ask 192.168.1.4 for the domain test.ip it also gives me back servfail


                              ; <<>> DiG 9.7.2-P3 <<>> @192.168.1.253 host3.test.ip
                              ; (1 server found)
                              ;; global options: +cmd
                              ;; Got answer:
                              ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 49426
                              ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

                              ;; QUESTION SECTION:
                              ;host3.test.ip.                 IN      A

                              ;; Query time: 11 msec
                              ;; SERVER: 192.168.1.253#53(192.168.1.253)
                              ;; WHEN: Mon Jan 10 23:40:03 2011
                              ;; MSG SIZE  rcvd: 31


                              So seems domain override is not working??

                              Currently running
                              2.0-BETA5 (i386)
                              built on Mon Jan 10 13:14:45 EST 2011

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.8, 24.11

                              1 Reply Last reply Reply Quote 0
                              • S
                                serangku
                                last edited by

                                hey … something error on unbound packages when updated to latest pf20 i386

                                Jan 11 14:10:09 php: /pkg_edit.php: The command '/usr/local/sbin/unbound-control start' returned exit code '1', the output was '[1294729809] unbound[8280:0] error: unknown size specifier: '-1m' /usr/local/etc/unbound/unbound.conf:17: error: buffer size expected read /usr/local/etc/unbound/unbound.conf failed: 1 errors in configuration file [1294729809] unbound[8280:0] fatal error: Could not read config file: /usr/local/etc/unbound/unbound.conf'

                                somethink error on pfsense or unbound it self ?
                                back again to dnsmasq

                                1 Reply Last reply Reply Quote 0
                                • W
                                  wagonza
                                  last edited by

                                  @ToxIcon:

                                  $ dig @192.168.2.9 www.pfsense.org

                                  ;; QUESTION SECTION:
                                  ;www.pfsense.org. IN A

                                  ;; ANSWER SECTION:
                                  www.pfsense.org. 3600 IN CNAME pfsense.org.
                                  pfsense.org. 3600 IN A 69.64.6.21

                                  ;; AUTHORITY SECTION:
                                  pfsense.org. 3600 IN NS ns17.domaincontrol.com.
                                  pfsense.org. 3600 IN NS ns18.domaincontrol.com.

                                  This shows that it is answering correctly unless www.pfsense.org was cached. Trying another website not resolved yet something like www.food.com?

                                  Follow me on twitter http://twitter.com/wagonza
                                  http://www.thepackethub.co.za

                                  1 Reply Last reply Reply Quote 0
                                  • W
                                    wagonza
                                    last edited by

                                    @jlepthien:

                                    Yeah okay. But I wanted to add that whole .ip domain so I added a whole domain overwrite, not just for the host…

                                    Yeah I hear what you saying. Your modem would have to be running its own name server as @johnpoz mentioned.

                                    Follow me on twitter http://twitter.com/wagonza
                                    http://www.thepackethub.co.za

                                    1 Reply Last reply Reply Quote 0
                                    • W
                                      wagonza
                                      last edited by

                                      @serangku:

                                      hey … something error on unbound packages when updated to latest pf20 i386

                                      Jan 11 14:10:09 php: /pkg_edit.php: The command '/usr/local/sbin/unbound-control start' returned exit code '1', the output was '[1294729809] unbound[8280:0] error: unknown size specifier: '-1m' /usr/local/etc/unbound/unbound.conf:17: error: buffer size expected read /usr/local/etc/unbound/unbound.conf failed: 1 errors in configuration file [1294729809] unbound[8280:0] fatal error: Could not read config file: /usr/local/etc/unbound/unbound.conf'

                                      somethink error on pfsense or unbound it self ?
                                      back again to dnsmasq

                                      What is kern.ipc.maxsockbuf set to on your pfSense box (sysctl kern.ipc.maxsockbuf)?

                                      I have committed a fix for this but still interested to know what your kern.ipc.maxsockbuf is set to.

                                      Follow me on twitter http://twitter.com/wagonza
                                      http://www.thepackethub.co.za

                                      1 Reply Last reply Reply Quote 0
                                      • W
                                        wagonza
                                        last edited by

                                        @johnpoz:

                                        OK so I updated my snap, and now its showing my domain overrides.

                                        Domain overrides

                                        stub-zone:
                                        name: "test.ip"
                                        stub-addr: 192.168.1.4
                                        stub-prime: no

                                        But I agree its not working like it should.. So there is a server at 192.168.1.4 running bind with a zone for test.ip

                                        see – if I query it directly authoritative for the host3 record I created.


                                        ; <<>> DiG 9.7.2-P3 <<>> @192.168.1.4 host3.test.ip
                                        ; (1 server found)
                                        ;; global options: +cmd
                                        ;; Got answer:
                                        ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 15037
                                        ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1

                                        ;; QUESTION SECTION:
                                        ;host3.test.ip.                 IN      A

                                        ;; ANSWER SECTION:
                                        host3.test.ip.          21600   IN      A       192.168.1.101

                                        ;; AUTHORITY SECTION:
                                        test.ip.                21600   IN      NS      p4-28g.local.lan.

                                        ;; ADDITIONAL SECTION:
                                        p4-28g.local.lan.       21600   IN      A       192.168.1.4

                                        ;; Query time: 5 msec
                                        ;; SERVER: 192.168.1.4#53(192.168.1.4)
                                        ;; WHEN: Mon Jan 10 23:32:39 2011
                                        ;; MSG SIZE  rcvd: 93


                                        Now if I ask the pfsense box that has an override set to ask 192.168.1.4 for the domain test.ip it also gives me back servfail


                                        ; <<>> DiG 9.7.2-P3 <<>> @192.168.1.253 host3.test.ip
                                        ; (1 server found)
                                        ;; global options: +cmd
                                        ;; Got answer:
                                        ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 49426
                                        ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

                                        ;; QUESTION SECTION:
                                        ;host3.test.ip.                 IN      A

                                        ;; Query time: 11 msec
                                        ;; SERVER: 192.168.1.253#53(192.168.1.253)
                                        ;; WHEN: Mon Jan 10 23:40:03 2011
                                        ;; MSG SIZE  rcvd: 31


                                        So seems domain override is not working??

                                        Currently running
                                        2.0-BETA5 (i386)
                                        built on Mon Jan 10 13:14:45 EST 2011

                                        Do you have "Private Address support" disabled?

                                        Follow me on twitter http://twitter.com/wagonza
                                        http://www.thepackethub.co.za

                                        1 Reply Last reply Reply Quote 0
                                        • johnpozJ
                                          johnpoz LAYER 8 Global Moderator
                                          last edited by

                                          No it needs to be enabled for host and domain override to work.. You can see from previous posts that host override works.. ie
                                          From the settings page
                                          Note: Domain Overrides and Host entries will be allowed to return answers if this option is enabled.

                                          See local overrides work just fine..

                                          ;; QUESTION SECTION:
                                          ;qs108t.local.lan.              IN      A

                                          ;; ANSWER SECTION:
                                          qs108t.local.lan.       3600    IN      A       192.168.1.128

                                          ;; Query time: 8 msec
                                          ;; SERVER: 192.168.1.253#53(192.168.1.253)
                                          ;; WHEN: Tue Jan 11 07:59:11 2011
                                          ;; MSG SIZE  rcvd: 50

                                          ;; QUESTION SECTION:
                                          ;p4-28g.local.lan.              IN      A

                                          ;; ANSWER SECTION:
                                          p4-28g.local.lan.       3600    IN      A       192.168.1.4

                                          ;; Query time: 7 msec
                                          ;; SERVER: 192.168.1.253#53(192.168.1.253)
                                          ;; WHEN: Tue Jan 11 07:59:49 2011
                                          ;; MSG SIZE  rcvd: 50

                                          but now I have a domain override set, shows up in the unbound config, the server it points to at 192.168.1.4 is running bind, clearly answers for that zone test.ip, but when you ask the pfsense box running unbound you get servfail?

                                          ;; QUESTION SECTION:
                                          ;host2.test.ip.                 IN      A

                                          ;; ANSWER SECTION:
                                          host2.test.ip.          21600   IN      A       192.168.1.100

                                          ;; AUTHORITY SECTION:
                                          test.ip.                21600   IN      NS      p4-28g.local.lan.

                                          ;; ADDITIONAL SECTION:
                                          p4-28g.local.lan.       21600   IN      A       192.168.1.4

                                          ;; Query time: 5 msec
                                          ;; SERVER: 192.168.1.4#53(192.168.1.4)
                                          ;; WHEN: Tue Jan 11 08:01:39 2011
                                          ;; MSG SIZE  rcvd: 93

                                          ; <<>> DiG 9.7.2-P3 <<>> @192.168.1.253 host2.test.ip
                                          ; (1 server found)
                                          ;; global options: +cmd
                                          ;; Got answer:
                                          ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 41300
                                          ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

                                          ;; QUESTION SECTION:
                                          ;host2.test.ip.                 IN      A

                                          ;; Query time: 32 msec
                                          ;; SERVER: 192.168.1.253#53(192.168.1.253)
                                          ;; WHEN: Tue Jan 11 08:02:10 2011
                                          ;; MSG SIZE  rcvd: 31

                                          Here are the settings from unbound, and host and domain overrides, etc.

                                          And showing that the override for the domain is listed in the unbound config.

                                          Domain overrides

                                          stub-zone:
                                          name: "test.ip"
                                          stub-addr: 192.168.1.4
                                          stub-prime: no

                                          Running snap
                                          2.0-BETA5 (i386)
                                          built on Mon Jan 10 13:14:45 EST 2011

                                          edit: on and yes I tried turning off dnssec support, same thing servfail

                                          Oh and just upgraded to last nights snap
                                          2.0-BETA5 (i386)
                                          built on Mon Jan 10 22:34:12 EST 2011

                                          Still fails - also seems to me that if your pointing pfsense to itself only (unbound) for dns in general setup, that upon update to new snap the reinstall of packages fail..

                                          unboundsettings.png_thumb
                                          unboundsettings.png
                                          overrides.png
                                          overrides.png_thumb

                                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                                          If you get confused: Listen to the Music Play
                                          Please don't Chat/PM me for help, unless mod related
                                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                                          1 Reply Last reply Reply Quote 0
                                          • W
                                            wagonza
                                            last edited by

                                            @johnpoz:

                                            but now I have a domain override set, shows up in the unbound config, the server it points to at 192.168.1.4 is running bind, clearly answers for that zone test.ip, but when you ask the pfsense box running unbound you get servfail?

                                            Ok i think i might have an idea on the problem here, can you send me your unbound.conf please? You can comment out any private data.

                                            @johnpoz:

                                            Still fails - also seems to me that if your pointing pfsense to itself only (unbound) for dns in general setup, that upon update to new snap the reinstall of packages fail..

                                            yeah it wouldnt because no name resolution can take place as unbound is not started yet.

                                            Follow me on twitter http://twitter.com/wagonza
                                            http://www.thepackethub.co.za

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.