Unbound DNS configuration
-
It's working but not the way I want it to be, it is suppose to be asking OpenDNS only if the query is intended outside of LAN, however this is not the case here, I'm not sure what I'm missing here.
Here's the host entries as shown in Unbound's status page:
Host entries
local-zone: "domain.lan" transparent
local-data-ptr: "127.0.0.1 localhost"
local-data: "localhost A 127.0.0.1"
local-data: "localhost.domain.lan A 127.0.0.1"
local-data-ptr: "10.10.10.254 fw.domain.lan"
local-data: "fw.domain.lan A 10.10.10.254"
local-data: "fw A 10.10.10.254"
local-data-ptr: "10.10.10.3 repo.domain.net"
local-data: "repo.domain.net IN A 10.10.10.3"
local-data-ptr: "10.10.10.181 sandbox.domain.net"
local-data: "sandbox.domain.net IN A 10.10.10.181"Having a .net domain aside from the default .lan does not matter, right?
Could you show me a screenshot of your Unbound DNS configuration, or you could point out what's wrong with my configuration as shown in the screenshots provided.
Many thanks!
 -
"it is suppose to be asking OpenDNS only if the query is intended outside of LAN"
What??
Your clients "pc" should have 1 dns entry and that is your unbound box. If you point your client at more than 1 dns you have know idea which one it will use. You just don't, its not like it will ask opendns for google.com and your unbound box for domain.lan
You have your unbound setup as your forwarder, the way it suppose to work is your client asks unbound for all its dns, if unbound knows about the domain/record then it answers, if not then it goes and asks the roots and does the lookup for the client.
If you just want to ask opendns for stuff that is not on your local domain then you need to check what you have unchecked "enable forwarding mode" Then it will ask whatever servers you have pfsense setup to use vs doing its own recursive lookups. But the power of unbound is having it do the looksup for you, not just a dumb forwarder if you ask me. If you just want a forwarder you and use the built in for that.
Again "PC's connected shows OpenDNS as DNS server instead of the ip address of pfSense" this is your issue not your unbound config.
-
"it is suppose to be asking OpenDNS only if the query is intended outside of LAN"
What??
Your clients "pc" should have 1 dns entry and that is your unbound box. If you point your client at more than 1 dns you have know idea which one it will use. You just don't, its not like it will ask opendns for google.com and your unbound box for domain.lan
You have your unbound setup as your forwarder, the way it suppose to work is your client asks unbound for all its dns, if unbound knows about the domain/record then it answers, if not then it goes and asks the roots and does the lookup for the client.
If you just want to ask opendns for stuff that is not on your local domain then you need to check what you have unchecked "enable forwarding mode" Then it will ask whatever servers you have pfsense setup to use vs doing its own recursive lookups. But the power of unbound is having it do the looksup for you, not just a dumb forwarder if you ask me. If you just want a forwarder you and use the built in for that.
Again "PC's connected shows OpenDNS as DNS server instead of the ip address of pfSense" this is your issue not your unbound config.
Yes, I know how it is supposed to work, that is why I'm asking if there's something not right with my Unbound configuration. If you noticed, the DNS forwarding option is not ticked, this is to force the client to resolve first using Unbound, correct?
Also, if I used the default DNSmasq instead, I have no problem, the dhcp client's ip configuration is what it is supposed to be, i.e. gateway and dns server points to the ip address of pfSense, and clients can resolve the FQDN of the local servers properly, unfortunately when I used Unbound (disabled DNSmasq), it's a different story altogether, the client machines sees OpenDNS instead of pfSense's.
-
The issue I'm experiencing is basically the same as in this thread –> http://forum.pfsense.org/index.php?topic=31140.0, which is just basically straightforward, if the package is already fixed (Dec 2010) so it will work with the just released 2.0. I've already tried various configuration possible on both General:Setup and Unbound, nothing seems to work. Another odd thing is that when I tried to resolve using dig @ip.add.ress of pfSense repo.domain.net ,
dig @10.10.10.254 repo.domain.net
; <<>> DiG 9.5.2-RedHat-9.5.2-1.fc10 <<>> @10.10.10.254 repo.domain.net
; (1 server found)
;; global options: printcmd
;; connection timed out; no servers could be reachedIt appears that Unbound is not running, how can that be if Services it shows it is running and forwards requests to OpenDNS.
Weird!
-
@madapaka:
Also, if I used the default DNSmasq instead, I have no problem, the dhcp client's ip configuration is what it is supposed to be, i.e. gateway and dns server points to the ip address of pfSense, and clients can resolve the FQDN of the local servers properly, unfortunately when I used Unbound (disabled DNSmasq), it's a different story altogether, the client machines sees OpenDNS instead of pfSense's.
Sounds like a DHCP configuration issue.
-
"It appears that Unbound is not running, how can that be if Services it shows it is running and forwards requests to OpenDNS. "
Service showing it running does not actually mean its listening on that IP, maybe its only listening on loopback?
Sorry but its IMPOSSIBLE what you say, if you can not talk to your unbound box on dns port – then its not possible for it to be forwarding them opendns.
Please post the output of your clients ipconfig /all -- sorry but YOU CAN NOT point them to more than your pfsense for dns and expect it to work like you want. If you want to resolve local domains, then you have to only point to local dns.
-
@madapaka:
Also, if I used the default DNSmasq instead, I have no problem, the dhcp client's ip configuration is what it is supposed to be, i.e. gateway and dns server points to the ip address of pfSense, and clients can resolve the FQDN of the local servers properly, unfortunately when I used Unbound (disabled DNSmasq), it's a different story altogether, the client machines sees OpenDNS instead of pfSense's.
Sounds like a DHCP configuration issue.
The DHCP server's configuration are just defaults except the range of ip addresses leases, and I think if there was something wrong, DNSmasq would not work either, but that is not the case.
-
I do believe the default dhcp would hand out whatever dns you have set in pfsense.
post your ipconfig /all output from dhcp client and we will know for sure what its using for dns.
-
"It appears that Unbound is not running, how can that be if Services it shows it is running and forwards requests to OpenDNS. "
Service showing it running does not actually mean its listening on that IP, maybe its only listening on loopback?
Sorry but its IMPOSSIBLE what you say, if you can not talk to your unbound box on dns port – then its not possible for it to be forwarding them opendns.
Please post the output of your clients ipconfig /all -- sorry but YOU CAN NOT point them to more than your pfsense for dns and expect it to work like you want. If you want to resolve local domains, then you have to only point to local dns.
What you're saying does not make any sense, I already posted the screenshot of Unbound DNS's configuration and it shows that it is listening on LAN (see again attached screenshot as proof). Tried forcing the clients to use pfSense's ip address as DNS server but if I do that, then the client machine loses it internet connection. When I revert the setting i.e. to receive ip address from the DHCP server, internet connection is working but when you view its connection details via ipconfig /all DNS shows OpenDNS instead that of pfSense's (please see results below).
Connection-specific DNS Suffix . : local
Description . . . . . . . . . . . : Atheros AR5B93 Wireless Network Adapter
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IPv4 Address. . . . . . . . . . . : 10.10.10.103(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Lease Obtained. . . . . . . . . . : Friday, September 23, 2011 9:43:18 PM
Lease Expires . . . . . . . . . . : Saturday, September 24, 2011 9:43:18 PM
Default Gateway . . . . . . . . . : 10.10.10.254
DHCP Server . . . . . . . . . . . : 202.67.222.222
202.67.220.220The issue I'm having with Unbound is the same issue posted here in this link –> http://forum.pfsense.org/index.php?topic=31140.0 (pfSense RC release, thread closed) which was apparently fixed because the package maintainer (wagonza?) updated the package.
 -
Dude!
You clearly showed that your pfsense box is not even listening for dns on its lan IP
@10.10.10.254 repo.domain.net
;; connection timed out; no servers could be reachedAnd then that ipconfig output doesn't even show any dns, so how exactly do you expect to do dns???
Connection-specific DNS Suffix . : local
Description . . . . . . . . . . . : Atheros AR5B93 Wireless Network Adapter
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IPv4 Address. . . . . . . . . . . : 10.10.10.103(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Lease Obtained. . . . . . . . . . : Friday, September 23, 2011 9:43:18 PM
Lease Expires . . . . . . . . . . : Saturday, September 24, 2011 9:43:18 PM
Default Gateway . . . . . . . . . : 10.10.10.254
DHCP Server . . . . . . . . . . . : 202.67.222.222
202.67.220.220
Also that local suffix does not look right, I would not suggest using a root tld as your local suffix, something like local.lan would be better. If you hosting boxes on domain.net, why would that not be your local dns suffix?
Please post what your clients are using for DNS from an ipconfig /all output!! And show that your pfsense box is actually listening on that lan IP for dns.. example
here is my pfsense netstat -an output showing what IPs 53 is listening on
[2.1-DEVELOPMENT][admin@pfsense.local.lan]/root(9): netstat -an
Active Internet connections (including servers)
Proto Recv-Q Send-Q Local Address Foreign Address (state)
tcp4 0 0 192.168.1.253.22 10.0.200.6.1824 ESTABLISHED
tcp4 0 0 24.13.xx.xx.443 64.43.xx.xx.43508 ESTABLISHED
tcp6 0 0 *.80 . LISTEN
tcp4 0 0 *.80 . LISTEN
tcp4 0 0 127.0.0.1.953 . LISTEN
tcp6 0 0 ::1.53 . LISTEN
tcp4 0 0 127.0.0.1.53 . LISTEN
tcp6 0 0 2001:470:snipped:b8.53 . LISTEN
tcp4 0 0 192.168.1.253.53 . LISTEN
tcp4 0 0 24.13.xx.xx.443 . LISTEN
tcp4 0 0 *.4949 . LISTEN
tcp4 0 0 *.22 . LISTEN
tcp6 0 0 *.22 . LISTEN
udp4 0 0 . .
udp4 0 0 . .
udp4 0 0 . .
udp4 0 0 . .
udp4 0 0 . .
udp6 0 0 ::1.53 .
udp4 0 0 127.0.0.1.53 .
udp6 0 0 2001:470:snipped:b8.53 .
udp4 0 0 192.168.1.253.53 .
udp4 0 0 192.168.1.253.42571 192.168.1.4.123
udp4 0 0 127.0.0.1.123 .
udp4 0 0 192.168.1.253.123 .
udp4 0 0 192.168.1.253.161 .
udp4 0 0 . .
udp4 0 0 127.0.0.1.6969 .
udp4 0 0 .514 .
udp6 0 0 .514 .
icm4 0 0 24.13.xx.xx. .
icm6 0 0 2001:470:snipped:b8. .
icm6 0 0 . .I snipped out my public ipv4 and my public ipv6 addresses
and as you can clearly see from – Im listening on 192.168.1.253 on udp and tcp 53, and that is where my client points for dns
C:\Windows\System32>ipconfig /all
Windows IP Configuration
Host Name . . . . . . . . . . . . : i5-w7
Primary Dns Suffix . . . . . . . : local.lan
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : local.lanEthernet adapter gig:
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Broadcom NetLink (TM) Gigabit Ethernet
Physical Address. . . . . . . . . : 18-03-73-B1-0D-D3
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
IPv6 Address. . . . . . . . . . . : 2001:470:snipped:b85::666(Preferred)
Link-local IPv6 Address . . . . . : fe80::21c9:720e:aea5:37e9%11(Preferred)
IPv4 Address. . . . . . . . . . . : 192.168.1.100(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 2001:470:snipped:b85::1
192.168.1.253
DNS Servers . . . . . . . . . . . : 2001:470:snipped:b85::1
192.168.1.253
NetBIOS over Tcpip. . . . . . . . : EnabledC:\Windows\System32>
**edit: btw does your dhcp servers being listed as public IPs?
DHCP Server . . . . . . . . . . . : 202.67.222.222
202.67.220.220
Connection-specific DNS Suffix . : local
Description . . . . . . . . . . . : Atheros AR5B93 Wireless Network Adapter
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IPv4 Address. . . . . . . . . . . : 10.10.10.103(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Lease Obtained. . . . . . . . . . : Friday, September 23, 2011 9:43:18 PM
Lease Expires . . . . . . . . . . : Saturday, September 24, 2011 9:43:18 PM
Default Gateway . . . . . . . . . : 10.10.10.254
DHCP Server . . . . . . . . . . . : 202.67.222.222
202.67.220.220
OH – YOU EDITED it??? to show DHCP vs DNS??? Those are opendns IPs are they not??**
That client is never going to ask your pfsense box anything about DNS if those 202 addresses are you dns vs what your output says is you have 2 dhcp servers???
-
Ignore the ipconfig /all results, just wanted to show you that it's pointing to OpenDNS and not pfSense's, I'm not in the office anymore, hope you get what I mean.
Anyways, just SSH to pfSense now and this is netstat's output:
[2.0-RELEASE][root@fw.domain.lan]/root(1): netstat -an
Active Internet connections (including servers)
Proto Recv-Q Send-Q Local Address Foreign Address (state)
tcp4 0 0 10.10.10.254.22222 10.10.10.3.50141 ESTABLISHED
tcp4 0 0 127.0.0.1.953 . LISTEN
tcp4 0 0 10.10.10.254.53 . LISTEN
tcp4 0 0 *.80 . LISTEN
tcp4 0 0 *.4343 . LISTEN
tcp4 0 0 *.22222 . LISTEN
tcp6 0 0 *.22222 . LISTEN
udp4 0 0 12x.xx.1xx.26.41858 69.xx.xx.29.123
udp4 0 0 12x.xx.1xx.26.57824 69.xx.xx9.51.123
udp4 0 0 12x.xx.1xx.26.21195 65.1xx.224.60.123
udp4 0 0 10.10.10.254.123 .
udp4 0 0 *.67 .
udp6 0 0 *.60356 .
udp4 0 0 *.56121 .
udp4 0 0 *.514 .
udp6 0 0 .514 .
udp4 0 0 10.10.10.254.53 .
udp4 0 0 . .
udp4 0 0 . .
udp4 0 0 127.0.0.1.6969 .
icm4 0 0 . .
icm4 0 0 12x.xx.1xx.26. .As you can see, it's listening on both TCP/UDP on port 53
–-
_OH – YOU EDITED it??? to show DHCP vs DNS??? Those are opendns IPs are they not??
That client is never going to ask your pfsense box anything about DNS if those 202 addresses are you dns vs what your output says is you have 2 dhcp servers???_
As I've said I'm not in the office anymore, but what I'm trying to show you is a replica of the configuration when I was behind pfSense.
What I can't understand is why is pfSense's DHCP server leasing/giving OpenDNS's ip address instead of its own, note they were not manual configured, they were provided by DHCP.
When using DNSmasq, client gets pfSense's ip address as DNS server but when Unbound is enabled, it points to OpenDNS instead of its own.
-
Well if your listening why can you not connect? Firewall rule, acl in unbound.
As to why your pfsense box is not handing out itself in dhcp.
I am currently not running the pfsense dhpc, but from this statement in the dhcp server section under where you put dns.
NOTE: leave blank to use the system default DNS servers - this interface's IP if DNS forwarder is enabled, otherwise the servers configured on the General page.
Did you put in the pfsense IP? If you left it blank then it would hand out whatever you have setup for pfsense to use for dns - or what your pfsense box got from your ISP maybe.
-
Actually, as I learned in this thread over on the IPv6 board, from wagonza… "There is currently no integration between DHCP and Unbound…"
There is currently no integration between DHCP and Unbound, in other words you will need to assign the IPs you want given o your DHCP clients by manually configuring them in the DHCP configuration page. Currently the way v4+v6 works is that when the DHCP service is set up it checks for:
- Manually configured DNS servers and assigns those, if those are not configured
- It then checks to see if dnsmasq is enabled. If it is enabled, it assigns the IP(s) configured on the LAN. If it is not enabled
- it assigns the DNS servers configured in System->General Setup to the DHCP clients.
I know databeestje has also mentioned some other rtadvd fixes that he is looking into fixing, but the above still stands until Unbound is fully integrated. Which I guess is now becoming a necessity…so best I get cracking :)
This holds true for both IPv4 & IPv6 I believe.
So on the DHCP config page, under the DNS server fields, just put your pfSense box IP not the openDNS server addresses, clients will then use the pfSense box, which in turn will use the Unbound config to look up local entries then roll to the DNS servers listed on the System : General Setup -> DNS settings for all external lookups…. I think this is what johnpoz has been trying to get at.
-
Actually, as I learned in this thread over on the IPv6 board, from wagonza… "There is currently no integration between DHCP and Unbound…"
There is currently no integration between DHCP and Unbound, in other words you will need to assign the IPs you want given o your DHCP clients by manually configuring them in the DHCP configuration page. Currently the way v4+v6 works is that when the DHCP service is set up it checks for:
- Manually configured DNS servers and assigns those, if those are not configured
- It then checks to see if dnsmasq is enabled. If it is enabled, it assigns the IP(s) configured on the LAN. If it is not enabled
- it assigns the DNS servers configured in System->General Setup to the DHCP clients.
I know databeestje has also mentioned some other rtadvd fixes that he is looking into fixing, but the above still stands until Unbound is fully integrated. Which I guess is now becoming a necessity…so best I get cracking :)
This holds true for both IPv4 & IPv6 I believe.
So on the DHCP config page, under the DNS server fields, just put your pfSense box IP not the openDNS server addresses, clients will then use the pfSense box, which in turn will use the Unbound config to look up local entries then roll to the DNS servers listed on the System : General Setup -> DNS settings for all external lookups…. I think this is what johnpoz has been trying to get at.
Thanks everyone, especially tebeve, that practically did it. I guess someone has to update the Unbound DNS wiki page.
-
"I guess someone has to update the Unbound DNS wiki page."
Why??? WTF does unbound config or wiki have to do with what your dhcp server hands out for dns??
What is required is some basic understanding of what dns is and what dhcp does.
-
"I guess someone has to update the Unbound DNS wiki page."
Why??? WTF does unbound config or wiki have to do with what your dhcp server hands out for dns??
What is required is some basic understanding of what dns is and what dhcp does.
Watch your language! What did I say to you to deserve that! Isn't it obvious, there is a need to update! If you don't get it I guess you don't understand what I'm saying, if you don't have anything good to say, just keep it to yourself!
-
@madapaka:
Actually, as I learned in this thread over on the IPv6 board, from wagonza… "There is currently no integration between DHCP and Unbound…"
There is currently no integration between DHCP and Unbound, in other words you will need to assign the IPs you want given o your DHCP clients by manually configuring them in the DHCP configuration page. Currently the way v4+v6 works is that when the DHCP service is set up it checks for:
- Manually configured DNS servers and assigns those, if those are not configured
- It then checks to see if dnsmasq is enabled. If it is enabled, it assigns the IP(s) configured on the LAN. If it is not enabled
- it assigns the DNS servers configured in System->General Setup to the DHCP clients.
I know databeestje has also mentioned some other rtadvd fixes that he is looking into fixing, but the above still stands until Unbound is fully integrated. Which I guess is now becoming a necessity…so best I get cracking :)
This holds true for both IPv4 & IPv6 I believe.
So on the DHCP config page, under the DNS server fields, just put your pfSense box IP not the openDNS server addresses, clients will then use the pfSense box, which in turn will use the Unbound config to look up local entries then roll to the DNS servers listed on the System : General Setup -> DNS settings for all external lookups…. I think this is what johnpoz has been trying to get at.
Thanks everyone, especially tebeve, that practically did it. I guess someone has to update the Unbound DNS wiki page.
Spoke too soon, when I rebooted pfSense, it's no longer working, reverted to the old config, at least it's working although not like it's supposed to be.
-
@madapaka:
@madapaka:
Actually, as I learned in this thread over on the IPv6 board, from wagonza… "There is currently no integration between DHCP and Unbound…"
There is currently no integration between DHCP and Unbound, in other words you will need to assign the IPs you want given o your DHCP clients by manually configuring them in the DHCP configuration page. Currently the way v4+v6 works is that when the DHCP service is set up it checks for:
- Manually configured DNS servers and assigns those, if those are not configured
- It then checks to see if dnsmasq is enabled. If it is enabled, it assigns the IP(s) configured on the LAN. If it is not enabled
- it assigns the DNS servers configured in System->General Setup to the DHCP clients.
I know databeestje has also mentioned some other rtadvd fixes that he is looking into fixing, but the above still stands until Unbound is fully integrated. Which I guess is now becoming a necessity…so best I get cracking :)
This holds true for both IPv4 & IPv6 I believe.
So on the DHCP config page, under the DNS server fields, just put your pfSense box IP not the openDNS server addresses, clients will then use the pfSense box, which in turn will use the Unbound config to look up local entries then roll to the DNS servers listed on the System : General Setup -> DNS settings for all external lookups…. I think this is what johnpoz has been trying to get at.
Thanks everyone, especially tebeve, that practically did it. I guess someone has to update the Unbound DNS wiki page.
Spoke too soon, when I rebooted pfSense, it's no longer working, reverted to the old config, at least it's working although not like it's supposed to be.
@madapaka - Just FYI… as per my mention of this other thread on the IPv6 board, wagonza has updated the Unbound package. Maybe this might help your issues.
EDIT: sorry, got my threads mixed up… the fix applied to the unbound package was for a different issue. My bad.
