Unbound DNS configuration

johnpoz

I do believe the default dhcp would hand out whatever dns you have set in pfsense.

post your ipconfig /all output from dhcp client and we will know for sure what its using for dns.

jan.gestre

"It appears that Unbound is not running, how can that be if Services it shows it is running and forwards requests to OpenDNS. "

Service showing it running does not actually mean its listening on that IP, maybe its only listening on loopback?

Sorry but its IMPOSSIBLE what you say, if you can not talk to your unbound box on dns port – then its not possible for it to be forwarding them opendns.

Please post the output of your clients ipconfig /all -- sorry but YOU CAN NOT point them to more than your pfsense for dns and expect it to work like you want. If you want to resolve local domains, then you have to only point to local dns.

What you're saying does not make any sense, I already posted the screenshot of Unbound DNS's configuration and it shows that it is listening on LAN (see again attached screenshot as proof). Tried forcing the clients to use pfSense's ip address as DNS server but if I do that, then the client machine loses it internet connection. When I revert the setting i.e. to receive ip address from the DHCP server, internet connection is working but when you view its connection details via ipconfig /all DNS shows OpenDNS instead that of pfSense's (please see results below).

Connection-specific DNS Suffix . : local
Description . . . . . . . . . . . : Atheros AR5B93 Wireless Network Adapter
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IPv4 Address. . . . . . . . . . . : 10.10.10.103(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Lease Obtained. . . . . . . . . . : Friday, September 23, 2011 9:43:18 PM
Lease Expires . . . . . . . . . . : Saturday, September 24, 2011 9:43:18 PM
Default Gateway . . . . . . . . . : 10.10.10.254
DHCP Server . . . . . . . . . . . : 202.67.222.222
202.67.220.220

The issue I'm having with Unbound is the same issue posted here in this link –> http://forum.pfsense.org/index.php?topic=31140.0 (pfSense RC release, thread closed) which was apparently fixed because the package maintainer (wagonza?) updated the package.

![Unbound DNS Settings.png](/public/imported_attachments/1/Unbound DNS Settings.png)
![Unbound DNS Settings.png_thumb](/public/imported_attachments/1/Unbound DNS Settings.png_thumb)

johnpoz

Dude!

You clearly showed that your pfsense box is not even listening for dns on its lan IP

@10.10.10.254 repo.domain.net
;; connection timed out; no servers could be reached

And then that ipconfig output doesn't even show any dns, so how exactly do you expect to do dns???

Connection-specific DNS Suffix . : local
Description . . . . . . . . . . . : Atheros AR5B93 Wireless Network Adapter
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IPv4 Address. . . . . . . . . . . : 10.10.10.103(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Lease Obtained. . . . . . . . . . : Friday, September 23, 2011 9:43:18 PM
Lease Expires . . . . . . . . . . : Saturday, September 24, 2011 9:43:18 PM
Default Gateway . . . . . . . . . : 10.10.10.254
DHCP Server . . . . . . . . . . . : 202.67.222.222
202.67.220.220

Also that local suffix does not look right, I would not suggest using a root tld as your local suffix, something like local.lan would be better. If you hosting boxes on domain.net, why would that not be your local dns suffix?

Please post what your clients are using for DNS from an ipconfig /all output!! And show that your pfsense box is actually listening on that lan IP for dns.. example

here is my pfsense netstat -an output showing what IPs 53 is listening on

[2.1-DEVELOPMENT][admin@pfsense.local.lan]/root(9): netstat -an
Active Internet connections (including servers)
Proto Recv-Q Send-Q Local Address Foreign Address (state)
tcp4 0 0 192.168.1.253.22 10.0.200.6.1824 ESTABLISHED
tcp4 0 0 24.13.xx.xx.443 64.43.xx.xx.43508 ESTABLISHED
tcp6 0 0 *.80 . LISTEN
tcp4 0 0 *.80 . LISTEN
tcp4 0 0 127.0.0.1.953 . LISTEN
tcp6 0 0 ::1.53 . LISTEN
tcp4 0 0 127.0.0.1.53 . LISTEN
tcp6 0 0 2001:470:snipped:b8.53 . LISTEN
tcp4 0 0 192.168.1.253.53 . LISTEN
tcp4 0 0 24.13.xx.xx.443 . LISTEN
tcp4 0 0 *.4949 . LISTEN
tcp4 0 0 *.22 . LISTEN
tcp6 0 0 *.22 . LISTEN
udp4 0 0 . .
udp4 0 0 . .
udp4 0 0 . .
udp4 0 0 . .
udp4 0 0 . .
udp6 0 0 ::1.53 .
udp4 0 0 127.0.0.1.53 .
udp6 0 0 2001:470:snipped:b8.53 .
udp4 0 0 192.168.1.253.53 .
udp4 0 0 192.168.1.253.42571 192.168.1.4.123
udp4 0 0 127.0.0.1.123 .
udp4 0 0 192.168.1.253.123 .
udp4 0 0 192.168.1.253.161 .
udp4 0 0 . .
udp4 0 0 127.0.0.1.6969 .
udp4 0 0 .514 .
udp6 0 0 .514 .
icm4 0 0 24.13.xx.xx. .
icm6 0 0 2001:470:snipped:b8. .
icm6 0 0 . .

I snipped out my public ipv4 and my public ipv6 addresses

and as you can clearly see from – Im listening on 192.168.1.253 on udp and tcp 53, and that is where my client points for dns

C:\Windows\System32>ipconfig /all

Windows IP Configuration

Host Name . . . . . . . . . . . . : i5-w7
Primary Dns Suffix . . . . . . . : local.lan
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : local.lan

Ethernet adapter gig:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Broadcom NetLink (TM) Gigabit Ethernet
Physical Address. . . . . . . . . : 18-03-73-B1-0D-D3
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
IPv6 Address. . . . . . . . . . . : 2001:470:snipped:b85::666(Preferred)
Link-local IPv6 Address . . . . . : fe80::21c9:720e:aea5:37e9%11(Preferred)
IPv4 Address. . . . . . . . . . . : 192.168.1.100(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 2001:470:snipped:b85::1
192.168.1.253
DNS Servers . . . . . . . . . . . : 2001:470:snipped:b85::1
192.168.1.253
NetBIOS over Tcpip. . . . . . . . : Enabled

C:\Windows\System32>

**edit: btw does your dhcp servers being listed as public IPs?

DHCP Server . . . . . . . . . . . : 202.67.222.222
202.67.220.220

Connection-specific DNS Suffix . : local
Description . . . . . . . . . . . : Atheros AR5B93 Wireless Network Adapter
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IPv4 Address. . . . . . . . . . . : 10.10.10.103(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Lease Obtained. . . . . . . . . . : Friday, September 23, 2011 9:43:18 PM
Lease Expires . . . . . . . . . . : Saturday, September 24, 2011 9:43:18 PM
Default Gateway . . . . . . . . . : 10.10.10.254
DHCP Server . . . . . . . . . . . : 202.67.222.222
202.67.220.220

OH – YOU EDITED it??? to show DHCP vs DNS??? Those are opendns IPs are they not??**

That client is never going to ask your pfsense box anything about DNS if those 202 addresses are you dns vs what your output says is you have 2 dhcp servers???

jan.gestre

Ignore the ipconfig /all results, just wanted to show you that it's pointing to OpenDNS and not pfSense's, I'm not in the office anymore, hope you get what I mean.

Anyways, just SSH to pfSense now and this is netstat's output:

[2.0-RELEASE][root@fw.domain.lan]/root(1): netstat -an
Active Internet connections (including servers)
Proto Recv-Q Send-Q Local Address Foreign Address (state)
tcp4 0 0 10.10.10.254.22222 10.10.10.3.50141 ESTABLISHED
tcp4 0 0 127.0.0.1.953 . LISTEN
tcp4 0 0 10.10.10.254.53 . LISTEN
tcp4 0 0 *.80 . LISTEN
tcp4 0 0 *.4343 . LISTEN
tcp4 0 0 *.22222 . LISTEN
tcp6 0 0 *.22222 . LISTEN
udp4 0 0 12x.xx.1xx.26.41858 69.xx.xx.29.123
udp4 0 0 12x.xx.1xx.26.57824 69.xx.xx9.51.123
udp4 0 0 12x.xx.1xx.26.21195 65.1xx.224.60.123
udp4 0 0 10.10.10.254.123 .
udp4 0 0 *.67 .
udp6 0 0 *.60356 .
udp4 0 0 *.56121 .
udp4 0 0 *.514 .
udp6 0 0 .514 .
udp4 0 0 10.10.10.254.53 .
udp4 0 0 . .
udp4 0 0 . .
udp4 0 0 127.0.0.1.6969 .
icm4 0 0 . .
icm4 0 0 12x.xx.1xx.26. .

As you can see, it's listening on both TCP/UDP on port 53

–-

_OH – YOU EDITED it??? to show DHCP vs DNS??? Those are opendns IPs are they not??

That client is never going to ask your pfsense box anything about DNS if those 202 addresses are you dns vs what your output says is you have 2 dhcp servers???_

As I've said I'm not in the office anymore, but what I'm trying to show you is a replica of the configuration when I was behind pfSense.

What I can't understand is why is pfSense's DHCP server leasing/giving OpenDNS's ip address instead of its own, note they were not manual configured, they were provided by DHCP.

When using DNSmasq, client gets pfSense's ip address as DNS server but when Unbound is enabled, it points to OpenDNS instead of its own.

johnpoz

Well if your listening why can you not connect? Firewall rule, acl in unbound.

As to why your pfsense box is not handing out itself in dhcp.

I am currently not running the pfsense dhpc, but from this statement in the dhcp server section under where you put dns.

NOTE: leave blank to use the system default DNS servers - this interface's IP if DNS forwarder is enabled, otherwise the servers configured on the General page.

Did you put in the pfsense IP? If you left it blank then it would hand out whatever you have setup for pfsense to use for dns - or what your pfsense box got from your ISP maybe.

tebeve

Actually, as I learned in this thread over on the IPv6 board, from wagonza… "There is currently no integration between DHCP and Unbound…"

@wagonza:

There is currently no integration between DHCP and Unbound, in other words you will need to assign the IPs you want given o your DHCP clients by manually configuring them in the DHCP configuration page. Currently the way v4+v6 works is that when the DHCP service is set up it checks for:

Manually configured DNS servers and assigns those, if those are not configured

It then checks to see if dnsmasq is enabled. If it is enabled, it assigns the IP(s) configured on the LAN. If it is not enabled

it assigns the DNS servers configured in System->General Setup to the DHCP clients.

I know databeestje has also mentioned some other rtadvd fixes that he is looking into fixing, but the above still stands until Unbound is fully integrated. Which I guess is now becoming a necessity…so best I get cracking :)

This holds true for both IPv4 & IPv6 I believe.

So on the DHCP config page, under the DNS server fields, just put your pfSense box IP not the openDNS server addresses, clients will then use the pfSense box, which in turn will use the Unbound config to look up local entries then roll to the DNS servers listed on the System : General Setup -> DNS settings for all external lookups…. I think this is what johnpoz has been trying to get at.

jan.gestre

@tebeve:

Actually, as I learned in this thread over on the IPv6 board, from wagonza… "There is currently no integration between DHCP and Unbound…"

@wagonza:

There is currently no integration between DHCP and Unbound, in other words you will need to assign the IPs you want given o your DHCP clients by manually configuring them in the DHCP configuration page. Currently the way v4+v6 works is that when the DHCP service is set up it checks for:

Manually configured DNS servers and assigns those, if those are not configured

It then checks to see if dnsmasq is enabled. If it is enabled, it assigns the IP(s) configured on the LAN. If it is not enabled

it assigns the DNS servers configured in System->General Setup to the DHCP clients.

I know databeestje has also mentioned some other rtadvd fixes that he is looking into fixing, but the above still stands until Unbound is fully integrated. Which I guess is now becoming a necessity…so best I get cracking :)

This holds true for both IPv4 & IPv6 I believe.

So on the DHCP config page, under the DNS server fields, just put your pfSense box IP not the openDNS server addresses, clients will then use the pfSense box, which in turn will use the Unbound config to look up local entries then roll to the DNS servers listed on the System : General Setup -> DNS settings for all external lookups…. I think this is what johnpoz has been trying to get at.

Thanks everyone, especially tebeve, that practically did it. I guess someone has to update the Unbound DNS wiki page.

johnpoz

"I guess someone has to update the Unbound DNS wiki page."

Why??? WTF does unbound config or wiki have to do with what your dhcp server hands out for dns??

What is required is some basic understanding of what dns is and what dhcp does.

jan.gestre

@johnpoz:

"I guess someone has to update the Unbound DNS wiki page."

Why??? WTF does unbound config or wiki have to do with what your dhcp server hands out for dns??

What is required is some basic understanding of what dns is and what dhcp does.

Watch your language! What did I say to you to deserve that! Isn't it obvious, there is a need to update! If you don't get it I guess you don't understand what I'm saying, if you don't have anything good to say, just keep it to yourself!

jan.gestre

@madapaka:

@tebeve:

Actually, as I learned in this thread over on the IPv6 board, from wagonza… "There is currently no integration between DHCP and Unbound…"

@wagonza:

There is currently no integration between DHCP and Unbound, in other words you will need to assign the IPs you want given o your DHCP clients by manually configuring them in the DHCP configuration page. Currently the way v4+v6 works is that when the DHCP service is set up it checks for:

Manually configured DNS servers and assigns those, if those are not configured

It then checks to see if dnsmasq is enabled. If it is enabled, it assigns the IP(s) configured on the LAN. If it is not enabled

it assigns the DNS servers configured in System->General Setup to the DHCP clients.

I know databeestje has also mentioned some other rtadvd fixes that he is looking into fixing, but the above still stands until Unbound is fully integrated. Which I guess is now becoming a necessity…so best I get cracking :)

This holds true for both IPv4 & IPv6 I believe.

So on the DHCP config page, under the DNS server fields, just put your pfSense box IP not the openDNS server addresses, clients will then use the pfSense box, which in turn will use the Unbound config to look up local entries then roll to the DNS servers listed on the System : General Setup -> DNS settings for all external lookups…. I think this is what johnpoz has been trying to get at.

Thanks everyone, especially tebeve, that practically did it. I guess someone has to update the Unbound DNS wiki page.

Spoke too soon, when I rebooted pfSense, it's no longer working, reverted to the old config, at least it's working although not like it's supposed to be.

tebeve

@madapaka:

@madapaka:

@tebeve:

Actually, as I learned in this thread over on the IPv6 board, from wagonza… "There is currently no integration between DHCP and Unbound…"

@wagonza:

There is currently no integration between DHCP and Unbound, in other words you will need to assign the IPs you want given o your DHCP clients by manually configuring them in the DHCP configuration page. Currently the way v4+v6 works is that when the DHCP service is set up it checks for:

Manually configured DNS servers and assigns those, if those are not configured

It then checks to see if dnsmasq is enabled. If it is enabled, it assigns the IP(s) configured on the LAN. If it is not enabled

it assigns the DNS servers configured in System->General Setup to the DHCP clients.

I know databeestje has also mentioned some other rtadvd fixes that he is looking into fixing, but the above still stands until Unbound is fully integrated. Which I guess is now becoming a necessity…so best I get cracking :)

This holds true for both IPv4 & IPv6 I believe.

So on the DHCP config page, under the DNS server fields, just put your pfSense box IP not the openDNS server addresses, clients will then use the pfSense box, which in turn will use the Unbound config to look up local entries then roll to the DNS servers listed on the System : General Setup -> DNS settings for all external lookups…. I think this is what johnpoz has been trying to get at.

Thanks everyone, especially tebeve, that practically did it. I guess someone has to update the Unbound DNS wiki page.

Spoke too soon, when I rebooted pfSense, it's no longer working, reverted to the old config, at least it's working although not like it's supposed to be.

@madapaka - Just FYI… as per my mention of this other thread on the IPv6 board, wagonza has updated the Unbound package. Maybe this might help your issues.

EDIT: sorry, got my threads mixed up… the fix applied to the unbound package was for a different issue. My bad.