Weirdester [sorry] DNS issue, appending local domain to querries inconsistently

mechtheist

Thank you for johnpoz for all that effort.

pfsense is connected directly to a timewarner cablemodem

My DNSs:
127.0.0.1
70.85.0.141
129.115.102.150
67.214.64.27
199.192.200.41

I tried the DNScache setting in browser and it did not help, I didn't think it would because a new firefox install exhibited this anomalous behavior on its first URL attemp, which was www.freebsd.org.

Early on, I did have freebsd getting blocked, that was an early confounding/confusing element in the really overcrowded mix of issues, it is blocked in the iblockads list, with 'Maven Networks:8.8.178.0-8.8.178.255' listing, don't know anything about that, just deleted that line. Since I can browse to that site on the PCs I set 8.8.8.8 as preferred DNS, and can browse there on some of the PCs with pfsense as primary some of the time also, it definitely isn't getting blocked. ALL systems using pfsense as first DNS all exhibit anomalies, they are inconsistent and intermittent.

This install is the 3rd try, the first two lasted a few days and I couldn't get certain things right in them, so this is third, neither had this issue, and this install was working for a few days before I tried to install blocker using the host file from http://winhelp2002.mvps.org/hosts.htm, designed to block sites using the hosts file in windows, it is a long list of sites all directed to 127.0.0.1 in order to block them. pfblocker didn't seem able to parse the file since it wasn't blocking the sites, so I went with some of the iblock lists. I keep bringing this up because of the timing, the problem started after I tried that hosts file in pfblocker, which had been removed and substituted with the iblock lists, and I've turned blocker off, and none of this stopped this behavior.

So, the PC I'm on right now and 8.8.8.8 set for DNS, so it was working fine, I just set it back to 10.0.0.1-the lan address for pfsense. From a windows command line I got this[173.174.xx.xx is my external IP]:

C:\Windows\System32>nslookup www.freebsd.org
Server:  pfsense.MYDOMAIN.org
Address:  10.0.0.1

Non-authoritative answer:
Name:    www.freebsd.org.MYDOMAIN.org
Address:  173.174.xx.xx

C:\Windows\System32>dig www.freebsd.org

; <<>> DiG 9.9.2 <<>> www.freebsd.org
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 17195
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 13, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.freebsd.org.               IN      A

;; AUTHORITY SECTION:
.                       518400  IN      NS      J.ROOT-SERVERS.NET.
.                       518400  IN      NS      K.ROOT-SERVERS.NET.
.                       518400  IN      NS      L.ROOT-SERVERS.NET.
.                       518400  IN      NS      M.ROOT-SERVERS.NET.
.                       518400  IN      NS      A.ROOT-SERVERS.NET.
.                       518400  IN      NS      B.ROOT-SERVERS.NET.
.                       518400  IN      NS      C.ROOT-SERVERS.NET.
.                       518400  IN      NS      D.ROOT-SERVERS.NET.
.                       518400  IN      NS      E.ROOT-SERVERS.NET.
.                       518400  IN      NS      F.ROOT-SERVERS.NET.
.                       518400  IN      NS      G.ROOT-SERVERS.NET.
.                       518400  IN      NS      H.ROOT-SERVERS.NET.
.                       518400  IN      NS      I.ROOT-SERVERS.NET.

;; Query time: 435 msec
;; SERVER: 10.0.0.1#53(10.0.0.1)
;; WHEN: Sat Jan 12 17:47:01 2013
;; MSG SIZE  rcvd: 255

C:\Windows\System32>nslookup www.freebsd.org.
Server:  pfsense.MYDOMAIN.org
Address:  10.0.0.1

Name:    www.freebsd.org
Served by:
- L.ROOT-SERVERS.NET
- M.ROOT-SERVERS.NET
- A.ROOT-SERVERS.NET
- B.ROOT-SERVERS.NET
- C.ROOT-SERVERS.NET
- D.ROOT-SERVERS.NET
- E.ROOT-SERVERS.NET
- F.ROOT-SERVERS.NET
- G.ROOT-SERVERS.NET
- H.ROOT-SERVERS.NET
C:\Windows\System32>ipconfig /flushdns

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.
C:\Windows\System32>nslookup www.freebsd.org
Server:  pfsense.MYDOMAIN.org
Address:  10.0.0.1

Non-authoritative answer:
Name:    www.freebsd.org.MYDOMAIN.org
Address:  173.174.xx.xx

Notice the flushing DNS and the period at the end of the nslookup when it seems to behave normally, and the anomalous when their is no period. And the browser shows "Pale Moon can't find the server at www.freebsd.org."

I just did another flush and this time freebsd.org comes up in the browser!!!! arrrggghhh^googol,
But, trying another high-failure rate www.ip-adress.com, and that fails. Looking at the wireshark captured data, the DNS queries for the successful and the failed www.freebsd.org are the same:
www.freebsd.org: type A, class IN

This is flushing DNS and what the command line sees:

C:\Windows\System32>ipconfig /flushdns

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

C:\Windows\System32>nslookup www.ip-adress.com
Server:  pfsense.MYDOMAIN.org
Address:  10.0.0.1

Non-authoritative answer:
Name:    www.ip-adress.com.MYDOMAIN.org
Address:  173.174.xx.xx

C:\Windows\System32>nslookup www.ip-adress.com.
Server:  pfsense.MYDOMAIN.org
Address:  10.0.0.1

Non-authoritative answer:
Name:    www.ip-adress.com
Address:  64.34.169.244

The search for ip-adress.com without the period is the same as for freebsd, but with the period it is looking for AAAA records (ipv6)

This behavior seems perverse, it changed while I writing this post, the browser has:
network.dnsCacheExpiration;0
I flushed the DNS before both the successful and unsuccessful freebsd attempt. NOW, I reset-to checked-the 'append parent suffixes of the primary DNS suffix' in the advanced dns config settings for the NIC/connection, I did this because I hadn't seen any queries with the mydomain appended as I had seen before, this is within 10 minutes of the above 'not-working' to 'working' on freebsd, and now it again couldn't get to freebsd, AND it could find ip-adress, another random sitcheroo. Of note, when I tried freebsd addresses, there was NO query to pfsense!!!!!??????!!!!!.

I want to go home, [but [i]leave the toys]. There is some kind of caching/time-to-live/DNS resolving interaction going on with this intermittent thingie is the only thing I can remotely figure, and it is some setting somewhere that got mis-set somehow, but it has to be in pfsense since everyone started going crazy at the same time [or is this mistaken somehow?]. The lack of response on a DNS query in the webconfigurator for 127.0.0.1 when it had been working earlier, could that mean something significant? Could this be a NIC hardware issue, the symptoms don't seem like that is likely??? Why do all youtube pages load but many to most of the videos don't? I've been on the verge of just re-doing the install, it isn't that big of a deal, but I really wanted to figure this out. So I will wait a couple of days, see if anyone sees where I've po'ed the network gods, and if not, reinstall.

To all who've bothered to look through all this, thanks!

Infos:


C:\Windows\System32>ipconfig /all

Windows IP Configuration

   Host Name . . . . . . . . . . . . : sandy
   Primary Dns Suffix  . . . . . . . :
   Node Type . . . . . . . . . . . . : Hybrid
   IP Routing Enabled. . . . . . . . : No
   WINS Proxy Enabled. . . . . . . . : No
   DNS Suffix Search List. . . . . . : MYDOMAIN.org

Ethernet adapter wired_gigabit:

   Connection-specific DNS Suffix  . : MYDOMAIN.org
   Description . . . . . . . . . . . : Realtek PCIe GBE Family Controller #2
   Physical Address. . . . . . . . . : 6C-62-6D-40-A4-7B
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   Link-local IPv6 Address . . . . . : fe80::xxxxx17(Preferred)
   IPv4 Address. . . . . . . . . . . : 10.0.0.10(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Lease Obtained. . . . . . . . . . : Saturday, January 12, 2013 5:19:28 PM
   Lease Expires . . . . . . . . . . : Saturday, January 12, 2013 8:46:15 PM
   Default Gateway . . . . . . . . . : 10.0.0.1
   DHCP Server . . . . . . . . . . . : 10.0.0.1
   DHCPv6 IAID . . . . . . . . . . . : 409756269
   DHCPv6 Client DUID. . . . . . . . : I swear occifer I only had a couple
   DNS Servers . . . . . . . . . . . : 10.0.0.1
   NetBIOS over Tcpip. . . . . . . . : Enabled

C:\Windows\System32>netsh interface ip show config
Configuration for interface "wired_gigabit"
    DHCP enabled:                         Yes
    IP Address:                           10.0.0.10
    Subnet Prefix:                        10.0.0.0/24 (mask 255.255.255.0)
    Default Gateway:                      10.0.0.1
    Gateway Metric:                       0
    InterfaceMetric:                      10
    DNS servers configured through DHCP:  10.0.0.1
    Register with which suffix:           Primary only
    WINS servers configured through DHCP: None

root% ifconfig
fwe0: flags=8802 <broadcast,simplex,multicast>metric 0 mtu 1500
        options=8 <vlan_mtu>ether 02:11:d8:3b:81:71
        ch 1 dma -1
fwip0: flags=8802 <broadcast,simplex,multicast>metric 0 mtu 1500
        lladdr 0.11.d8.0.1.3b.81.71.a.2.ff.fe.0.0.0.0
re0: flags=8843 <up,broadcast,running,simplex,multicast>metric 0 mtu 1500
        options=389b <rxcsum,txcsum,vlan_mtu,vlan_hwtagging,vlan_hwcsum,wol_ucast,wol_mcast,wol_magic>ether 00:14:d1:15:45:33
        inet 10.0.0.1 netmask 0xffffff00 broadcast 10.0.0.255
        inet6 fe80::214:d1ff:fe15:4533%re0 prefixlen 64 scopeid 0x3
        nd6 options=3 <performnud,accept_rtadv>media: Ethernet autoselect (1000baseT <full-duplex>)
        status: active
re1: flags=8843 <up,broadcast,running,simplex,multicast>metric 0 mtu 1500
        options=389b <rxcsum,txcsum,vlan_mtu,vlan_hwtagging,vlan_hwcsum,wol_ucast,wol_mcast,wol_magic>ether 00:21:2f:2f:a5:92
        inet 10.0.5.1 netmask 0xffffff00 broadcast 10.0.5.255
        inet6 xxxxxre1 prefixlen 64 scopeid 0x4
        nd6 options=3 <performnud,accept_rtadv>media: Ethernet autoselect (1000baseT <full-duplex>)
        status: active
nfe0: flags=8943 <up,broadcast,running,promisc,simplex,multicast>metric 0 mtu 1500
        options=80008 <vlan_mtu,linkstate>ether 00:1a:92:df:2a:14
        inet6 fe80::xxxxx%nfe0 prefixlen 64 scopeid 0x5
        inet 173.174.xx.xx netmask 0xffffe000 broadcast 255.255.255.255
        nd6 options=3 <performnud,accept_rtadv>media: Ethernet autoselect (100baseTX <full-duplex>)
        status: active
pflog0: flags=100 <promisc>metric 0 mtu 33664
pfsync0: flags=0<> metric 0 mtu 1460
        syncpeer: 224.0.0.240 maxupd: 128 syncok: 1
enc0: flags=0<> metric 0 mtu 1536
lo0: flags=8049 <up,loopback,running,multicast>metric 0 mtu 16384
        options=3 <rxcsum,txcsum>inet 127.0.0.1 netmask 0xff000000
        inet6 ::1 prefixlen 128
        inet6 fe80::1%lo0 prefixlen 64 scopeid 0x9
        nd6 options=3<performnud,accept_rtadv></performnud,accept_rtadv></rxcsum,txcsum></up,loopback,running,multicast></promisc></full-duplex></performnud,accept_rtadv></vlan_mtu,linkstate></up,broadcast,running,promisc,simplex,multicast></full-duplex></performnud,accept_rtadv></rxcsum,txcsum,vlan_mtu,vlan_hwtagging,vlan_hwcsum,wol_ucast,wol_mcast,wol_magic></up,broadcast,running,simplex,multicast></full-duplex></performnud,accept_rtadv></rxcsum,txcsum,vlan_mtu,vlan_hwtagging,vlan_hwcsum,wol_ucast,wol_mcast,wol_magic></up,broadcast,running,simplex,multicast></broadcast,simplex,multicast></vlan_mtu></broadcast,simplex,multicast>

cable modem–---pfsense-----lan-------------switch-----PCs, wifi router, shrine to network gods
|
|
|---OPT1/DMZ------router----PCs

#System aliases

loopback = "{ lo0 }"
WAN = "{ nfe0 }"
LAN = "{ re0 }"
OPT1 = "{ re1 }"

#SSH Lockout Table
table <sshlockout>persist
table <webconfiguratorlockout>persist
#Snort tables
table <snort2c>table <virusprot># User Aliases 
table <mylans>{   10.0.0.0/24  10.0.5.0/24 } 
mylans = "<mylans>"
table <pfblockeriblockads>persist file "/var/db/aliastables/pfBlockeriblockads.txt"
pfBlockeriblockads = "<pfblockeriblockads>"
table <pfblockeriblockspywaregz>persist file "/var/db/aliastables/pfBlockeriblockspywaregz.txt"
pfBlockeriblockspywaregz = "<pfblockeriblockspywaregz>"
table <pfblockeriblockwebexploittxt>persist file "/var/db/aliastables/pfBlockeriblockwebexploittxt.txt"
pfBlockeriblockwebexploittxt = "<pfblockeriblockwebexploittxt>"
table <pfblockertopspammers>persist file "/var/db/aliastables/pfBlockerTopSpammers.txt"
pfBlockerTopSpammers = "<pfblockertopspammers>"
table <tsubs>{   10.0.0.20  10.0.0.21  10.0.0.22 } 
tsubs = "<tsubs>"

# Gateways
GWWAN = " route-to ( nfe0 173.174.xx.xx ) "

set loginterface re0
set optimization normal
set limit states 786000
set limit src-nodes 786000

set skip on pfsync0

no nat proto carp
no rdr proto carp
nat-anchor "natearly/*"
nat-anchor "natrules/*"

# Outbound NAT rules

# Subnets to NAT 
tonatsubnets	= "{ 10.0.0.0/24 10.0.5.0/24 127.0.0.0/8  }"
nat on $WAN  from $tonatsubnets port 500 to any port 500 -> 173.174.xx.xx/32 port 500  
nat on $WAN  from $tonatsubnets to any -> 173.174.xx.xx/32 port 1024:65535  

# Load balancing anchor
rdr-anchor "relayd/*"
# TFTP proxy
rdr-anchor "tftp-proxy/*"
table <negate_networks>{ 173.174.xx.0/19 10.0.0.0/24 10.0.5.0/24 }
# NAT Inbound Redirects
rdr on nfe0 proto tcp from any to 173.174.xx.xx port 80 -> 10.0.5.2
# Reflection redirects
rdr on { re0 re1 } proto tcp from any to 173.174.xx.xx port 80 tag PFREFLECT -> 127.0.0.1 port 19000

rdr on nfe0 proto tcp from any to 173.174.xx.0/19 port xx -> 10.0.0.1
# Reflection redirects
rdr on { re0 re1 } proto tcp from any to 173.174.xx.0/19 port xx tag PFREFLECT -> 127.0.0.1 port 19001

rdr on nfe0 proto tcp from any to 173.174.xx.0/19 port xxxx -> 10.0.0.1
# Reflection redirects
rdr on { re0 re1 } proto tcp from any to 173.174.xx.0/19 port xxxx tag PFREFLECT -> 127.0.0.1 port 19002

# UPnPd rdr anchor
rdr-anchor "miniupnpd"

anchor "relayd/*"
#---------------------------------------------------------------------------
# default deny rules
#---------------------------------------------------------------------------
block in log all label "Default deny rule"
block out log all label "Default deny rule"

# We use the mighty pf, we cannot be fooled.
block quick proto { tcp, udp } from any port = 0 to any
block quick proto { tcp, udp } from any to any port = 0

# Block all IPv6
block in quick inet6 all
block out quick inet6 all

# Snort package
block quick from <snort2c>to any label "Block snort2c hosts"
block quick from any to <snort2c>label "Block snort2c hosts"

# SSH lockout
block in log quick proto tcp from <sshlockout>to any port xx label "sshlockout"

# webConfigurator lockout
block in log quick proto tcp from <webconfiguratorlockout>to any port xxxx label "webConfiguratorlockout"
block in quick from <virusprot>to any label "virusprot overload table"
table <bogons>persist file "/etc/bogons"
# block bogon networks
# http://www.cymru.com/Documents/bogon-bn-nonagg.txt
block in log quick on $WAN from <bogons>to any label "block bogon networks from WAN"
antispoof for nfe0
# block anything from private networks on interfaces with the option set
antispoof for $WAN
block in log quick on $WAN from 10.0.0.0/8 to any label "block private networks from wan block 10/8"
block in log quick on $WAN from 127.0.0.0/8 to any label "block private networks from wan block 127/8"
block in log quick on $WAN from 172.16.0.0/12 to any label "block private networks from wan block 172.16/12"
block in log quick on $WAN from 192.168.0.0/16 to any label "block private networks from wan block 192.168/16"
# allow our DHCP client out to the WAN
pass in on $WAN proto udp from any port = 67 to any port = 68 label "allow dhcp client out WAN"
pass out on $WAN proto udp from any port = 68 to any port = 67 label "allow dhcp client out WAN"
# Not installing DHCP server firewall rules for WAN which is configured for DHCP.
antispoof for re0
# allow access to DHCP server on LAN
pass in quick on $LAN proto udp from any port = 68 to 255.255.255.255 port = 67 label "allow access to DHCP server"
pass in quick on $LAN proto udp from any port = 68 to 10.0.0.1 port = 67 label "allow access to DHCP server"
pass out quick on $LAN proto udp from 10.0.0.1 port = 67 to any port = 68 label "allow access to DHCP server"
antispoof for re1
# allow access to DHCP server on OPT1
pass in quick on $OPT1 proto udp from any port = 68 to 255.255.255.255 port = 67 label "allow access to DHCP server"
pass in quick on $OPT1 proto udp from any port = 68 to 10.0.5.1 port = 67 label "allow access to DHCP server"
pass out quick on $OPT1 proto udp from 10.0.5.1 port = 67 to any port = 68 label "allow access to DHCP server"

# loopback
pass in on $loopback all label "pass loopback"
pass out on $loopback all label "pass loopback"
# let out anything from the firewall host itself and decrypted IPsec traffic
pass out all keep state allow-opts label "let out anything from firewall host itself"
pass out route-to ( nfe0 173.174.xx.xx ) from 173.174.xx.xx to !173.174.xx.0/19 keep state allow-opts label "let out anything from firewall host itself"
# make sure the user cannot lock himself out of the webConfigurator or SSH
pass in quick on re0 proto tcp from any to (re0) port { xxxx 443  xx } keep state label "anti-lockout rule"
# NAT Reflection rules
pass in inet tagged PFREFLECT keep state label "NAT REFLECT: Allow traffic to localhost"

# User-defined rules follow

anchor "userrules/*"
block  in log  quick  on $WAN reply-to ( nfe0 173.174.xx.xx )  from   $pfBlockerTopSpammers to any  label "USER_RULE: pfBlockerTopSpammers auto rule"
block  in log  quick  on $WAN reply-to ( nfe0 173.174.xx.xx )  from   $pfBlockeriblockads to any  label "USER_RULE: pfBlockeriblockads auto rule"
block  in log  quick  on $WAN reply-to ( nfe0 173.174.xx.xx )  from   $pfBlockeriblockspywaregz to any  label "USER_RULE: pfBlockeriblockspywaregz auto rule"
block  in log  quick  on $WAN reply-to ( nfe0 173.174.xx.xx )  from   $pfBlockeriblockwebexploittxt to any  label "USER_RULE: pfBlockeriblockwebexploittxt auto rule"
pass  in log  quick  on $WAN reply-to ( nfe0 173.174.xx.xx )  proto tcp  from any to   10.0.5.2 port 80  flags S/SA keep state  label "USER_RULE: NAT Port forward for web server"
pass   in  quick  on $WAN reply-to ( nfe0 173.174.xx.xx )  proto tcp  from any to   10.0.0.1 port xx   label "USER_RULE: NAT ssh redirect for wan"
pass   in  quick  on $WAN reply-to ( nfe0 173.174.xx.xx )  proto tcp  from any to   10.0.0.1 port xxxx   label "USER_RULE: NAT ssh redirect for wan"
pass  in log  quick  on $WAN reply-to ( nfe0 173.174.xx.xx )  proto tcp  from   8.8.178.110 to   $mylans flags S/SA keep state  label "USER_RULE: copied formEasy Rule: Passed from Firewall Log View"
block return  in log  quick  on $LAN  from any to   $pfBlockerTopSpammers  label "USER_RULE: pfBlockerTopSpammers auto rule"
block return  in log  quick  on $LAN  from any to   $pfBlockeriblockads  label "USER_RULE: pfBlockeriblockads auto rule"
block return  in log  quick  on $LAN  from any to   $pfBlockeriblockspywaregz  label "USER_RULE: pfBlockeriblockspywaregz auto rule"
block return  in log  quick  on $LAN  from any to   $pfBlockeriblockwebexploittxt  label "USER_RULE: pfBlockeriblockwebexploittxt auto rule"
pass  in  quick  on $LAN  from 10.0.0.0/24 to any keep state  label "USER_RULE: Default allow LAN to any rule"
pass  in log  quick  on $LAN  proto tcp  from   $mylans to   8.8.178.110 port 80  flags S/SA keep state  label "USER_RULE: Easy Rule: Passed from Firewall Log View"
pass  in  quick  on $LAN  proto tcp  from   10.0.0.10 to   8.8.178.110 port 80  flags S/SA keep state  label "USER_RULE: Easy Rule: Passed from Firewall Log View"
block return  in log  quick  on $OPT1  from any to   $pfBlockerTopSpammers  label "USER_RULE: pfBlockerTopSpammers auto rule"
block return  in log  quick  on $OPT1  from any to   $pfBlockeriblockads  label "USER_RULE: pfBlockeriblockads auto rule"
block return  in log  quick  on $OPT1  from any to   $pfBlockeriblockspywaregz  label "USER_RULE: pfBlockeriblockspywaregz auto rule"
block return  in log  quick  on $OPT1  from any to   $pfBlockeriblockwebexploittxt  label "USER_RULE: pfBlockeriblockwebexploittxt auto rule"
pass  in log  quick  on $OPT1  from 10.0.5.1/24 to !10.0.0.0/24 keep state  label "USER_RULE: MY UNDefault allow DMZ to any NOT_lan-rule"

# VPN Rules
anchor "tftp-proxy/*"
# uPnPd
anchor "miniupnpd"</bogons></bogons></virusprot></webconfiguratorlockout></sshlockout></snort2c></snort2c></negate_networks></tsubs></tsubs></pfblockertopspammers></pfblockertopspammers></pfblockeriblockwebexploittxt></pfblockeriblockwebexploittxt></pfblockeriblockspywaregz></pfblockeriblockspywaregz></pfblockeriblockads></pfblockeriblockads></mylans></mylans></virusprot></snort2c></webconfiguratorlockout></sshlockout>

johnpoz

Ok I don't have time right at this minute to read all through that info - but this jumps out at me

" I just set it back to 10.0.0.1-the lan address for pfsense. From a windows command line I got this[173.174.xx.xx is my external IP]:"

C:\Windows\System32>nslookup www.freebsd.org
Server: pfsense.MYDOMAIN.org
Address: 10.0.0.1

Non-authoritative answer:
Name: www.freebsd.org.MYDOMAIN.org
Address: 173.174.xx.xx

What is this MYDOMAIN.org thing?? Are you changing that, or is really mydomain.org? Since its all CAPS what are you changing this out for?

And do you see how I did a sniff, where is your sniff. I want to see exactly what your doing a query for and to where?

Those IPs you list don't seem like your ISP dns to me

dig -x 70.85.0.141 +short
8d.0.5546.static.theplanet.com.

dig -x 129.115.102.150 +short
juliet.it.utsa.edu.

dig -x 67.214.64.27 +short
dns1.telwestonline.com

dig -x 199.192.200.41 +short
ct41.7wei.com.

Those are not the dns servers for timewarner - where did you come up with using those?

And your config still shows the aliases for pfblocker and using the ad list that blocks freebsd.org network.

Lets see the sniff of your query, I really don't think your local domain is MYDOMAIN.org is it? And if it is - you do understand that is a public domain!! and I doubt you own it

Domain Name:MYDOMAIN.ORG
Created On:23-Aug-1996 04:00:00 UTC
Last Updated On:13-Aug-2012 13:20:37 UTC
Registrant ID:moniker1831
Registrant Name:Vince Di Bernardo
Registrant Organization:Vince Di Bernardo
Registrant Street1:18737 Shaws Creek Road

And a query for what you did a query for would fail

; <<>> DiG 9.8.1-P1 <<>> pfsense.mydomain.org
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 59437
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;pfsense.mydomain.org. IN A

;; Query time: 524 msec
;; SERVER: 192.168.1.253#53(192.168.1.253)
;; WHEN: Sun Jan 13 08:50:19 2013
;; MSG SIZE rcvd: 38

Not sure why you would hide a local domain?? if you really are uisng mydomain.org - bad IDEA, use something that is not public, mydomain.lan would be fine, etc.

But this is telling me it was cached at the server for that fqdn with your suffix on the end

Non-authoritative answer:
Name: www.freebsd.org.MYDOMAIN.org
Address: 173.174.xx.xx

Not sure what this means..

nslookup www.freebsd.org.
Server: pfsense.MYDOMAIN.org
Address: 10.0.0.1

Name: www.freebsd.org
Served by:

L.ROOT-SERVERS.NET
M.ROOT-SERVERS.NET
A.ROOT-SERVERS.NET

But clearly the box does not have a clue about that request. If it just throws back roots, but since it did not throw back a nxdomain, I would assume its telling you it needs to be forwarded??

Ad some point did you try and run local dns on pfsense? unbound? Or tiny? And I don't understand why your using those odd ball dns for your forwarders? Why not your provider? Or some more well known public dns, 4.3.3.3, 4.2.2.2

How about using debug on your nslookup, your going to see that windows is going to ask with its suffix attached

So you got something going on with that suffix your using? Lets see what is going on exactly, where is the sniff of the traffic from your client to pfsense, and then what pfsense sends out and gets back. Or what it answers back because it has that record.

nslookupdebug.png_thumb

mechtheist

I really appreciate you taking so much time trying to help. I blanked out the particulars of my domain name and external IPs for privacy/paranoia issues, the name itself isn't something that will get by censors. The DNS servers are ones that score the highest in DNSBench from http://www.GRC.com, the Gibsdon Research folk [ShieldsUp etc], plus one from my the DNSexit folk that I get my dynamic DNS workings. The ad-blocking list I am using is a static text file with the offending blockage removed, I can surf to freebsd.org with no problem, as I detailed above, right in the middle of writing the previous post, my main machine went from its typical not finding freebsd, to finding it, and then not finding it, all in 10 minutes, where the only thing I changed was checking the box on the 'append parent suffixes of the primary DNS suffix' in the advanced dns config settings for the NIC/connection in windows.

I can't figure out how to copy from wireshark, I get little pieces, but the query for freebsd looks like this:

www.freebsd.org: type A, class IN

I'm doing something wrong here, image: https://skydrive.live.com/redir?resid=CD4A1DE1B932EC1E!96107

when doing the testing above, when it changed from not working to working to not working, after the initial query, there was not another one, the initial query for ip-adress.com was normal. I'm sorry this is the best I can do at the moment, I have some things I am running late for right now, and will be gone for most of the rest of the day, but tonight I will figure out how to suck more data from wireshark, I haven't used it all that much so I got some learnin' to do in that regard.

Again, thanks, really really thanks, for taking so much time. Have a good one.

johnpoz

What does get by censors mean? I am more worried about the tld, for a private domain you use on your lan for your local machines. I would not suggest you use any sort of valid tld, you run into an issue where it could resolve on the public net.

using mydomain.lan or .local or .foo etc. would be better options.

The query for freebsd.or looks like that where - on your lan, or that is what is going out the wan of pfsense when you ask for it?

For you to get a response with your public IP as the answer, something has to answer with that? It should not be possible for an external dns to respond – so I have to assume pfsense is responding.

Your pointing to 127.0.0.1 - pfsense itself for dns. So did you at some point try and run unbound or tiny dns, or some other dns -- did you install bind for example.

What do you have in your Host Overrides in dns forwarder under services?

By default windows will add its primary suffix to queries when looking for stuff that does not answer. So what is domain your using locally? mydomain.org is a valid domain on the internet - this is not something you should be using as your primary domain on your local boxes. Unless of course you owned and controlled that domain and wanted to do that??

Lets fully understand your local domain and hostnames and how they query, and then we can figure out how what your seeing is happening.

PM me your details of your domain if you don't want it public. But I don't see how something like curseword.lan would be an issue. the .tld is part I am curious about. org, net, com, info, biz, etc.. not good choices for local domains if you ask me.

More than happy to remote in and take a look with you if you want. We could use teamviewer to one of your local hosts and then access your pfsense gui and shell with you watching everything that we do, etc.

Just send me a PM and we can schedule a good time.

mechtheist

Okay, this is the best I can do, PC tsub, has pfsense as sole DNS, the details of a DNS query that fails at the browser:

Query
Frame: Number = 557, Captured Frame Length = 125, MediaType = WiFi

WiFi: [Unencrypted Data] .T….., (I)
- MetaData:
Version: 2 (0x2)
Length: 32 (0x20)
- OpMode: Unknown operation mode(16)
StationMode: (...............................0) Not Station Mode
APMode: (..............................0.) Not AP Mode
ExtensibleStationMode: (.............................0..) Not Extensible Station Mode
Unused: (.0000000000000000000000000010...)
MonitorMode: (0...............................) Not Monitor Mode
Flags: 4294967295 (0xFFFFFFFF)
RemData: Outbound
TimeStamp: 01/14/2013, 13:21:07.132834 UTC
- FrameControl: Version 0,Data, Data, .T.....(0x108)
Version: (..............00) 0
Type: (............10..) Data
SubType: (........0000....) Data
DS: (......01........) STA to DS via AP
MoreFrag: (.....0..........) No
Retry: (....0...........) No
PowerMgt: (...0............) Active Mode
MoreData: (..0.............) No
ProtectedFrame: (.0..............) No
Order: (0...............) Unordered
Duration: 32768 (0x8000)
BSSID: 10BF48 D99340
SA: 844BF5 B1B3A5
DA: TRENDware International, Inc. 154533
- SequenceControl: Sequence Number = 0
FragmentNumber: (............0000) 0
SequenceNumber: (000000000000....) 0
LLC: Unnumbered(U) Frame, Command Frame, SSAP = SNAP(Sub-Network Access Protocol), DSAP = SNAP(Sub-Network Access Protocol)
- DSAP: SNAP(Sub-Network Access Protocol), Individual DSAP
Address: (1010101.) SNAP(Sub-Network Access Protocol)
IG: (.......0) Individual Address
- SSAP: SNAP(Sub-Network Access Protocol), Command
Address: (1010101.) SNAP(Sub-Network Access Protocol)
CR: (.......0) Command Frame
- Unnumbered: UI - Unnumbered Information
MMM: (000.....) 0
PF: (...0....) Poll Bit - No Response Solicited
MM: (....00..)
Type: (......11) Unnumbered(U) Frame
Snap: EtherType = Internet IP (IPv4), OrgCode = XEROX CORPORATION
OrganizationCode: XEROX CORPORATION, 0(0x0000)
EtherType: Internet IP (IPv4), 2048(0x0800)
Ipv4: Src = 10.0.0.21, Dest = 10.0.0.1, Next Protocol = UDP, Packet ID = 18662, Total IP Length = 61
- Versions: IPv4, Internet Protocol; Header Length = 20
Version: (0100....) IPv4, Internet Protocol
HeaderLength: (....0101) 20 bytes (0x5)
- DifferentiatedServicesField: DSCP: 0, ECN: 0
DSCP: (000000..) Differentiated services codepoint 0
ECT: (......0.) ECN-Capable Transport not set
CE: (.......0) ECN-CE not set
TotalLength: 61 (0x3D)
Identification: 18662 (0x48E6)
- FragmentFlags: 0 (0x0)
Reserved: (0...............)
DF: (.0..............) Fragment if necessary
MF: (..0.............) This is the last fragment
Offset: (...0000000000000) 0
TimeToLive: 128 (0x80)
NextProtocol: UDP, 17(0x11)
Checksum: 56756 (0xDDB4)
SourceAddress: 10.0.0.21
DestinationAddress: 10.0.0.1
Udp: SrcPort = 51429, DstPort = DNS(53), Length = 41
SrcPort: 51429
DstPort: DNS(53)
TotalLength: 41 (0x29)
Checksum: 1076 (0x434)
UDPPayload: SourcePort = 51429, DestinationPort = 53
Dns: QueryId = 0xD7DF, QUERY (Standard query), Query for www.freebsd.org of type Host Addr on class Internet
QueryIdentifier: 55263 (0xD7DF)
- Flags: Query, Opcode - QUERY (Standard query), RD, Rcode - Success
QR: (0...............) Query
Opcode: (.0000...........) QUERY (Standard query) 0
AA: (.....0..........) Not authoritative
TC: (......0.........) Not truncated
RD: (.......1........) Recursion desired
RA: (........0.......) Recursive query support not available
Zero: (.........0......) 0
AuthenticatedData: (..........0.....) Not AuthenticatedData
CheckingDisabled: (...........0....) Not CheckingDisabled
Rcode: (............0000) Success 0
QuestionCount: 1 (0x1)
AnswerCount: 0 (0x0)
NameServerCount: 0 (0x0)
AdditionalCount: 0 (0x0)
- QRecord: www.freebsd.org of type Host Addr on class Internet
QuestionName: www.freebsd.org
QuestionType: A, IPv4 address, 1(0x1)
QuestionClass: Internet, 1(0x1)

response:
Frame: Number = 561, Captured Frame Length = 336, MediaType = WiFi

WiFi: [Unencrypted Data] F…..P, (I) RSSI = -44 dBm, Rate = Unknown
- MetaData: RSSI = -44 dBm, Rate = Unknown
Version: 2 (0x2)
Length: 32 (0x20)
- OpMode: Unknown operation mode(16)
StationMode: (...............................0) Not Station Mode
APMode: (..............................0.) Not AP Mode
ExtensibleStationMode: (.............................0..) Not Extensible Station Mode
Unused: (.0000000000000000000000000010...)
MonitorMode: (0...............................) Not Monitor Mode
Flags: 0 (0x0)
PhyType: 802.11n
Channel: Undefined channel with center frequency 2437, Center Frequency: 2437 MHz
lRSSI: -44 dBm
Rate: Unknown
TimeStamp: 01/14/2013, 13:21:07.176325 UTC
- FrameControl: Version 0,Data, Data, F.....P(0x4208)
Version: (..............00) 0
Type: (............10..) Data
SubType: (........0000....) Data
DS: (......10........) DS to STA via AP
MoreFrag: (.....0..........) No
Retry: (....0...........) No
PowerMgt: (...0............) Active Mode
MoreData: (..0.............) No
ProtectedFrame: (.1..............) Yes
Order: (0...............) Unordered
Duration: 44 (0x2C)
DA: 844BF5 B1B3A5
BSSID: 10BF48 D99340
SA: TRENDware International, Inc. 154533
- SequenceControl: Sequence Number = 3655
FragmentNumber: (............0000) 0
SequenceNumber: (111001000111....) 3655
LLC: Unnumbered(U) Frame, Command Frame, SSAP = SNAP(Sub-Network Access Protocol), DSAP = SNAP(Sub-Network Access Protocol)
- DSAP: SNAP(Sub-Network Access Protocol), Individual DSAP
Address: (1010101.) SNAP(Sub-Network Access Protocol)
IG: (.......0) Individual Address
- SSAP: SNAP(Sub-Network Access Protocol), Command
Address: (1010101.) SNAP(Sub-Network Access Protocol)
CR: (.......0) Command Frame
- Unnumbered: UI - Unnumbered Information
MMM: (000.....) 0
PF: (...0....) Poll Bit - No Response Solicited
MM: (....00..)
Type: (......11) Unnumbered(U) Frame
Snap: EtherType = Internet IP (IPv4), OrgCode = XEROX CORPORATION
OrganizationCode: XEROX CORPORATION, 0(0x0000)
EtherType: Internet IP (IPv4), 2048(0x0800)
Ipv4: Src = 10.0.0.1, Dest = 10.0.0.21, Next Protocol = UDP, Packet ID = 45530, Total IP Length = 272
- Versions: IPv4, Internet Protocol; Header Length = 20
Version: (0100....) IPv4, Internet Protocol
HeaderLength: (....0101) 20 bytes (0x5)
- DifferentiatedServicesField: DSCP: 0, ECN: 0
DSCP: (000000..) Differentiated services codepoint 0
ECT: (......0.) ECN-Capable Transport not set
CE: (.......0) ECN-CE not set
TotalLength: 272 (0x110)
Identification: 45530 (0xB1DA)
- FragmentFlags: 0 (0x0)
Reserved: (0...............)
DF: (.0..............) Fragment if necessary
MF: (..0.............) This is the last fragment
Offset: (...0000000000000) 0
TimeToLive: 64 (0x40)
NextProtocol: UDP, 17(0x11)
Checksum: 46061 (0xB3ED)
SourceAddress: 10.0.0.1
DestinationAddress: 10.0.0.21
Udp: SrcPort = DNS(53), DstPort = 51429, Length = 252
SrcPort: DNS(53)
DstPort: 51429
TotalLength: 252 (0xFC)
Checksum: 61812 (0xF174)
UDPPayload: SourcePort = 53, DestinationPort = 51429
Dns: QueryId = 0xD7DF, QUERY (Standard query), Response - Success
QueryIdentifier: 55263 (0xD7DF)
- Flags: Response, Opcode - QUERY (Standard query), RD, RA, Rcode - Success
QR: (1...............) Response
Opcode: (.0000...........) QUERY (Standard query) 0
AA: (.....0..........) Not authoritative
TC: (......0.........) Not truncated
RD: (.......1........) Recursion desired
RA: (........1.......) Recursive query support available
Zero: (.........0......) 0
AuthenticatedData: (..........0.....) Not AuthenticatedData
CheckingDisabled: (...........0....) Not CheckingDisabled
Rcode: (............0000) Success 0
QuestionCount: 1 (0x1)
AnswerCount: 0 (0x0)
NameServerCount: 13 (0xD)
AdditionalCount: 0 (0x0)
- QRecord: www.freebsd.org of type Host Addr on class Internet
QuestionName: www.freebsd.org
QuestionType: A, IPv4 address, 1(0x1)
QuestionClass: Internet, 1(0x1)
- AuthorityRecord: of type NS on class Internet: K.ROOT-SERVERS.NET
ResourceName:
ResourceType: NS, Authoritative name server, 2(0x2)
ResourceClass: Internet, 1(0x1)
TimeToLive: 518400 (0x7E900)
ResourceDataLength: 20 (0x14)
AuthoritativeNameServer: K.ROOT-SERVERS.NET
- AuthorityRecord: of type NS on class Internet: L.ROOT-SERVERS.NET
ResourceName:
ResourceType: NS, Authoritative name server, 2(0x2)
ResourceClass: Internet, 1(0x1)
TimeToLive: 518400 (0x7E900)
ResourceDataLength: 4 (0x4)
AuthoritativeNameServer: L.ROOT-SERVERS.NET
- AuthorityRecord: of type NS on class Internet: M.ROOT-SERVERS.NET
ResourceName:
ResourceType: NS, Authoritative name server, 2(0x2)
ResourceClass: Internet, 1(0x1)
TimeToLive: 518400 (0x7E900)
ResourceDataLength: 4 (0x4)
AuthoritativeNameServer: M.ROOT-SERVERS.NET
- AuthorityRecord: of type NS on class Internet: A.ROOT-SERVERS.NET
ResourceName:
ResourceType: NS, Authoritative name server, 2(0x2)
ResourceClass: Internet, 1(0x1)
TimeToLive: 518400 (0x7E900)
ResourceDataLength: 4 (0x4)
AuthoritativeNameServer: A.ROOT-SERVERS.NET
- AuthorityRecord: of type NS on class Internet: B.ROOT-SERVERS.NET
ResourceName:
ResourceType: NS, Authoritative name server, 2(0x2)
ResourceClass: Internet, 1(0x1)
TimeToLive: 518400 (0x7E900)
ResourceDataLength: 4 (0x4)
AuthoritativeNameServer: B.ROOT-SERVERS.NET
- AuthorityRecord: of type NS on class Internet: C.ROOT-SERVERS.NET
ResourceName:
ResourceType: NS, Authoritative name server, 2(0x2)
ResourceClass: Internet, 1(0x1)
TimeToLive: 518400 (0x7E900)
ResourceDataLength: 4 (0x4)
AuthoritativeNameServer: C.ROOT-SERVERS.NET
- AuthorityRecord: of type NS on class Internet: D.ROOT-SERVERS.NET
ResourceName:
ResourceType: NS, Authoritative name server, 2(0x2)
ResourceClass: Internet, 1(0x1)
TimeToLive: 518400 (0x7E900)
ResourceDataLength: 4 (0x4)
AuthoritativeNameServer: D.ROOT-SERVERS.NET
- AuthorityRecord: of type NS on class Internet: E.ROOT-SERVERS.NET
ResourceName:
ResourceType: NS, Authoritative name server, 2(0x2)
ResourceClass: Internet, 1(0x1)
TimeToLive: 518400 (0x7E900)
ResourceDataLength: 4 (0x4)
AuthoritativeNameServer: E.ROOT-SERVERS.NET
- AuthorityRecord: of type NS on class Internet: F.ROOT-SERVERS.NET
ResourceName:
ResourceType: NS, Authoritative name server, 2(0x2)
ResourceClass: Internet, 1(0x1)
TimeToLive: 518400 (0x7E900)
ResourceDataLength: 4 (0x4)
AuthoritativeNameServer: F.ROOT-SERVERS.NET
- AuthorityRecord: of type NS on class Internet: G.ROOT-SERVERS.NET
ResourceName:
ResourceType: NS, Authoritative name server, 2(0x2)
ResourceClass: Internet, 1(0x1)
TimeToLive: 518400 (0x7E900)
ResourceDataLength: 4 (0x4)
AuthoritativeNameServer: G.ROOT-SERVERS.NET
- AuthorityRecord: of type NS on class Internet: H.ROOT-SERVERS.NET
ResourceName:
ResourceType: NS, Authoritative name server, 2(0x2)
ResourceClass: Internet, 1(0x1)
TimeToLive: 518400 (0x7E900)
ResourceDataLength: 4 (0x4)
AuthoritativeNameServer: H.ROOT-SERVERS.NET
- AuthorityRecord: of type NS on class Internet: I.ROOT-SERVERS.NET
ResourceName:
ResourceType: NS, Authoritative name server, 2(0x2)
ResourceClass: Internet, 1(0x1)
TimeToLive: 518400 (0x7E900)
ResourceDataLength: 4 (0x4)
AuthoritativeNameServer: I.ROOT-SERVERS.NET
- AuthorityRecord: of type NS on class Internet: J.ROOT-SERVERS.NET
ResourceName:
ResourceType: NS, Authoritative name server, 2(0x2)
ResourceClass: Internet, 1(0x1)
TimeToLive: 518400 (0x7E900)
ResourceDataLength: 4 (0x4)
AuthoritativeNameServer: J.ROOT-SERVERS.NET

windows data

C:\Users\rob>ipconfig /all

Windows IP Configuration

Host Name . . . . . . . . . . . . : tsub
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : MYDOMAIN.org

Wireless LAN adapter Wi-Fi:

Connection-specific DNS Suffix . : MYDOMAIN.org
Description . . . . . . . . . . . : Broadcom 4313GN 802.11b/g/n 1x1 Wi-Fi Adapter
Physical Address. . . . . . . . . : 84-4B-F5-B1-B3-A5
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
Link-local IPv6 Address . . . . . : fe80::3c04:875a:976e:7cdb%12(Preferred)
IPv4 Address. . . . . . . . . . . : 10.0.0.21(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Lease Obtained. . . . . . . . . . : Monday, January 14, 2013 6:10:24 AM
Lease Expires . . . . . . . . . . : Monday, January 14, 2013 9:10:24 AM
Default Gateway . . . . . . . . . : 10.0.0.1
DHCP Server . . . . . . . . . . . : 10.0.0.1
DHCPv6 IAID . . . . . . . . . . . : 260328437
DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-18-4B-72-FC-84-4B-F5-B1-B3-A5
DNS Servers . . . . . . . . . . . : 10.0.0.1
NetBIOS over Tcpip. . . . . . . . : Enabled

C:\Users\rob>netsh interface ip show config

Configuration for interface "Wi-Fi"
DHCP enabled: Yes
IP Address: 10.0.0.21
Subnet Prefix: 10.0.0.0/24 (mask 255.255.255.0)
Default Gateway: 10.0.0.1
Gateway Metric: 0
InterfaceMetric: 25
DNS servers configured through DHCP: 10.0.0.1
Register with which suffix: Primary only
WINS servers configured through DHCP: None

Configuration for interface "Loopback Pseudo-Interface 1"
DHCP enabled: No
IP Address: 127.0.0.1
Subnet Prefix: 127.0.0.0/8 (mask 255.0.0.0)
InterfaceMetric: 50
Statically Configured DNS Servers: None
Register with which suffix: None
Statically Configured WINS Servers: None

Now, PC ivy, has an external DNS server as primary, the browser browses to freebsd.org. The firrst line is something that started recently, don't know what causes that yet, I have to disable and re-enable the NIC and it connects and works fine, the words are copied from the ever-unhelpful diagnostic from windsows.

Windows couldn't automatically bind the IP protocol stack to the network adapter.

ivy has an external primary DNS, this is how a freebsd query went on it:

query:

Frame: Number = 244, Captured Frame Length = 75, MediaType = ETHERNET

Ethernet: Etype = Internet IP (IPv4),DestinationAddress:[00-14-D1-15-45-33],SourceAddress:[8C-89-A5-D9-FC-46]
- DestinationAddress: TRENDware International, Inc. 154533 [00-14-D1-15-45-33]
Rsv: (000000..)
UL: (…...0.) Universally Administered Address
IG: (.......0) Individual address (unicast)
- SourceAddress: 8C89A5 D9FC46 [8C-89-A5-D9-FC-46]
Rsv: (100011..)
UL: (…...0.) Universally Administered Address
IG: (.......0) Individual address (unicast)
EthernetType: Internet IP (IPv4), 2048(0x800)
Ipv4: Src = 10.0.0.11, Dest = 70.85.0.141, Next Protocol = UDP, Packet ID = 8548, Total IP Length = 61
- Versions: IPv4, Internet Protocol; Header Length = 20
Version: (0100....) IPv4, Internet Protocol
HeaderLength: (....0101) 20 bytes (0x5)
- DifferentiatedServicesField: DSCP: 0, ECN: 0
DSCP: (000000..) Differentiated services codepoint 0
ECT: (......0.) ECN-Capable Transport not set
CE: (.......0) ECN-CE not set
TotalLength: 61 (0x3D)
Identification: 8548 (0x2164)
- FragmentFlags: 0 (0x0)
Reserved: (0...............)
DF: (.0..............) Fragment if necessary
MF: (..0.............) This is the last fragment
Offset: (...0000000000000) 0
TimeToLive: 128 (0x80)
NextProtocol: UDP, 17(0x11)
Checksum: 51295 (0xC85F)
SourceAddress: 10.0.0.11
DestinationAddress: 70.85.0.141
Udp: SrcPort = 54357, DstPort = DNS(53), Length = 41
SrcPort: 54357
DstPort: DNS(53)
TotalLength: 41 (0x29)
Checksum: 36772 (0x8FA4)
UDPPayload: SourcePort = 54357, DestinationPort = 53
Dns: QueryId = 0x428, QUERY (Standard query), Query for www.freebsd.org of type Host Addr on class Internet
QueryIdentifier: 1064 (0x428)
- Flags: Query, Opcode - QUERY (Standard query), RD, Rcode - Success
QR: (0...............) Query
Opcode: (.0000...........) QUERY (Standard query) 0
AA: (.....0..........) Not authoritative
TC: (......0.........) Not truncated
RD: (.......1........) Recursion desired
RA: (........0.......) Recursive query support not available
Zero: (.........0......) 0
AuthenticatedData: (..........0.....) Not AuthenticatedData
CheckingDisabled: (...........0....) Not CheckingDisabled
Rcode: (............0000) Success 0
QuestionCount: 1 (0x1)
AnswerCount: 0 (0x0)
NameServerCount: 0 (0x0)
AdditionalCount: 0 (0x0)
- QRecord: www.freebsd.org of type Host Addr on class Internet
QuestionName: www.freebsd.org
QuestionType: A, IPv4 address, 1(0x1)
QuestionClass: Internet, 1(0x1)

response:

Frame: Number = 245, Captured Frame Length = 306, MediaType = ETHERNET

Ethernet: Etype = Internet IP (IPv4),DestinationAddress:[8C-89-A5-D9-FC-46],SourceAddress:[00-14-D1-15-45-33]
- DestinationAddress: 8C89A5 D9FC46 [8C-89-A5-D9-FC-46]
Rsv: (100011..)
UL: (…...0.) Universally Administered Address
IG: (.......0) Individual address (unicast)
- SourceAddress: TRENDware International, Inc. 154533 [00-14-D1-15-45-33]
Rsv: (000000..)
UL: (…...0.) Universally Administered Address
IG: (.......0) Individual address (unicast)
EthernetType: Internet IP (IPv4), 2048(0x800)
Ipv4: Src = 70.85.0.141, Dest = 10.0.0.11, Next Protocol = UDP, Packet ID = 13655, Total IP Length = 292
- Versions: IPv4, Internet Protocol; Header Length = 20
Version: (0100....) IPv4, Internet Protocol
HeaderLength: (....0101) 20 bytes (0x5)
- DifferentiatedServicesField: DSCP: 0, ECN: 0
DSCP: (000000..) Differentiated services codepoint 0
ECT: (......0.) ECN-Capable Transport not set
CE: (.......0) ECN-CE not set
TotalLength: 292 (0x124)
Identification: 13655 (0x3557)
- FragmentFlags: 0 (0x0)
Reserved: (0...............)
DF: (.0..............) Fragment if necessary
MF: (..0.............) This is the last fragment
Offset: (...0000000000000) 0
TimeToLive: 54 (0x36)
NextProtocol: UDP, 17(0x11)
Checksum: 64901 (0xFD85)
SourceAddress: 70.85.0.141
DestinationAddress: 10.0.0.11
Udp: SrcPort = DNS(53), DstPort = 54357, Length = 272
SrcPort: DNS(53)
DstPort: 54357
TotalLength: 272 (0x110)
Checksum: 6076 (0x17BC)
UDPPayload: SourcePort = 53, DestinationPort = 54357
Dns: QueryId = 0x428, QUERY (Standard query), Response - Success, 8.8.178.110, 72.52.71.1
QueryIdentifier: 1064 (0x428)
- Flags: Response, Opcode - QUERY (Standard query), RD, RA, Rcode - Success
QR: (1...............) Response
Opcode: (.0000...........) QUERY (Standard query) 0
AA: (.....0..........) Not authoritative
TC: (......0.........) Not truncated
RD: (.......1........) Recursion desired
RA: (........1.......) Recursive query support available
Zero: (.........0......) 0
AuthenticatedData: (..........0.....) Not AuthenticatedData
CheckingDisabled: (...........0....) Not CheckingDisabled
Rcode: (............0000) Success 0
QuestionCount: 1 (0x1)
AnswerCount: 2 (0x2)
NameServerCount: 3 (0x3)
AdditionalCount: 5 (0x5)
- QRecord: www.freebsd.org of type Host Addr on class Internet
QuestionName: www.freebsd.org
QuestionType: A, IPv4 address, 1(0x1)
QuestionClass: Internet, 1(0x1)
- ARecord: www.freebsd.org of type CNAME on class Internet: wfe0.ysv.freebsd.org
ResourceName: www.freebsd.org
ResourceType: CNAME, Canonical name for an alias, 5(0x5)
ResourceClass: Internet, 1(0x1)
TimeToLive: 120 (0x78)
ResourceDataLength: 11 (0xB)
CName: wfe0.ysv.freebsd.org
- ARecord: wfe0.ysv.freebsd.org of type Host Addr on class Internet: 8.8.178.110
ResourceName: wfe0.ysv.freebsd.org
ResourceType: A, IPv4 address, 1(0x1)
ResourceClass: Internet, 1(0x1)
TimeToLive: 3600 (0xE10)
ResourceDataLength: 4 (0x4)
IPAddress: 8.8.178.110
- AuthorityRecord: freebsd.org of type NS on class Internet: ns3.isc-sns.info
ResourceName: freebsd.org
ResourceType: NS, Authoritative name server, 2(0x2)
ResourceClass: Internet, 1(0x1)
TimeToLive: 3229 (0xC9D)
ResourceDataLength: 18 (0x12)
AuthoritativeNameServer: ns3.isc-sns.info
- AuthorityRecord: freebsd.org of type NS on class Internet: ns1.isc-sns.net
ResourceName: freebsd.org
ResourceType: NS, Authoritative name server, 2(0x2)
ResourceClass: Internet, 1(0x1)
TimeToLive: 3229 (0xC9D)
ResourceDataLength: 17 (0x11)
AuthoritativeNameServer: ns1.isc-sns.net
- AuthorityRecord: freebsd.org of type NS on class Internet: ns2.isc-sns.com
ResourceName: freebsd.org
ResourceType: NS, Authoritative name server, 2(0x2)
ResourceClass: Internet, 1(0x1)
TimeToLive: 3229 (0xC9D)
ResourceDataLength: 17 (0x11)
AuthoritativeNameServer: ns2.isc-sns.com
- AdditionalRecord: ns1.isc-sns.net of type Host Addr on class Internet: 72.52.71.1
ResourceName: ns1.isc-sns.net
ResourceType: A, IPv4 address, 1(0x1)
ResourceClass: Internet, 1(0x1)
TimeToLive: 2291 (0x8F3)
ResourceDataLength: 4 (0x4)
IPAddress: 72.52.71.1
- AdditionalRecord: ns1.isc-sns.net of type AAAA on class Internet: 2001:470:1A:0:0:0:0:1
ResourceName: ns1.isc-sns.net
ResourceType: AAAA, IPv6 Address, 28(0x1c)
ResourceClass: Internet, 1(0x1)
TimeToLive: 2291 (0x8F3)
ResourceDataLength: 16 (0x10)
IPv6Address: 2001:470:1A:0:0:0:0:1
- AdditionalRecord: ns2.isc-sns.com of type Host Addr on class Internet: 38.103.2.1
ResourceName: ns2.isc-sns.com
ResourceType: A, IPv4 address, 1(0x1)
ResourceClass: Internet, 1(0x1)
TimeToLive: 559 (0x22F)
ResourceDataLength: 4 (0x4)
IPAddress: 38.103.2.1
- AdditionalRecord: ns3.isc-sns.info of type Host Addr on class Internet: 63.243.194.1
ResourceName: ns3.isc-sns.info
ResourceType: A, IPv4 address, 1(0x1)
ResourceClass: Internet, 1(0x1)
TimeToLive: 559 (0x22F)
ResourceDataLength: 4 (0x4)
IPAddress: 63.243.194.1
- AdditionalRecord: ns3.isc-sns.info of type AAAA on class Internet: 2001:5A0:10:0:0:0:0:1
ResourceName: ns3.isc-sns.info
ResourceType: AAAA, IPv6 Address, 28(0x1c)
ResourceClass: Internet, 1(0x1)
TimeToLive: 559 (0x22F)
ResourceDataLength: 16 (0x10)
IPv6Address: 2001:5A0:10:0:0:0:0:1

this is windows data
C:\Windows\system32>ipconfig /all

Windows IP Configuration

Host Name . . . . . . . . . . . . : ivy
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : MYDOMAIN.org

Ethernet adapter Ethernet:

Connection-specific DNS Suffix . : MYDOMAIN.org
Description . . . . . . . . . . . : Intel(R) 82579V Gigabit Network Connection
Physical Address. . . . . . . . . : 8C-89-A5-D9-FC-46
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
Link-local IPv6 Address . . . . . : fe80::45da:e57:cbd:2f17%17(Preferred)
IPv4 Address. . . . . . . . . . . : 10.0.0.11(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Lease Obtained. . . . . . . . . . : Monday, January 14, 2013 8:09:11 AM
Lease Expires . . . . . . . . . . : Monday, January 14, 2013 10:09:11 AM
Default Gateway . . . . . . . . . : 10.0.0.1
DHCP Server . . . . . . . . . . . : 10.0.0.1
DHCPv6 IAID . . . . . . . . . . . : 210536869
DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-18-51-40-C9-8C-89-A5-D9-FC-46
DNS Servers . . . . . . . . . . . : 70.85.0.141
10.0.0.1
NetBIOS over Tcpip. . . . . . . . : Enabled

Ethernet adapter VirtualBox Host-Only Network:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : VirtualBox Host-Only Ethernet Adapter
Physical Address. . . . . . . . . : 08-00-27-00-CC-5E
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
Link-local IPv6 Address . . . . . : fe80::81ce:a421:e7bd:c1ec%20(Preferred)
IPv4 Address. . . . . . . . . . . : 192.168.56.1(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . :
DHCPv6 IAID . . . . . . . . . . . : 252182567
DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-18-51-40-C9-8C-89-A5-D9-FC-46
DNS Servers . . . . . . . . . . . : fec0:0:0:ffff::1%1
fec0:0:0:ffff::2%1
fec0:0:0:ffff::3%1
NetBIOS over Tcpip. . . . . . . . : Enabled

Tunnel adapter Teredo Tunneling Pseudo-Interface:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes

Tunnel adapter isatap.{64BA4B2A-0261-447E-BB5D-120558063E49}:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft ISATAP Adapter #2
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes

Tunnel adapter isatap.MYDOMAIN.org:

Connection-specific DNS Suffix . : MYDOMAIN.org
Description . . . . . . . . . . . : Microsoft ISATAP Adapter
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
Link-local IPv6 Address . . . . . : fe80::5efe:10.0.0.11%24(Preferred)
Default Gateway . . . . . . . . . :
DNS Servers . . . . . . . . . . . : 70.85.0.141
10.0.0.1
NetBIOS over Tcpip. . . . . . . . : Disabled

C:\Windows\system32>netsh interface ip show config

Configuration for interface "Ethernet"
DHCP enabled: Yes
IP Address: 10.0.0.11
Subnet Prefix: 10.0.0.0/24 (mask 255.255.255.0)
Default Gateway: 10.0.0.1
Gateway Metric: 0
InterfaceMetric: 10
Statically Configured DNS Servers: 70.85.0.141
10.0.0.1
Register with which suffix: Primary only
WINS servers configured through DHCP: None

I don't know how to read this, the responses are different, the IP is in the response from an outside DNS, not in the pfsense response, but i have no idea where to go from here. I've set something stupid somewhere, but have no idea what and how I did anything any differently than previous installs of pfsense. thanks for any info

johnpoz

So when you asked pfsense for www.freebsd.org it responded with the root servers. This is could happen I guess when you ask a server for a recursive lookup for something its not authoritative for and it won't do recursive for you. Normally it should just be a refused response.

But I did that query to the NSers you have listed – and guess what

; <<>> DiG 9.8.1-P1 <<>> @__199.192.200.41__ www.freebsd.org
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 33888
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 13, ADDITIONAL: 0
;; WARNING: recursion requested but not available

;; QUESTION SECTION:
;www.freebsd.org. IN A

;; AUTHORITY SECTION:
. 518400 IN NS K.ROOT-SERVERS.NET.
. 518400 IN NS L.ROOT-SERVERS.NET.
. 518400 IN NS M.ROOT-SERVERS.NET.
. 518400 IN NS A.ROOT-SERVERS.NET.
. 518400 IN NS B.ROOT-SERVERS.NET.
. 518400 IN NS C.ROOT-SERVERS.NET.
. 518400 IN NS D.ROOT-SERVERS.NET.
. 518400 IN NS E.ROOT-SERVERS.NET.
. 518400 IN NS F.ROOT-SERVERS.NET.
. 518400 IN NS G.ROOT-SERVERS.NET.
. 518400 IN NS H.ROOT-SERVERS.NET.
. 518400 IN NS I.ROOT-SERVERS.NET.
. 518400 IN NS J.ROOT-SERVERS.NET.

;; Query time: 20 msec
;; SERVER: 199.192.200.41#53(199.192.200.41)
;; WHEN: Mon Jan 14 13:20:38 2013
;; MSG SIZE rcvd: 244

Now notice how fast the response was!! 20 ms – so pfsense by default as you saw in my wireshark trace send the query you ask it to ALL your dns listed. And the first one that responds wins.. So when you query for www.freebsd.org and this guy at 199.192.200.41 answers first with the root servers and a NOERROR as status - pfsense will just hand that back to you.

Remove that guy from your list of dns servers and your issues should go away, the other servers seemed to respond correctly from my test.

edit: I would only suggest you use good dns, that server might have been listed in your benchmark software, but he does not seem to respond to recursive queries..

I asked him for www.goggle.com for example - and again he responds with just the roots

; <<>> DiG 9.8.1-P1 <<>> @199.192.200.41 www.google.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 6568
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 13, ADDITIONAL: 0
;; WARNING: recursion requested but not available

;; QUESTION SECTION:
;www.google.com. IN A

;; AUTHORITY SECTION:
. 518400 IN NS K.ROOT-SERVERS.NET.
. 518400 IN NS L.ROOT-SERVERS.NET.
. 518400 IN NS M.ROOT-SERVERS.NET.
. 518400 IN NS A.ROOT-SERVERS.NET.
. 518400 IN NS B.ROOT-SERVERS.NET.
. 518400 IN NS C.ROOT-SERVERS.NET.
. 518400 IN NS D.ROOT-SERVERS.NET.
. 518400 IN NS E.ROOT-SERVERS.NET.
. 518400 IN NS F.ROOT-SERVERS.NET.
. 518400 IN NS G.ROOT-SERVERS.NET.
. 518400 IN NS H.ROOT-SERVERS.NET.
. 518400 IN NS I.ROOT-SERVERS.NET.
. 518400 IN NS J.ROOT-SERVERS.NET.

;; Query time: 20 msec
;; SERVER: 199.192.200.41#53(199.192.200.41)
;; WHEN: Mon Jan 14 13:28:07 2013
;; MSG SIZE rcvd: 243

But he sure responds FAST ;) So he would be a problem child for all your dns stuff to be sure!! I would think you could be having more issues than your reporting with using him.

From a PTR query, that sure doesn't look like a legit public NS to me
;; ANSWER SECTION:
41.200.192.199.in-addr.arpa. 86400 IN PTR ct41.7wei.com.

See where I bolded that he is not doing recursive lookups - he normally should respond with REFUSED vs sending you back roots.. But not sure what that box actually is or who configured it, or what its running for dns, etc.. etc.

This would also explain why you say it works for awhile and then stops working - if you get a response from one of the other NSers listed with the good info, then pfsense would hand that off to your client. But if he gets this garbage back of just roots, he would hand that off just as well. It doesn't know any better - just forwarding what your asking, and then returning what it gets back ;)

If your not happy with your ISP dns, or any of the other openpublic like google or open or norton, scrubit, etc. Then I would suggest 4.2.2.2 I have had good luck with it over many many years. I personally normally just run my own local that queries roots directly, this was working great when unbound was part of the distro.. And was suppose to be included with 2.1 but seems it has gotten put on the back burner. It will be great day when they fully integrate it into pfsense ;) And I always have my local copy of bind on my ubuntu box I can query, or I have box out in CA and some in EU I use for dns testing for geographic diversity when they are using geoip, etc.

Isn't DNS fun!!! ;)

mechtheist

THANKS!! I haven't tested it yet, but it sure sounds like the right answer. That DNS is one of 4 that DNSexit says I need to use, or at least one of them, there is an implication that the dynamic part won't work right if I don't use their server, but I've rarely used one of theirs, and been okay. I should have known better since DNSBench almost always failed on all 4of those, I assumed it was no response, which shouldn't matter, I'm not clever enough to realize that what I was getting was basically garbage. FUN FUN!

So far so good, got to freebsd, and ip-tools.com, and I just got this, the query without the period always returned the local address and had the local domain appended:

C:\Windows\system32>nslookup www.freebsd.org
Server: pfsense.fuckyouandfuckyourgod.org
Address: 10.0.0.1

Non-authoritative answer:
Name: wfe0.ysv.freebsd.org
Addresses: 2001:1900:2254:206a::50:0
8.8.178.110
Aliases: www.freebsd.org

So thanks again, you must be a shaman in the realms of the internet gods, I shall slaughter a goat to appease any lingering animosity they may hold for me.

johnpoz

"That DNS is one of 4 that DNSexit says I need to use"

Yes to point your domain to as your NS at your registrar, not to use for recursive lookups. That one returning roots is ns3.dnsexit.com

I just tested with your domain, and yes that server does respond as authoritative for your domain, but he does not allow recursive lookups. If those are the 4 your using… They have a really bad setup!!

Authoritative servers normally should NOT allow for recursive -- your just asking to be used in a dos, or have a dos against you. It would not be very difficult to keep those servers really really busy doing recursive to the point that they could not serve up the zones they are suppose to be authoritative for.. DNS can be used in an amplification type attack, you can send very small amounts of data, and get best more data in return. small query, large answer/work doing recursive.

And they claim 100% uptime since 1998?? From what I have seen I would have to say dumb luck ;)

None of those should be used as your forwarders in your pfsense setup. They are used when someone is looking up your domain. Not to be used when looking up freebsd.org or google.com, etc.

Just do whatever it is you do to keep your dynamic updated, I just looked and pfsense dynamic dns has dnsexit listed to keep updated on a wan IP change, etc..

As I stated before if you don't like your isp dns, there are other public dns you can use. googledns should work, if they don't have something close enough to you for your liking try the 4.2.2.2 one or 4.2.2.(1-6) works.

You could also use ntt servers - they allow public queries 129.250.35.250 or .251 you could use the ones at http://www.public-root.com/ they have 2 in US. You could use level3 -- they have a large dns setup, use 209.244.0.3 or .4

Or jut google for public name servers that you can query. But those you using are NO GOOD for recursive lookups ;)

mechtheist

That was the only dnsexit I was using, the rest came from running DNSBench, from Gibson Research Corp, at https://www.grc.com/default.htm , the site has a great deal of good info and tests, seems like a great resource, but probably too basic for you. The benchmark will configure itself with a custom list of dns servers to test, and the ones you mention he also has a great deal of praise for. It's surprising those aren't in my custom list, but I added them and they make a very good showing, so I'm adding the fastest one to the top of my list. Timewarner really sucks so I'm ignoring them. This is the first of about 54 servers tested.

Final benchmark results, sorted by nameserver performance:
(average cached name retrieval speed, fastest to slowest)

10. 0. 0. 1 | Min | Avg | Max |Std.Dev|Reliab%|
–--------------+-------+-------+-------+-------+-------+
+ Cached Name | 0.000 | 0.000 | 0.000 | 0.000 | 100.0 |
+ Uncached Name | 0.018 | 0.065 | 0.236 | 0.053 | 100.0 |
+ DotCom Lookup | 0.019 | 0.030 | 0.063 | 0.012 | 100.0 |
---<-------->---+-------+-------+-------+-------+-------+
pfsense.reality-works.org
Local Network Nameserver

67.214. 64. 27 | Min | Avg | Max |Std.Dev|Reliab%|
----------------+-------+-------+-------+-------+-------+
- Cached Name | 0.010 | 0.013 | 0.023 | 0.002 | 100.0 |
- Uncached Name | 0.034 | 0.117 | 0.399 | 0.092 | 100.0 |
- DotCom Lookup | 0.042 | 0.088 | 0.232 | 0.040 | 100.0 |
---<-------->---+-------+-------+-------+-------+-------+
dns1.telwestonline.com
Corpus Christi Internal

129.115.102.150 | Min | Avg | Max |Std.Dev|Reliab%|
----------------+-------+-------+-------+-------+-------+
- Cached Name | 0.012 | 0.015 | 0.019 | 0.001 | 100.0 |
- Uncached Name | 0.025 | 0.082 | 0.266 | 0.062 | 100.0 |
- DotCom Lookup | 0.053 | 0.068 | 0.078 | 0.006 | 100.0 |
---<-------->---+-------+-------+-------+-------+-------+
juliet.it.utsa.edu
University of Texas at San Antonio

69.164.196. 21 | Min | Avg | Max |Std.Dev|Reliab%|
----------------+-------+-------+-------+-------+-------+
- Cached Name | 0.014 | 0.017 | 0.022 | 0.002 | 100.0 |
- Uncached Name | 0.016 | 0.074 | 0.226 | 0.051 | 98.0 |
- DotCom Lookup | 0.016 | 0.029 | 0.148 | 0.022 | 100.0 |
---<-------->---+-------+-------+-------+-------+-------+
ryujin.darkdna.net
Linode

4. 2. 2. 4 | Min | Avg | Max |Std.Dev|Reliab%|
----------------+-------+-------+-------+-------+-------+
- Cached Name | 0.014 | 0.017 | 0.026 | 0.002 | 100.0 |
- Uncached Name | 0.016 | 0.077 | 0.335 | 0.071 | 100.0 |
- DotCom Lookup | 0.034 | 0.074 | 0.141 | 0.037 | 100.0 |
---<-------->---+-------+-------+-------+-------+-------+
d.resolvers.level3.net
Level 3 Communications

156.154. 71. 1 | Min | Avg | Max |Std.Dev|Reliab%|
----------------+-------+-------+-------+-------+-------+
- Cached Name | 0.015 | 0.017 | 0.024 | 0.002 | 100.0 |
- Uncached Name | 0.016 | 0.082 | 0.258 | 0.064 | 100.0 |
- DotCom Lookup | 0.018 | 0.055 | 0.086 | 0.014 | 100.0 |
---<-------->---+-------+-------+-------+-------+-------+
rdns2.ultradns.net
NEUSTAR

216.146. 36. 36 | Min | Avg | Max |Std.Dev|Reliab%|
----------------+-------+-------+-------+-------+-------+
- Cached Name | 0.016 | 0.018 | 0.023 | 0.001 | 100.0 |
- Uncached Name | 0.018 | 0.064 | 0.213 | 0.046 | 98.0 |
- DotCom Lookup | 0.017 | 0.056 | 0.071 | 0.014 | 100.0 |
---<-------->---+-------+-------+-------+-------+-------+
resolver2.dyndnsinternetguide.com
Dynamic Network Services

4. 2. 2. 1 | Min | Avg | Max |Std.Dev|Reliab%|
----------------+-------+-------+-------+-------+-------+
- Cached Name | 0.014 | 0.018 | 0.030 | 0.003 | 100.0 |
- Uncached Name | 0.016 | 0.073 | 0.265 | 0.059 | 100.0 |
- DotCom Lookup | 0.035 | 0.062 | 0.129 | 0.024 | 100.0 |
---<-------->---+-------+-------+-------+-------+-------+
a.resolvers.level3.net
Level 3 Communications

Thanks again, I've been using the system extensively and only a couple of stray failures, nothing out of the ordinary!!!!

Oh, and thanks to all of the guys behind pfsense, it's amazing how simple it all is and so so easy to set up, especially considering the power/versatility.

johnpoz

"so I'm adding the fastest one to the top of my list"

The order doesn't really matter - you do understand that pfsense queries all the ips listed at the same time, and then uses the one that answers first. Prob doesn't make a lot of sense to have more than a couple of them.

Nor is it going to make much different .016 vs .018 or .05 vs .06

Yeah I know Steve – he likes to make a lot of noise ;) Don't you recall how the raw sockets of XP was going to end the internet as we knew it? Or the whole WMF nonsense? I really wouldn't recommend that site to anyone, be careful of hype he likes to promote. Sure some basic info is there -- and he can explain things in simple terms, but no I wouldn't recommend that site to be honest. Do a simple google "What the World Thinks of Steve Gibson" some fun quotes to be read.

mechtheist

Wow, thanks for the heads up, I knew none of that, all I know of the guy before was his site, the utilities there, like ShieldsUp and DNSBench, which I'd seen recommended by somewhere reputable, seemed genuinely useful, and I don't have the technical chops to seriously evaluate much of any of it. That 'What the world…' page, pretty harsh. Well, great, now I feel even stupider, especially because empty hype disgusts me no end, and false hype is way worse. Have a good one.