Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    DNS Resolver

    Scheduled Pinned Locked Moved 2.2 Snapshot Feedback and Problems - RETIRED
    186 Posts 44 Posters 138.6k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • C
      cmb
      last edited by

      @router_wang:

      Does the resolver also handle IPv6 dns requests?

      Of course.

      1 Reply Last reply Reply Quote 0
      • N
        NobodyHere
        last edited by

        We're running the December 10th build. I can confirm issues with a new WAN address breaking unbound. When our PPPoE WAN link gets a new IP address, the resolver will reply with internal IPs set via DHCP clientIDs, but any external DNS lookup made via a system on the LAN fails.

        DNS resolving on the firewall continues to work, so it's clearly an issue with unbound.

        1 Reply Last reply Reply Quote 0
        • C
          cmb
          last edited by

          @NobodyHere:

          We're running the December 10th build. I can confirm issues with a new WAN address breaking unbound. When our PPPoE WAN link gets a new IP address, the resolver will reply with internal IPs set via DHCP clientIDs, but any external DNS lookup made via a system on the LAN fails.

          DNS resolving on the firewall continues to work, so it's clearly an issue with unbound.

          https://redmine.pfsense.org/issues/4095

          1 Reply Last reply Reply Quote 0
          • N
            NobodyHere
            last edited by

            I'm not sure what a message consisting solely of a link to a similar bug report means…

            1 Reply Last reply Reply Quote 0
            • P
              phil.davis
              last edited by

              @NobodyHere:

              I'm not sure what a message consisting solely of a link to a similar bug report means…

              I think cmb means "it is a known issue and there is a bug report for it".
              It does really need fixing - as you have described, DNS resolution can stop working on a WAN DHCP address change, if you have an "unfortunate" combination of Unbound in forwarder mode… settings.

              As the Greek philosopher Isosceles used to say, "There are 3 sides to every triangle."
              If I helped you, then help someone else - buy someone a gift from the INF catalog http://secure.inf.org/gifts/usd/

              1 Reply Last reply Reply Quote 0
              • C
                cmb
                last edited by

                @phil.davis:

                @NobodyHere:

                I'm not sure what a message consisting solely of a link to a similar bug report means…

                I think cmb means "it is a known issue and there is a bug report for it".

                Yes, figured that was clear.

                1 Reply Last reply Reply Quote 0
                • D
                  dstroot
                  last edited by

                  Latest version broke unbound for me - it did not start after the upgrade.  I had to uncheck "Enable DNSSEC Support" to get it to come up.

                  1 Reply Last reply Reply Quote 0
                  • J
                    jbc
                    last edited by

                    I have DNS resolver setup to use opendns via dnscrypt-proxy.
                    I then have firewall rules setup to only allow lan clients to query lan address on port 53,
                    and block requests to remote DNS'; Everything works in this regard (no dns leaks).

                    But, if I query an unknown, none existant name, such as qwertyuiopas.dfghjklzxcvbnm
                    I get:
                    drill qwertyuiopas.dfghjklzxcvbnm
                    ;; ->>HEADER<<- opcode: QUERY, rcode: NXDOMAIN, id: 40495
                    ;; flags: qr rd ra ; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0
                    ;; QUESTION SECTION:
                    ;; qwertyuiopas.dfghjklzxcvbnm. IN      A

                    ;; ANSWER SECTION:

                    ;; AUTHORITY SECTION:
                    .      2918    IN      SOA    a.root-servers.net. nstld.verisign-grs.com. 2014122700 1800 900 604800 86400

                    ;; ADDITIONAL SECTION:

                    ;; Query time: 28 msec
                    ;; SERVER: 127.0.0.1
                    ;; WHEN: Sat Dec 27 18:05:03 2014
                    ;; MSG SIZE  rcvd: 120

                    And if I ping qwertyuiopas.dfghjklzxcvbnm; It resolves to my WAN ip… (I would expect an unknown host response)

                    I have "NAT Reflection mode for port forwards" set to Pure NAT, could this be the culprit?

                    1 Reply Last reply Reply Quote 0
                    • D
                      dstroot
                      last edited by

                      I am trying to do the same - can your describe this further?

                      "I have DNS resolver setup to use opendns via dnscrypt-proxy.
                      I then have firewall rules setup to only allow lan clients to query lan address on port 53,
                      and block requests to remote DNS';"

                      Right now I have DNS (53) blocked outbound from the LAN and Resolver in forwarding mode using OpenDNS.  However DNSSEC is giving me issues.

                      What was the process to get dnscrypt-proxy going properly?

                      Best,
                      Dan

                      firewall_home_lan_-_Services__DNS_Resolver.png
                      firewall_home_lan_-_Services__DNS_Resolver.png_thumb
                      firewall_home_lan_-_Services__DNS_Resolver__Advanced.png
                      firewall_home_lan_-_Services__DNS_Resolver__Advanced.png_thumb

                      1 Reply Last reply Reply Quote 0
                      • D
                        doktornotor Banned
                        last edited by

                        @dstroot:

                        "I have DNS resolver setup to use opendns via dnscrypt-proxy.
                        Right now I have DNS (53) blocked outbound from the LAN and Resolver in forwarding mode using OpenDNS.  However DNSSEC is giving me issues.

                        DNSSEC != the OpenDNS nonsense that noone else uses. If you want DNSSEC, do not use OpenDNS.

                        1 Reply Last reply Reply Quote 0
                        • J
                          jbc
                          last edited by

                          I installed the dnscrypt-proxy package and setup unbound with a forward-zone to 127.0.0.1.
                          I then setup the dnscrypt-proxy, first using dnscrypt.eu-nl; which worked for a bit, but is unstable, so right now I have it querying opendns while I investigate the dnscrypt.eu issue…

                          btw. I have dnssec checked. no problem.

                          1 Reply Last reply Reply Quote 0
                          • D
                            dstroot
                            last edited by

                            @ doktornotor: "If you want DNSSEC, do not use OpenDNS."

                            OK - do you have a recommendation what to use?

                            1 Reply Last reply Reply Quote 0
                            • D
                              dstroot
                              last edited by

                              @JBC - Thank you.

                              1 Reply Last reply Reply Quote 0
                              • J
                                jbc
                                last edited by

                                I am probably misguided, admittedly, I am not an expect on these matters,
                                but what is the problem with dnscrypt used in conjuction with DNSSEC,
                                as far as I see, they solve different issues…

                                Look at #3: What about DNSSEC? Does this eliminate the need for DNSSEC?

                                https://www.opendns.com/about/innovations/dnscrypt/

                                And again, I actually don't want to use opendns, but dnscrypt.eu.

                                1 Reply Last reply Reply Quote 0
                                • D
                                  doktornotor Banned
                                  last edited by

                                  @dstroot:

                                  @ doktornotor: "If you want DNSSEC, do not use OpenDNS."

                                  OK - do you have a recommendation what to use?

                                  If you are using the DNS censorship features from OpenDNS, I have no suggestions.  :P Unbound is just fine as DNSSEC-validating recursive resolver, without any need for forwarding anywhere.

                                  @jbc:

                                  but what is the problem with dnscrypt used in conjuction with DNSSEC,
                                  Look at #3: What about DNSSEC? Does this eliminate the need for DNSSEC?
                                  https://www.opendns.com/about/innovations/dnscrypt/

                                  You cannot use OpenDNS servers for DNSSEC validation. They don't validate anything.

                                  
>nslookup www.dnssec-failed.org 8.8.4.4
Server:  google-public-dns-b.google.com
Address:  8.8.4.4

*** google-public-dns-b.google.com can't find www.dnssec-failed.org: Server failed

>nslookup www.dnssec-failed.org 208.67.222.222
Server:  resolver1.opendns.com
Address:  208.67.222.222

Non-authoritative answer:
Name:    www.dnssec-failed.org
Addresses:  68.87.109.242
          69.252.193.191
                                  1 Reply Last reply Reply Quote 0
                                  • J
                                    jbc
                                    last edited by

                                    @doktornotor:

                                    I see, thank you for clearing that up :)

                                    edit:
                                    Incase someone stumbles across this, here is a list of free dnscrypt servers;
                                    Column 8 notes if they support DNSSEC or not.

                                    https://github.com/jedisct1/dnscrypt-proxy/blob/master/dnscrypt-resolvers.csv

                                    1 Reply Last reply Reply Quote 0
                                    • M
                                      mir
                                      last edited by

                                      For a censor free and no logging  DNS service which supports DNSSEC I can recommend this:
                                      http://www.censurfridns.dk/

                                      1 Reply Last reply Reply Quote 0
                                      • D
                                        dstroot
                                        last edited by

                                        Maybe everyone already knows this but there is not a whole lot of config advice I can find here.  So I thought I'd share what I have figured out.

                                        It seems you should really only use DNDSEC if you are using unbound as a recursive resolver (which is pretty slow if you are hitting a site for a first time).  Otherwise all is good.

                                        Otherwise turn DNSSEC off if you you are just using it as a forwarder because it's unlikely to be doing anything with OpenDNS (particularly with Google DNS since that seems to cause issues with unbound if you have it on).

                                        From this site: https://calomel.org/unbound_dns.html

                                        
  # If you use forward-zone below to query the Google DNS servers you MUST comment out 
  # this option or all DNS queries will fail:
  # auto-trust-anchor-file: "/var/unbound/etc/root.key"

                                        In either configuration, recursive or forwarder, it will cache DNS entries so subsequent requests are very fast.

                                        Hope this helps someone.

                                        1 Reply Last reply Reply Quote 0
                                        • C
                                          cmb
                                          last edited by

                                          @dstroot:

                                          It seems you should really only use DNDSEC if you are using unbound as a recursive resolver (which is pretty slow if you are hitting a site for a first time).  Otherwise all is good.

                                          Otherwise turn DNSSEC off if you you are just using it as a forwarder because it's unlikely to be doing anything with OpenDNS (particularly with Google DNS since that seems to cause issues with unbound if you have it on).

                                          Only use it in forwarder mode if your configured servers for forwarding support DNSSEC. Google's public DNS is fine there, OpenDNS apparently isn't.

                                          In many situations there won't be much if any difference in query response time between recursive and forwarder. Depends on how much latency between you and that domain's NSes, how much latency there is between you and your forwarders, and whether or not the forwarders have it cached.

                                          1 Reply Last reply Reply Quote 0
                                          • C
                                            cmb
                                            last edited by

                                            @cmb:

                                            @NobodyHere:

                                            We're running the December 10th build. I can confirm issues with a new WAN address breaking unbound. When our PPPoE WAN link gets a new IP address, the resolver will reply with internal IPs set via DHCP clientIDs, but any external DNS lookup made via a system on the LAN fails.

                                            DNS resolving on the firewall continues to work, so it's clearly an issue with unbound.

                                            https://redmine.pfsense.org/issues/4095

                                            The above referenced issue should be fixed. Those who were seeing that, please try on the 31st or newer snapshot.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.