Unable to access some sites when going through pfsense

phil.davis

Try
nslookup www.vogue.co.uk.

from a client.

That will tell you if it resolves or not.

For me that resolves like:

nslookup www.vogue.co.uk.
Server:  testoffice-rt-wifi.np.net.inf.org
Address:  10.49.212.250

Non-authoritative answer:
Name:    d2o72irmaclxq5.cloudfront.net
Addresses:  54.230.190.135
          54.230.190.27
          54.230.190.134
          54.230.190.121
          54.230.190.28
          54.230.190.210
          54.230.190.44
          54.230.190.172
Aliases:  www.vogue.co.uk

Try browsing to one of those addresses directly and see if a page starts loading at all…
Try "tracert" to one of those addresses - see if it is getting far.

Then you will know if you have a DNS problem or a routing problem or firewall block or...

muswellhillbilly

Do you have a proxy (Squid?) operating on your pfSense system and are your users accessing the web via the proxy? Also, are you using a local DNS server - such as the pfSense firewalls - to do your DNS forwarding or are you using an outside proxy server? Your nslookup as mentioned by Phil should indicate what your primary DNS server is.

christopheb

No Squid or other proxy and the DNS field is left blank in the DHCP config, meaning that it's the pfsense interface which forwards the requests. I'll send the nslookup output from the sites which can't be accessed as soon as can get it.

muswellhillbilly

Ok, so if there's no DNS server mentioned in the DHCP config then I assume your clients have to have static DNS entries in their network settings in order to resolve hostnames, is that right? Something to note is that in my experience DNS won't pass until after your clients have authenticated through the captive portal. For instance, in my own case the primary DNS server in my DHCP config on the firewall is the firewall itself, which acts as a DNS forwarder. This means that in order for the landing page to come up, the client has to be able to resolve DNS names so that when the first request is made for a page, the user is taken to the login page directly.

Post your nslookup results and we'll see what that tells us.

stephenw10

Leaving the DNS field blank in the pfSense DNS server config page means 'pass the pfSense interface address'. So clients use the pfSense DNS forwarder. That's the default setup.
At least that's how I read it. ;) The results shall tell all.

Steve

jahonix

Which DNS does your pfSense actually use?

If I look at the vogue UK site I see different IPs as compared to phil.davis because the CDN seems to resolve differently from regional locations.

Non-authoritative answer:
www.vogue.co.uk canonical name = d2o72irmaclxq5.cloudfront.net.
Name: d2o72irmaclxq5.cloudfront.net
Address: 54.230.200.241
Name: d2o72irmaclxq5.cloudfront.net
Address: 54.230.201.38
Name: d2o72irmaclxq5.cloudfront.net
Address: 54.230.200.160
Name: d2o72irmaclxq5.cloudfront.net
Address: 54.239.168.104
Name: d2o72irmaclxq5.cloudfront.net
Address: 54.230.201.187
Name: d2o72irmaclxq5.cloudfront.net
Address: 54.230.201.180
Name: d2o72irmaclxq5.cloudfront.net
Address: 54.230.202.80
Name: d2o72irmaclxq5.cloudfront.net
Address: 54.230.201.110

christopheb

Hi,
Thanks all for your responses. stephenw10 is right about leaving the DNS field blank in DHCP. The pfsense interface is passed and pfsense is the DNS forwarder. I'll send the nslookup results as soon as I can.

Christophe.

firewalluser

@jahonix:

Which DNS does your pfSense actually use?

If I look at the vogue UK site I see different IPs as compared to phil.davis because the CDN seems to resolve differently from regional locations.

Non-authoritative answer:
www.vogue.co.uk canonical name = d2o72irmaclxq5.cloudfront.net.
Name: d2o72irmaclxq5.cloudfront.net
Address: 54.230.200.241
Name: d2o72irmaclxq5.cloudfront.net
Address: 54.230.201.38
Name: d2o72irmaclxq5.cloudfront.net
Address: 54.230.200.160
Name: d2o72irmaclxq5.cloudfront.net
Address: 54.239.168.104
Name: d2o72irmaclxq5.cloudfront.net
Address: 54.230.201.187
Name: d2o72irmaclxq5.cloudfront.net
Address: 54.230.201.180
Name: d2o72irmaclxq5.cloudfront.net
Address: 54.230.202.80
Name: d2o72irmaclxq5.cloudfront.net
Address: 54.230.201.110

Waitrose is another company that hosts some of their website on cloudfront, so if you use the firefox addon called noscript, allow waitrose.com but dont allow anything else ie blocking trackers and advertisers, you cant shop at Waitrose which cant be good for sales!

christopheb

Hi, I finally got around to going on-site for this issue. Narrowed it down to Safari. It seems that the DNS forwarder doesn't like the Safari prefetching feature. Sometimes It would get "Query refused" from the DNS forwarder. Was resolved by setting the default gateway of my ISP as the DNS in dhcp settings.

http://support.apple.com/en-us/HT203387

C:\Users\ChristopheB>nslookup espn.co.uk
Server: pfsense.localdomain
Address: 10.0.0.1

*** pfsense.localdomain can't find espn.co.uk: Query refused

C:\Users\ChristopheB>nslookup espn.co.uk
Server: pfsense.localdomain
Address: 10.0.0.1

Non-authoritative answer:
Name: espn.co.uk
Address: 80.168.92.140

stephenw10

Thanks for coming back with that useful info. Must be quite a few people that have been hit by this. Safari 5.0.1 was released in 2010 though so almost everyone using would be affected you'd think.

Steve