Unable to route incoming DNS traffic
-
so these are all public IPs and your natting at pfsense.
So you say you can ping the bind servers IP from the public? Your saying when you sniff on the bind server you see no dns traffic from public internet but you see the pings? And the bind server can query dns on the public internet?
-
I have a bind server which I want to make available to the wider world through my pfSense device.
IMHO this isn't the best idea. DDOS attacks are common using improperly configured bind servers. Port 53 traffic may be blocked by your ISP because of this.
-
so these are all public IPs and your natting at pfsense.
All are public IPs, and I am not performing any NAT - just trying to simply route.
So you say you can ping the bind servers IP from the public?
Correct. And I can SSH to it.
Your saying when you sniff on the bind server you see no dns traffic from public internet but you see the pings?
Correct.
And the bind server can query dns on the public internet?
Correct. I can query DNS against 8.8.8.8 no problem.
Port 53 traffic may be blocked by your ISP.
No ports are filtered by my ISP. When I remove the pfSense device from the picture (and replace it with something like VyOS) - it works no problem.
-
Can you post a screen shot of your firewall rules?
-
Can you post a screen shot of your firewall rules?
Sure…. I've also attached a log to show that traffic is being logged for this rule, and that SSH traffic is flowing through.
I know the rule I've created is dangerous - however I am trying to rule out where the problem is.
-
And where it that you see 53 traffic.. All see there is ssh traffic.
why would pfsense block 53?? Makes no sense you got something else going on or 53 is not even getting to you. Why don't you sniff on the wan and lan of pfsense and lets see the 53 traffic hit wan and not go out lan, or maybe it does?
So you photoshopped those rules? because 77.77.77.2 is not your real IP..
-
The screenshots do NOT show DNS traffic and chances are high that inbound DNS is completely blocked by ISP.
-
what dns traffic are you seeing in those screenshots dok?
Do you have any rules in floating?
-
None of course. Tried typing on touchscreen junk after a couple of months.
-
Is the downstream router NAT'd?
IMHO, I would have created an explicit rule to take traffic going into port 53 on the WAN side of pfSense and routes it to the IP address/port 53 of the downstream router. In the downstream router you'd direct that traffic to the bind server.
-
And where it that you see 53 traffic.. All see there is ssh traffic.
I don't - that's the problem. I don't see any DNS traffic coming in.
why would pfsense block 53?? Makes no sense you got something else going on or 53 is not even getting to you. Why don't you sniff on the wan and lan of pfsense and lets see the 53 traffic hit wan and not go out lan, or maybe it does?
This is what I'm trying to figure out - it doesn't make sense to me why pfSense is not passing inbound DNS requests through.
How do I perform sniffing on the pfSense device itself?So you photoshopped those rules? because 77.77.77.2 is not your real IP..
I have replaced my IPs in my original post and in my firewall log for the purposes of this post.
The screenshots do NOT show DNS traffic and chances are high that inbound DNS is completely blocked by ISP.
As mentioned in an earlier post, if I replace my pfSense device with VyOS - DNS works no problem - so I know port 53 and inbound DNS are NOT filtered by my ISP.
-
you sniff on pfsense under diag, packet capture.
And your floating tab is empty?
I see your blocking bogon - is it possible your source of dns traffic would be in bogon?
