[Solved] blocking external DNS Requests

neilisme

Hello,

So, I went to the how-to's and followed the how to block external DNS requests tutorial. I Inserted the 2 rules exactly as specified…However after the rules are saved and applied, I have no Domain Name resolution. Please see the screen caps for more information. 1: The How-to itself, 2: How my rules look, first rule and second rule

1.jpg_thumb

2.jpg_thumb
![first rule.jpg](/public/imported_attachments/1/first rule.jpg)
![first rule.jpg_thumb](/public/imported_attachments/1/first rule.jpg_thumb)
![second rule.jpg](/public/imported_attachments/1/second rule.jpg)
![second rule.jpg_thumb](/public/imported_attachments/1/second rule.jpg_thumb)

doktornotor

@neilisme:

I have no Domain Name resolution

Where? DNS configured how? (Needs to be pfSense LAN interface IP.) Much better done like this instead, if you ask me: https://doc.pfsense.org/index.php/Redirecting_all_DNS_Requests_to_pfSense

(The block rule can stay below the redirect.)

neilisme

Thank you for your reply. Alas, i tried your suggestion, same result…no clients on the network can resolve domain names. All clients use DHCP. I have rebooted the box and deleted and remade the rules...no effect. As for DNS on the box, the resolver is enabled on the lan section and remains untouched. I use OpenNICProject DNS IP's, setup in the "general setup" section...see screen caps. Thank you for your assistance.

![general setup.jpg](/public/imported_attachments/1/general setup.jpg)
![general setup.jpg_thumb](/public/imported_attachments/1/general setup.jpg_thumb)

resolver.jpg_thumb

KOM

You should be using the DNS Forwarder, not the Resolver. Resolver is mainly for authoritative DNS. You just want it to pass the request along to the upstream DNS, which is forwarding.

doktornotor

Whether a forwarder, resolver, bind or anything else is used there is irrelevant. Post the rules screenshot and some nslookup/dig/drill/whatever from the clients and from pfSense itself.

neilisme

Thank you both for your assistance. Kom's advice worked.

KOM

Post the rules screenshot

He did in his original post, 2.jpg.

doktornotor

And redid the setup in post 2. Sigh. There's no difference how this works no matter what DNS server is used as long as the server is actually working.

jahonix

Anyone noticed that the rules for DNS in pictures 2, first- and second-rule are actually disabled? This way users can still query every DNS server they like which is in contrast to this thread's topic.

doktornotor

I won't ask for any more screenshots. Obviously a screenshot of the wiki article and another obviously disfunct one is extremely relevant according to some people here and there's no need for any more info. ::)

neilisme

@doktornotor:

I won't ask for any more screenshots. Obviously a screenshot of the wiki article and another obviously disfunct one is extremely relevant according to some people here and there's no need for any more info. ::)

Doc, While I really appreciate your input on this subject, does your advice always have to extract a punishment? Must your monumental, elitist arrogance rear its ugly head in your posts? Once again, thank you for nothing.

neilisme

@jahonix:

Anyone noticed that the rules for DNS in pictures 2, first- and second-rule are actually disabled? This way users can still query every DNS server they like which is in contrast to this thread's topic.

Wow! you wouldn't disable rules that you could not make work? This was simply a home enthusiast experimenting and trying to gain knowledge, but you and Dok have turned this into a witch hunt….thanks for that and you useful input.

Mod, will you please lock or delete this thread?

Derelict

Trouble is we can only go by what you post. If you post a screenshot of a bunch of disabled rules, we can only assume you're doing it wrong.

These are things that many here could configure or fix in mere seconds. Extracting the information necessary out of people less experienced is sometimes a challenge.

jahonix

@neilisme:

Wow! you wouldn't disable rules that you could not make work? This was simply a home enthusiast experimenting and trying to gain knowledge, but you and Dok have turned this into a witch hunt….thanks for that and you useful input.

All I did was pointing out that there are needed rules disabled in your screenshots and nobody seemed to care.
When the rest of your setup is running fine, enabling them probably solves your initial problem. That seemed to have gotten out of focus.

Smack me - if I would not have brought the attention to it!

KOM

Extracting the information necessary out of people less experienced is sometimes a challenge.

Please don't make excuses for childish behaviour. You know perfectly well that it's easy to ask people for details without being a condescending jerk about it. You manage it many times per day, every day, as do most posters here. We need to make these forums friendlier in general. Punishing people for asking questions, even dumb ones, doesn't help grow the project and I'm simply baffled as to why some people choose to behave that way. Perhaps not enough love as a child.

doktornotor

And we still have not solved the real problem here. Good that the forum is more friendly now.

KOM

And we still have not solved the real problem here.

Are you in some sort of hurry to be an ass?