[Solved] blocking external DNS Requests
-
I have no Domain Name resolution
Where? DNS configured how? (Needs to be pfSense LAN interface IP.) Much better done like this instead, if you ask me: https://doc.pfsense.org/index.php/Redirecting_all_DNS_Requests_to_pfSense
(The block rule can stay below the redirect.)
-
Thank you for your reply. Alas, i tried your suggestion, same result…no clients on the network can resolve domain names. All clients use DHCP. I have rebooted the box and deleted and remade the rules...no effect. As for DNS on the box, the resolver is enabled on the lan section and remains untouched. I use OpenNICProject DNS IP's, setup in the "general setup" section...see screen caps. Thank you for your assistance.
-
You should be using the DNS Forwarder, not the Resolver. Resolver is mainly for authoritative DNS. You just want it to pass the request along to the upstream DNS, which is forwarding.
-
Whether a forwarder, resolver, bind or anything else is used there is irrelevant. Post the rules screenshot and some nslookup/dig/drill/whatever from the clients and from pfSense itself.
-
Thank you both for your assistance. Kom's advice worked.
-
Post the rules screenshot
He did in his original post, 2.jpg.
-
And redid the setup in post 2. Sigh. There's no difference how this works no matter what DNS server is used as long as the server is actually working.
-
Anyone noticed that the rules for DNS in pictures 2, first- and second-rule are actually disabled? This way users can still query every DNS server they like which is in contrast to this thread's topic.
-
I won't ask for any more screenshots. Obviously a screenshot of the wiki article and another obviously disfunct one is extremely relevant according to some people here and there's no need for any more info. ::)
-
I won't ask for any more screenshots. Obviously a screenshot of the wiki article and another obviously disfunct one is extremely relevant according to some people here and there's no need for any more info. ::)
Doc, While I really appreciate your input on this subject, does your advice always have to extract a punishment? Must your monumental, elitist arrogance rear its ugly head in your posts? Once again, thank you for nothing.
-
Anyone noticed that the rules for DNS in pictures 2, first- and second-rule are actually disabled? This way users can still query every DNS server they like which is in contrast to this thread's topic.
Wow! you wouldn't disable rules that you could not make work? This was simply a home enthusiast experimenting and trying to gain knowledge, but you and Dok have turned this into a witch hunt….thanks for that and you useful input.
Mod, will you please lock or delete this thread?
-
Trouble is we can only go by what you post. If you post a screenshot of a bunch of disabled rules, we can only assume you're doing it wrong.
These are things that many here could configure or fix in mere seconds. Extracting the information necessary out of people less experienced is sometimes a challenge.
-
Wow! you wouldn't disable rules that you could not make work? This was simply a home enthusiast experimenting and trying to gain knowledge, but you and Dok have turned this into a witch hunt….thanks for that and you useful input.
All I did was pointing out that there are needed rules disabled in your screenshots and nobody seemed to care.
When the rest of your setup is running fine, enabling them probably solves your initial problem. That seemed to have gotten out of focus.Smack me - if I would not have brought the attention to it!
-
Extracting the information necessary out of people less experienced is sometimes a challenge.
Please don't make excuses for childish behaviour. You know perfectly well that it's easy to ask people for details without being a condescending jerk about it. You manage it many times per day, every day, as do most posters here. We need to make these forums friendlier in general. Punishing people for asking questions, even dumb ones, doesn't help grow the project and I'm simply baffled as to why some people choose to behave that way. Perhaps not enough love as a child.
-
And we still have not solved the real problem here. Good that the forum is more friendly now.
-
And we still have not solved the real problem here.
Are you in some sort of hurry to be an ass?
