OpenDnS not working

JSM11 · Jun 19, 2015, 3:40 PM

Howdy I can't get pfsence to use open dns ive added the dns numbers in the setup and its not sending it over the lan network.

This was working before I updated.

(I start a clean on every update so I know it was working before)

Any ideas?
Cheers

DNS server(s) 127.0.0.1
208.67.222.222
208.67.220.220

doktornotor · Jun 19, 2015, 3:42 PM

You added what where? System - General? No, that sends nothing over the LAN.

JSM11 · Jun 19, 2015, 3:43 PM

@doktornotor:

You added what where? System - General? No, that sends nothing over the LAN.

in General Setup

This is all I did before and has always worked.

doktornotor · Jun 19, 2015, 3:47 PM

That setting is what's used by the firewall itself. Not for LAN clients. You either pass the DNS servers via DHCP, or point the LAN clients to pfSense's DNS server and forward the requests to OpenDNS. Sticking OpenDNS into General Setup does nothing regarding the clients.

JSM11 · Jun 19, 2015, 3:48 PM

@doktornotor:

That setting is what's used by the firewall itself. Not for LAN clients. You either pass the DNS servers via DHCP, or point the LAN clients to pfSense's DNS server and forward the requests to OpenDNS. Sticking OpenDNS into General Setup does nothing regarding the clients.

Odd indeed sir this is all I did before and it worked perfect opendns was blocking everythign I didn't want my son to see on the web.
Do you know how to do it than ? if you have time and will that is.

Cheers

doktornotor · Jun 19, 2015, 3:50 PM

I already have written how to do it. What's unclear there?

JSM11 · Jun 19, 2015, 3:51 PM

@doktornotor:

I already have written how to do it. What's unclear there?

Well quite alot for someone who is new-ish to pfsense and only sticks to the very basics I would have no idea which menu to go to to even start this.

johnpoz · Jun 19, 2015, 4:01 PM

What are you handing to your clients.. Look at your dhcp server settings on pfsense.

Simple ipconfig /all on your clients show you what they are using for dns. There are different settings you can have pfsense hand out itself for dns, and then forward to what you want to forward to be it your isp, public dns like opendns, etc.

If your using the resolver in pfsense vs the forwarder, it will never use opendns even if you tell your clients to use pfsense as dns, etc.

JSM11 · Jun 19, 2015, 4:09 PM

@johnpoz:

What are you handing to your clients.. Look at your dhcp server settings on pfsense.

Simple ipconfig /all on your clients show you what they are using for dns. There are different settings you can have pfsense hand out itself for dns, and then forward to what you want to forward to be it your isp, public dns like opendns, etc.

If your using the resolver in pfsense vs the forwarder, it will never use opendns even if you tell your clients to use pfsense as dns, etc.

All Im trying to do is to make sure every computer / tablet etc… uses the OpenDNS nameservers (208.67.222.222 208.67.220.220)

See this guy adds it to setup and works fine.
https://www.youtube.com/watch?v=lZ6sEWRmvz4

This is all I did before and it worked spot on. Has something changed?

doktornotor · Jun 19, 2015, 4:15 PM

For starters, 2.2.x is using DNS resolver (unbound) instead of DNS forwarder (dnsmasq). So yeah, a whole lot changed, there are the fine release notes/changelogs on the blog/wiki. Useful to read those.

KOM · Jun 19, 2015, 4:23 PM

DHCP will already serve the pfSense LAN IP for DNS by default so DHCP clients should be working already. If your clients are static IP, then you need to configure their network settings and specify pfSense LAN IP as their DNS server. Lastly, you need to edit your LAN firewall rules to prevent your clients from editing their DNS settings and using external DNS:

https://doc.pfsense.org/index.php/Blocking_DNS_queries_to_external_resolvers

doktornotor · Jun 19, 2015, 4:27 PM

@KOM:

DHCP will already serve the pfSense LAN IP for DNS by default so DHCP clients should be working already.

No, not with Unbound. It won't use anything in System - General by default.

wbennett77 · Jun 19, 2015, 4:46 PM

https://doc.pfsense.org/index.php/Unbound_DNS_Resolver - Look for "Enable Forwarding Mode"

JSM11 · Jun 19, 2015, 5:07 PM

All working now guys thanks :)

KOM · Jun 19, 2015, 5:18 PM

No, not with Unbound. It won't use anything in System - General by default.

Ah yes, I checked the option and it will offer pfSense LAN IP if DNS Forwarder is enabled, otherwise it will offer the DNS configured in General Settings.

doktornotor · Jun 19, 2015, 5:34 PM

@KOM:

No, not with Unbound. It won't use anything in System - General by default.

Ah yes, I checked the option and it will offer pfSense LAN IP if DNS Forwarder is enabled, otherwise it will offer the DNS configured in General Settings.

That misleading description in DHCP server settings is already fixed in 2.2.3 snapshots:

"NOTE: leave blank to use the system default DNS servers - this interface's IP if DNS Forwarder or Resolver is enabled, otherwise the servers configured on the General page.

Point being - unbound won't forward anything anywhere by default, it does the resolution itself.

phil.davis · Jun 28, 2015, 8:47 AM

I'll put a summary here that will hopefully help future readers:

If you want to use particular DNS servers out on the internet to do some filtered DNS for you (e.g. OpenDNS or DynDNS Internet Guide or…) then your DNS on pfSense must be in forwarding mode.
a) If DNS Forwarder is enabled - then it always does forwarding mode - easy, done.
b) If DNS Resolver is enabled - then select the checkbox to "Enable Forwarding Mode".

Put the special DNS servers in System->General.

If you are using DHCP on pfSense then let it do its default thing - it will give the clients the pfSense interface IP as the DNS, and pfSense DNS is in forwarding mode to those.

For clients with hard-coded static IPs - set their DNS manually to the pfSense interface IP.

maverik1 · Sep 1, 2015, 5:32 AM

I am unable to get this working…pain in butt with so many tabs dealing with DNS.... I've specified OpenDNS servers under General Setup and made sure Allow DNS server list to be overridden by DHCP option was unchecked. I also specified same OpenDNS servers under DHCP server. Rebooted my machines, cleared cache, cookies, history from browser... ran ipconfig /flushdns... When I do an ipconfig /all DNS server shows 192.168.1.1 which is the dhcp server/gateway and so forth.

I've also verified my IP has been updated with OpenDNS. I've setup Dynamic DNS as well and its working. If I go to Diagnostics and do DNS Lookup I can see it is using OpenDNS servers:

Server Query time
208.67.222.222 22 msec
208.67.220.220 24 msec

Why is it not working?

drurb75 · Feb 19, 2016, 9:10 AM

New to forums - first ever post. Bear with me if I break the rules.

This thread helped confirm I was on the right path - thanks Phil for the succinct solution.

Following on the solution you offered, which is correct, there is one extra setting I found blocking me from forwarding from unbound to OpenDNS specifically; Unchecking the advanced unbound setting to Harden DNSSEC Data allowed me to forward to that service. Note, Google DNS was working with the Harden DNSSEC setting enabled.

One extra point on static / user-set DNS settings in devices on the network - Port Forward traffic into LAN interface that has a DNS (port 53) destination IP that is not the LAN interface IP to the LAN interface IP. No more sneaking around your network-wide DNS settings.

Hope this helps someone.

dabigoreo · Feb 19, 2016, 5:17 PM

Newbie here. Had a similar problem with OpenDNS as well. During initial setup I used the OpenDNS entries on the General page and could not figure out why the welcome test page for OpenDNS said I wasn't configured properly. I eventually figured out that forwarding needed to be turned on for the DNS Resolver (default mode on initial install). This kinda fixed things but then I noticed a lot of websites were not resolving or taking a very long time to resolve. I changed gears by turning off DNS Resolver and enabling DNS Forwarder - all dns issues went away and OpenDNS confirmation was achieved. Hope this helps other newbies to pfsense. 8)