OpenDnS not working
-
I already have written how to do it. What's unclear there?
Well quite alot for someone who is new-ish to pfsense and only sticks to the very basics I would have no idea which menu to go to to even start this.
-
What are you handing to your clients.. Look at your dhcp server settings on pfsense.
Simple ipconfig /all on your clients show you what they are using for dns. There are different settings you can have pfsense hand out itself for dns, and then forward to what you want to forward to be it your isp, public dns like opendns, etc.
If your using the resolver in pfsense vs the forwarder, it will never use opendns even if you tell your clients to use pfsense as dns, etc.
-
What are you handing to your clients.. Look at your dhcp server settings on pfsense.
Simple ipconfig /all on your clients show you what they are using for dns. There are different settings you can have pfsense hand out itself for dns, and then forward to what you want to forward to be it your isp, public dns like opendns, etc.
If your using the resolver in pfsense vs the forwarder, it will never use opendns even if you tell your clients to use pfsense as dns, etc.
All Im trying to do is to make sure every computer / tablet etc… uses the OpenDNS nameservers (208.67.222.222 208.67.220.220)
See this guy adds it to setup and works fine.
https://www.youtube.com/watch?v=lZ6sEWRmvz4This is all I did before and it worked spot on. Has something changed?
-
For starters, 2.2.x is using DNS resolver (unbound) instead of DNS forwarder (dnsmasq). So yeah, a whole lot changed, there are the fine release notes/changelogs on the blog/wiki. Useful to read those.
-
DHCP will already serve the pfSense LAN IP for DNS by default so DHCP clients should be working already. If your clients are static IP, then you need to configure their network settings and specify pfSense LAN IP as their DNS server. Lastly, you need to edit your LAN firewall rules to prevent your clients from editing their DNS settings and using external DNS:
https://doc.pfsense.org/index.php/Blocking_DNS_queries_to_external_resolvers
-
@KOM:
DHCP will already serve the pfSense LAN IP for DNS by default so DHCP clients should be working already.
No, not with Unbound. It won't use anything in System - General by default.
-
https://doc.pfsense.org/index.php/Unbound_DNS_Resolver - Look for "Enable Forwarding Mode"
-
All working now guys thanks :)
-
No, not with Unbound. It won't use anything in System - General by default.
Ah yes, I checked the option and it will offer pfSense LAN IP if DNS Forwarder is enabled, otherwise it will offer the DNS configured in General Settings.
-
@KOM:
No, not with Unbound. It won't use anything in System - General by default.
Ah yes, I checked the option and it will offer pfSense LAN IP if DNS Forwarder is enabled, otherwise it will offer the DNS configured in General Settings.
That misleading description in DHCP server settings is already fixed in 2.2.3 snapshots:
"NOTE: leave blank to use the system default DNS servers - this interface's IP if DNS Forwarder or Resolver is enabled, otherwise the servers configured on the General page.
Point being - unbound won't forward anything anywhere by default, it does the resolution itself.
-
I'll put a summary here that will hopefully help future readers:
If you want to use particular DNS servers out on the internet to do some filtered DNS for you (e.g. OpenDNS or DynDNS Internet Guide or…) then your DNS on pfSense must be in forwarding mode.
a) If DNS Forwarder is enabled - then it always does forwarding mode - easy, done.
b) If DNS Resolver is enabled - then select the checkbox to "Enable Forwarding Mode".Put the special DNS servers in System->General.
If you are using DHCP on pfSense then let it do its default thing - it will give the clients the pfSense interface IP as the DNS, and pfSense DNS is in forwarding mode to those.
For clients with hard-coded static IPs - set their DNS manually to the pfSense interface IP.
-
I am unable to get this working…pain in butt with so many tabs dealing with DNS.... I've specified OpenDNS servers under General Setup and made sure Allow DNS server list to be overridden by DHCP option was unchecked. I also specified same OpenDNS servers under DHCP server. Rebooted my machines, cleared cache, cookies, history from browser... ran ipconfig /flushdns... When I do an ipconfig /all DNS server shows 192.168.1.1 which is the dhcp server/gateway and so forth.
I've also verified my IP has been updated with OpenDNS. I've setup Dynamic DNS as well and its working. If I go to Diagnostics and do DNS Lookup I can see it is using OpenDNS servers:
Server Query time
208.67.222.222 22 msec
208.67.220.220 24 msecWhy is it not working?
-
New to forums - first ever post. Bear with me if I break the rules.
This thread helped confirm I was on the right path - thanks Phil for the succinct solution.
Following on the solution you offered, which is correct, there is one extra setting I found blocking me from forwarding from unbound to OpenDNS specifically; Unchecking the advanced unbound setting to Harden DNSSEC Data allowed me to forward to that service. Note, Google DNS was working with the Harden DNSSEC setting enabled.
One extra point on static / user-set DNS settings in devices on the network - Port Forward traffic into LAN interface that has a DNS (port 53) destination IP that is not the LAN interface IP to the LAN interface IP. No more sneaking around your network-wide DNS settings.
Hope this helps someone.
-
Newbie here. Had a similar problem with OpenDNS as well. During initial setup I used the OpenDNS entries on the General page and could not figure out why the welcome test page for OpenDNS said I wasn't configured properly. I eventually figured out that forwarding needed to be turned on for the DNS Resolver (default mode on initial install). This kinda fixed things but then I noticed a lot of websites were not resolving or taking a very long time to resolve. I changed gears by turning off DNS Resolver and enabling DNS Forwarder - all dns issues went away and OpenDNS confirmation was achieved. Hope this helps other newbies to pfsense. 8)
-
I know this is a bit old, but I just wanted to confirm that disabling the Harden DNSSEC Data and enabling DNS Query Forwarding will allow OpenDNS to work.
Enabling the DNS Query Forwarding on the resolver will break DNS for clients if Harden DNSSEC Data is enabled. I was kicking all around trying to get this working.
Disable Harden DNSSEC Data:
Services > DNS Resolver > Advanced Settings > Uncheck Harden DNSSEC Data
Services > DNS Resolver > Check DNS Query Forwarding -
I know this is a bit old, but I just wanted to confirm that disabling the Harden DNSSEC Data and enabling DNS Query Forwarding will allow OpenDNS to work.
Enabling the DNS Query Forwarding on the resolver will break DNS for clients if Harden DNSSEC Data is enabled. I was kicking all around trying to get this working.
Disable Harden DNSSEC Data:
Services > DNS Resolver > Advanced Settings > Uncheck Harden DNSSEC Data
Services > DNS Resolver > Check DNS Query ForwardingToday, November 2017, OpenDNS isn't doing any DNSSEC yet, and worse, by concept it can't pass along the DNS requests without breaking the security chain.
-
Well, it's now November 2018 and OpenDNS still does not support DNSSEC. Good to see things have changed a lot in a year.
-
Why would they support DNSSEC? One of their primary purposes is to alter DNS replies to do things DNSSEC is designed to prevent.
-
this helped me, the last few entries, but here is what fixed it for me in
2023...Services > DNS Resolver > Advanced Settings > Left it checked
Services > DNS Resolver > Check DNS Query Forwardingseems like I am using OpenDNS, like I wanted, but still able to use my dns resolver so I can do host overrides and anything else I want to do in DNS.
