DNS Resolver problems
-
Lets be clear here, dns has NOTHING to do with the latency of your connection. It can be a bit slower than just using a resolver because it is talking to the actual authoritative server of the domain, and not just pulling a cached entry from your isp or public dns that has 100 of thousands of queries going to it and more likely than not has what you were looking for cached.
The authoritative name server for a specific domain might be on the other side of the globe from you. And you have to find it by walking to down the tree from root.. from . to tld to domain, etc. So that initial query might be a bit slower than just your plain jane forwarder. Also resolver is using dnssec out of the box, which the forwarder is not.
With the resolver you are sure you have full dnssec support and are getting the info from the horses mouth, with a forwarder you have no idea if that IP you looked up is OLD or bad even.. Your just getting what is in the cache of that dns your using.
Now once the resolver has looked it up, it will cache it and the next time you query it as long as your inside the ttl of that record is will be FAST as anything else you look up from the forwarder that was locally cached.
This has nothing to do with SSL or latency of your actual connection.
As to using plex with ssl.. WTF does that have to do with dns?? And sure and the hell pfsense is not going to be doing anything with a https connection any different than any other packets. Unless your using squid with pfsense?? And trying to do ssl interception??
I have plex server and use pfsense have no issues at all. If you point me to this plex thread or give some details of what doesn't work I would be happy to test that.
As to using forwarder vs resolver - I can tell you if your internet connection is shitty, or your isp is shitty and does dns interception/blocking then yea resolver is not going to be for you. And your better off using the forwarder.
But in the big picture using the resolver is much better from a security standpoint than using a forwarder.
Where you can also have a problem with resolver is if the domain your trying to lookup has broken dnssec - then yeah those lookups will FAIL as they rightfully should.. Where if using the forwarder that is not doing dnssec they would lookup just fine.
If your stuff is working fine with forwarder, and your happy then there you go end of discussion. But there is nothing different in the end result with forwarder or resolver when ti comes to looking up something - in the end you look up www.domain.tld you get back an IP.. Those are the exactly the same - its just the security and method of how that actually happens is where there is a difference. And none of that would have any effect on the speed of your connection or ssl..
As to not being able to do speedtest - I use the resolver and can tell you for fact that speedtest works just fine..
If you want to figure out what your actual problem is, please go back to the resolver and post some actual info to what your problem is other than some mention of latency error?? To what speedtest? Something your ISP has setup?? That maybe only their dns resolves? What is the FQDN your trying to go to something.domain.tld ???
And are you trying to connect to your plex remotely with SSL?? Or what exactly?
-
And if the forwarder works and you decide to stick with it I would try enabling forwarder mode of the resolver instead. Then you'll be using the currently-embraced unbound instead of the on-the-way-out dnsmasq.
-
Lets be clear here, dns has NOTHING to do with the latency of your connection. It can be a bit slower than just using a resolver because it is talking to the actual authoritative server of the domain, and not just pulling a cached entry from your isp or public dns that has 100 of thousands of queries going to it and more likely than not has what you were looking for cached.
The authoritative name server for a specific domain might be on the other side of the globe from you. And you have to find it by walking to down the tree from root.. from . to tld to domain, etc. So that initial query might be a bit slower than just your plain jane forwarder. Also resolver is using dnssec out of the box, which the forwarder is not.
With the resolver you are sure you have full dnssec support and are getting the info from the horses mouth, with a forwarder you have no idea if that IP you looked up is OLD or bad even.. Your just getting what is in the cache of that dns your using.
Now once the resolver has looked it up, it will cache it and the next time you query it as long as your inside the ttl of that record is will be FAST as anything else you look up from the forwarder that was locally cached.
This has nothing to do with SSL or latency of your actual connection.
As to using plex with ssl.. WTF does that have to do with dns?? And sure and the hell pfsense is not going to be doing anything with a https connection any different than any other packets. Unless your using squid with pfsense?? And trying to do ssl interception??
I have plex server and use pfsense have no issues at all. If you point me to this plex thread or give some details of what doesn't work I would be happy to test that.
As to using forwarder vs resolver - I can tell you if your internet connection is shitty, or your isp is shitty and does dns interception/blocking then yea resolver is not going to be for you. And your better off using the forwarder.
But in the big picture using the resolver is much better from a security standpoint than using a forwarder.
Where you can also have a problem with resolver is if the domain your trying to lookup has broken dnssec - then yeah those lookups will FAIL as they rightfully should.. Where if using the forwarder that is not doing dnssec they would lookup just fine.
If your stuff is working fine with forwarder, and your happy then there you go end of discussion. But there is nothing different in the end result with forwarder or resolver when ti comes to looking up something - in the end you look up www.domain.tld you get back an IP.. Those are the exactly the same - its just the security and method of how that actually happens is where there is a difference. And none of that would have any effect on the speed of your connection or ssl..
As to not being able to do speedtest - I use the resolver and can tell you for fact that speedtest works just fine..
If you want to figure out what your actual problem is, please go back to the resolver and post some actual info to what your problem is other than some mention of latency error?? To what speedtest? Something your ISP has setup?? That maybe only their dns resolves? What is the FQDN your trying to go to something.domain.tld ???
And are you trying to connect to your plex remotely with SSL?? Or what exactly?
http://forums.sagetv.com/forums/showthread.php?t=62233
https://forums.plex.tv/discussion/175111/pfsense-plex-secure-plex-web-and-long-delay-at-startuphere is the plex problems I am not the only one. say that it can not be how much you like I know what problems I have I invite any admin for a rdp session and see whats going on. As for speedtest.net yes yes with only the resolver I get the error when I enter a opendns in the dhcp serve the problems go, I have had ddwrt,gargoylr,netgear,Asus and untangle and never had these 2 problems I install pfsense with resolver and I get these 2 problems and you say its from my end? if its from my end how come these problems happen only in pfsense using resolver?
-
If you're having DNS problems learn to use DNS tools like dig/drill to figure out what's going on.
-
And if the forwarder works and you decide to stick with it I would try enabling forwarder mode of the resolver instead. Then you'll be using the currently-embraced unbound instead of the on-the-way-out dnsmasq.
Thanks will try it
-
I removed the opendns and tried speed test here is a pic
-
Your pfSense problems need pictures of:
System: General Setup,
Services: DNS forwarder,
Services: DNS Resolver,
Services: DHCP server,
and the clienthost IPaddress from where you test the speed. :) -
IP 192.168.1.14 AND 192.168.1.2
Thanks
-
System: General Setup, you do not need "allow DNS serverlist overridden checked.."
Services: DNS Resolver, listening Network interfaces: select only the inside LAN's,Both the clients have received a DHCP-lease, with DNS 127.0.0.1/192.168.1.1 right ? (So no static with own public DNS)
You have allowed firewall LAN all outgoing ? (at least you want [IPv4 TCP/UDP LAN net * This Firewall 53 (DNS)] ) -
That plex issue with secure plex sure seems to be rebinding protection.. Not DNS exactly.. Yeah public domains shouldn't resolve to rfc1918 address space..
So you could make an exception
server:
private-domain: "example.com"For the domain your trying to hit, or you could just use a host override to point whatever your accessing outside locally so its not public lookup that returns rfc1918
Forwarder does rebinding protection as well you would need something like
rebind-domain-ok=/mydomain.com/https://doc.pfsense.org/index.php/DNS_Rebinding_Protections
In the advanced section of the forwarder to allow your domain to return private IP space. or you could just turn off rebinding protection. How exactly are you trying to access plex??
More than likely your shitty off the shelf routers not going to provide rebinding protection. As to your speedtest… What is the url your using to access that speedtest??
Me personally I don't access my plex from outside other than with vpn.. Clickity Clickity on my vpn network, click open plex app on phone or ipad there you go.. Same goes for any computer, I just vpn in and hit the web page of my plex server.
-
HI johnpoz
You are 100 percent right, the plex problem was the rebinding and ye lol you where again right shitty routers do not have dns rebinding protection and looks like untangle does not have it also so A++ to pfsense :P, I use the phone app or some users use the web browser to access plex, the problem seams to be in using browser but hey it is not worth loosing rebinding protection over it It makes much more sence as you say to use VPN. As for the speedtest I go to speedtest.net and choose my ISP server Madlina, strange part is if i user speedtest.net and select a different server other then my isp it works, and when I specify a public dns in dhcp server madlina works, I turned of dns overwrite in general setup but still same problem
-
@hda:
System: General Setup, you do not need "allow DNS serverlist overridden checked.."
Services: DNS Resolver, listening Network interfaces: select only the inside LAN's,Both the clients have received a DHCP-lease, with DNS 127.0.0.1/192.168.1.1 right ? (So no static with own public DNS)
You have allowed firewall LAN all outgoing ? (at least you want [IPv4 TCP/UDP LAN net * This Firewall 53 (DNS)] )Hi I removed the overwrite in general
2 the 192.168.1.2 has a static dhcp set in the pfsense dhcp
3 resolver listining interface I can not select LAN on its own I get
The following input errors were detected:This system is configured to use the DNS Resolver as its DNS server, so Localhost or All must be selected in Network Interfaces.
when I select local host I do ot get dns -
resolver listining interface I can not select LAN on its own I get
The following input errors were detected:This system is configured to use the DNS Resolver as its DNS server, so Localhost or All must be selected in Network Interfaces.
when I select local host I do ot get dnsCorrect, I forgot to point for Localhost too. Use Ctrl+mouseclick to select LAN(s) and Localhost. (But 'All' should work OK)
-
@hda:
resolver listining interface I can not select LAN on its own I get
The following input errors were detected:This system is configured to use the DNS Resolver as its DNS server, so Localhost or All must be selected in Network Interfaces.
when I select local host I do ot get dnsCorrect, I forgot to point for Localhost too. Use Ctrl+mouseclick to select LAN(s) and Localhost. (But 'All' should work OK)
here are the pic same problem
-
Then to me it looks like DNSSEC-support problem at test-site.
You could test this with unchecking DNSSEC support. But not recommended for the ultimate Resolver use ;)N.B. There is another tough criterium, see Services: DNS Resolver: Advanced (Harden DNSSEC data).
-
@hda:
Then to me it looks like DNSSEC-support problem at test-site.
You could test this with unchecking DNSSEC support. But not recommended for the ultimate Resolver use ;)N.B. There is another tough criterium, see Services: DNS Resolver: Advanced (Harden DNSSEC data).
Hi unchecked both but same problem. lol its a mystery
-
How do you pick "Madlina"
in speedtest? I want to look to what IP/FQDN your testing too..
What city are you using that allows you to select Madlina? Can you post a screen shot showing you picking this - see example below
-
Hi I am from Malta so in Malta and Madlina is where my isp servers are Melita plc
-
Ok I am using resolver and have no issues testing to that server.
I would suggest you do a sniff on your machine when you try and test to that server, vs when you test to a server that works. Or even easier enable debug.. So click on your map before you start test and type debug and you should get a window - see attached… What errors/info do you get in there?
-
Ok I am using resolver and have no issues testing to that server.
I would suggest you do a sniff on your machine when you try and test to that server, vs when you test to a server that works
No idea I installed pfsense on a different pc and same results it only works when I use public dns. sorry what do you mean by doing a sniff?
