DNS Resolver problems

[Derelict]

If you're having DNS problems learn to use DNS tools like dig/drill to figure out what's going on.

[Chrismallia]

@Derelict:

And if the forwarder works and you decide to stick with it I would try enabling forwarder mode of the resolver instead. Then you'll be using the currently-embraced unbound instead of the on-the-way-out dnsmasq.

Thanks will try it

[Chrismallia]

I removed the opendns and tried speed test here is a pic

[hda]

Your pfSense problems need pictures of:
System: General Setup,
Services: DNS forwarder,
Services: DNS Resolver,
Services: DHCP server,
and the clienthost IPaddress from where you test the speed. :)

[Chrismallia]

IP 192.168.1.14 AND 192.168.1.2

Thanks

[hda]

System: General Setup, you do not need "allow DNS serverlist overridden checked.."
Services: DNS Resolver, listening Network interfaces: select only the inside LAN's,

Both the clients have received a DHCP-lease, with DNS 127.0.0.1/192.168.1.1 right ? (So no static with own public DNS)
You have allowed firewall LAN all outgoing ? (at least you want [IPv4 TCP/UDP LAN net * This Firewall 53 (DNS)] )

[johnpoz]

That plex issue with secure plex sure seems to be rebinding protection.. Not DNS exactly..  Yeah public domains shouldn't resolve to rfc1918 address space..

So you could make an exception
server:
private-domain: "example.com"

For the domain your trying to hit, or you could just use a host override to point whatever your accessing outside locally so its not public lookup that returns rfc1918

Forwarder does rebinding protection as well you would need something like
rebind-domain-ok=/mydomain.com/

https://doc.pfsense.org/index.php/DNS_Rebinding_Protections

In the advanced section of the forwarder to allow your domain to return private IP space.  or you could just turn off rebinding protection.  How exactly are you trying to access plex??

More than likely your shitty off the shelf routers not going to provide rebinding protection. As to your speedtest… What is the url your using to access that speedtest??

Me personally I don't access my plex from outside other than with vpn..  Clickity Clickity on my vpn network, click open plex app on phone or ipad there you go.. Same goes for any computer, I just vpn in and hit the web page of my plex server.

[Chrismallia]

HI johnpoz

You are 100 percent right, the plex problem was the rebinding and ye lol you where again right shitty routers do not have dns rebinding protection and looks like untangle does not have it  also so A++ to pfsense  :P, I use the phone app or some users use the web browser to access plex, the problem seams to be in using browser but hey it is not worth loosing rebinding protection over it It makes much more sence as you say to use VPN. As for the speedtest I go to speedtest.net and choose my ISP server Madlina, strange part is if i user speedtest.net and select a different server other then my isp it works, and when I specify a public dns in dhcp server madlina works, I turned of dns overwrite in general setup but still same problem

[Chrismallia]

@hda:

System: General Setup, you do not need "allow DNS serverlist overridden checked.."
Services: DNS Resolver, listening Network interfaces: select only the inside LAN's,

Both the clients have received a DHCP-lease, with DNS 127.0.0.1/192.168.1.1 right ? (So no static with own public DNS)
You have allowed firewall LAN all outgoing ? (at least you want [IPv4 TCP/UDP LAN net * This Firewall 53 (DNS)] )

Hi I removed the overwrite in general
2 the 192.168.1.2 has a static dhcp set in the pfsense dhcp
3 resolver listining interface I can not select LAN on its own I get
The following input errors were detected:

This system is configured to use the DNS Resolver as its DNS server, so Localhost or All must be selected in Network Interfaces.
when I select local host I do ot get dns

[hda]

@Chrismallia:

resolver listining interface I can not select LAN on its own I get
The following input errors were detected:

This system is configured to use the DNS Resolver as its DNS server, so Localhost or All must be selected in Network Interfaces.
when I select local host I do ot get dns

Correct, I forgot to point for Localhost too. Use Ctrl+mouseclick to select LAN(s) and Localhost. (But 'All' should work OK)

[Chrismallia]

@hda:

@Chrismallia:

resolver listining interface I can not select LAN on its own I get
The following input errors were detected:

This system is configured to use the DNS Resolver as its DNS server, so Localhost or All must be selected in Network Interfaces.
when I select local host I do ot get dns

Correct, I forgot to point for Localhost too. Use Ctrl+mouseclick to select LAN(s) and Localhost. (But 'All' should work OK)

here are the pic same problem

[hda]

Then to me it looks like DNSSEC-support problem at test-site.
You could test this with unchecking DNSSEC support. But not recommended for the ultimate Resolver use ;)

N.B. There is another tough criterium, see Services: DNS Resolver: Advanced (Harden DNSSEC data).

[Chrismallia]

@hda:

Then to me it looks like DNSSEC-support problem at test-site.
You could test this with unchecking DNSSEC support. But not recommended for the ultimate Resolver use ;)

N.B. There is another tough criterium, see Services: DNS Resolver: Advanced (Harden DNSSEC data).

Hi unchecked both but same problem. lol its a mystery

[johnpoz]

How do you pick "Madlina"

in speedtest?  I want to look to what IP/FQDN your testing too..

What city are you using that allows you to select Madlina?  Can you post a screen shot showing you picking this - see example below

[Chrismallia]

Hi I am from Malta so in Malta and Madlina is where my isp servers are Melita plc

[johnpoz]

Ok I am using resolver and have no issues testing to that server.

I would suggest you do a sniff on your machine when you try and test to that server, vs when you test to a server that works.  Or even easier enable debug..  So click on your map before you start test and type debug and you should get a window - see attached… What errors/info do you get in there?

[Chrismallia]

@johnpoz:

Ok I am using resolver and have no issues testing to that server.

I would suggest you do a sniff on your machine when you try and test to that server, vs when you test to a server that works

No idea I installed pfsense on a different pc and same results it only works when I use public dns.  sorry what do you mean by doing a sniff?

[johnpoz]

see my edit, enable debug.

Does this resolve, do a nslookup or dig, use dns diag in pfsense

; <<>> DiG 9.9.5-3ubuntu0.7-Ubuntu <<>> speedtest.melita.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 49494
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;speedtest.melita.com.          IN      A

;; ANSWER SECTION:
speedtest.melita.com.  100    IN      A      212.56.138.60

;; AUTHORITY SECTION:
melita.com.            2714    IN      NS      ns1.melitacable.com.
melita.com.            2714    IN      NS      ns.melitacable.com.

;; Query time: 153 msec
;; SERVER: 192.168.9.253#53(192.168.9.253)
;; WHEN: Tue Mar 08 09:47:37 CST 2016
;; MSG SIZE  rcvd: 112

[Chrismallia]

Here is what I got

[johnpoz]

there is going to more to it than that - scroll through it… Can you resolve what I posted speedtest.melita.com

So I show socket latency fails as well, but then it goes to http latency

5780  INFO: socket-latency Test started at 1457451815780
15781  WARNING: REPLACE ME: Handle SubTest Start - socket-latency
30784  ERROR: Latency test returned an error: [AnchorEvent type="error" bubbles=false cancelable=false eventPhase=2] timeout
30785  DEBUG: test started: false
30786  INFO: cleaning up: socket-latency
30787  INFO: MethodId set to: 1
30887  INFO: Starting: latency
30889  INFO: Method: 2/2
30890  INFO: Method Used: http
30890  INFO: Starting subtest: http-latency
30892  INFO: http-latency Test started at 1457451830892
30894  WARNING: REPLACE ME: Handle SubTest Start - http-latency
31619  INFO: progress: 0.1  current: 719  time left: 7434  test: http-latency

You will have to look through the debug where it loads the file and see if you can load it..

Here is from their troubleshooting info

See I can load this - can you
http://speedtest.melita.com/speedtest/latency.txt