DNS Resolver problems
-
IP 192.168.1.14 AND 192.168.1.2
Thanks
-
System: General Setup, you do not need "allow DNS serverlist overridden checked.."
Services: DNS Resolver, listening Network interfaces: select only the inside LAN's,Both the clients have received a DHCP-lease, with DNS 127.0.0.1/192.168.1.1 right ? (So no static with own public DNS)
You have allowed firewall LAN all outgoing ? (at least you want [IPv4 TCP/UDP LAN net * This Firewall 53 (DNS)] ) -
That plex issue with secure plex sure seems to be rebinding protection.. Not DNS exactly.. Yeah public domains shouldn't resolve to rfc1918 address space..
So you could make an exception
server:
private-domain: "example.com"For the domain your trying to hit, or you could just use a host override to point whatever your accessing outside locally so its not public lookup that returns rfc1918
Forwarder does rebinding protection as well you would need something like
rebind-domain-ok=/mydomain.com/https://doc.pfsense.org/index.php/DNS_Rebinding_Protections
In the advanced section of the forwarder to allow your domain to return private IP space. or you could just turn off rebinding protection. How exactly are you trying to access plex??
More than likely your shitty off the shelf routers not going to provide rebinding protection. As to your speedtest… What is the url your using to access that speedtest??
Me personally I don't access my plex from outside other than with vpn.. Clickity Clickity on my vpn network, click open plex app on phone or ipad there you go.. Same goes for any computer, I just vpn in and hit the web page of my plex server.
-
HI johnpoz
You are 100 percent right, the plex problem was the rebinding and ye lol you where again right shitty routers do not have dns rebinding protection and looks like untangle does not have it also so A++ to pfsense :P, I use the phone app or some users use the web browser to access plex, the problem seams to be in using browser but hey it is not worth loosing rebinding protection over it It makes much more sence as you say to use VPN. As for the speedtest I go to speedtest.net and choose my ISP server Madlina, strange part is if i user speedtest.net and select a different server other then my isp it works, and when I specify a public dns in dhcp server madlina works, I turned of dns overwrite in general setup but still same problem
-
@hda:
System: General Setup, you do not need "allow DNS serverlist overridden checked.."
Services: DNS Resolver, listening Network interfaces: select only the inside LAN's,Both the clients have received a DHCP-lease, with DNS 127.0.0.1/192.168.1.1 right ? (So no static with own public DNS)
You have allowed firewall LAN all outgoing ? (at least you want [IPv4 TCP/UDP LAN net * This Firewall 53 (DNS)] )Hi I removed the overwrite in general
2 the 192.168.1.2 has a static dhcp set in the pfsense dhcp
3 resolver listining interface I can not select LAN on its own I get
The following input errors were detected:This system is configured to use the DNS Resolver as its DNS server, so Localhost or All must be selected in Network Interfaces.
when I select local host I do ot get dns -
resolver listining interface I can not select LAN on its own I get
The following input errors were detected:This system is configured to use the DNS Resolver as its DNS server, so Localhost or All must be selected in Network Interfaces.
when I select local host I do ot get dnsCorrect, I forgot to point for Localhost too. Use Ctrl+mouseclick to select LAN(s) and Localhost. (But 'All' should work OK)
-
@hda:
resolver listining interface I can not select LAN on its own I get
The following input errors were detected:This system is configured to use the DNS Resolver as its DNS server, so Localhost or All must be selected in Network Interfaces.
when I select local host I do ot get dnsCorrect, I forgot to point for Localhost too. Use Ctrl+mouseclick to select LAN(s) and Localhost. (But 'All' should work OK)
here are the pic same problem
-
Then to me it looks like DNSSEC-support problem at test-site.
You could test this with unchecking DNSSEC support. But not recommended for the ultimate Resolver use ;)N.B. There is another tough criterium, see Services: DNS Resolver: Advanced (Harden DNSSEC data).
-
@hda:
Then to me it looks like DNSSEC-support problem at test-site.
You could test this with unchecking DNSSEC support. But not recommended for the ultimate Resolver use ;)N.B. There is another tough criterium, see Services: DNS Resolver: Advanced (Harden DNSSEC data).
Hi unchecked both but same problem. lol its a mystery
-
How do you pick "Madlina"
in speedtest? I want to look to what IP/FQDN your testing too..
What city are you using that allows you to select Madlina? Can you post a screen shot showing you picking this - see example below
-
Hi I am from Malta so in Malta and Madlina is where my isp servers are Melita plc
-
Ok I am using resolver and have no issues testing to that server.
I would suggest you do a sniff on your machine when you try and test to that server, vs when you test to a server that works. Or even easier enable debug.. So click on your map before you start test and type debug and you should get a window - see attached… What errors/info do you get in there?
-
Ok I am using resolver and have no issues testing to that server.
I would suggest you do a sniff on your machine when you try and test to that server, vs when you test to a server that works
No idea I installed pfsense on a different pc and same results it only works when I use public dns. sorry what do you mean by doing a sniff?
-
see my edit, enable debug.
Does this resolve, do a nslookup or dig, use dns diag in pfsense
; <<>> DiG 9.9.5-3ubuntu0.7-Ubuntu <<>> speedtest.melita.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 49494
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 1;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;speedtest.melita.com. IN A;; ANSWER SECTION:
speedtest.melita.com. 100 IN A 212.56.138.60;; AUTHORITY SECTION:
melita.com. 2714 IN NS ns1.melitacable.com.
melita.com. 2714 IN NS ns.melitacable.com.;; Query time: 153 msec
;; SERVER: 192.168.9.253#53(192.168.9.253)
;; WHEN: Tue Mar 08 09:47:37 CST 2016
;; MSG SIZE rcvd: 112
-
Here is what I got
-
there is going to more to it than that - scroll through it… Can you resolve what I posted speedtest.melita.com
So I show socket latency fails as well, but then it goes to http latency
5780 INFO: socket-latency Test started at 1457451815780
15781 WARNING: REPLACE ME: Handle SubTest Start - socket-latency
30784 ERROR: Latency test returned an error: [AnchorEvent type="error" bubbles=false cancelable=false eventPhase=2] timeout
30785 DEBUG: test started: false
30786 INFO: cleaning up: socket-latency
30787 INFO: MethodId set to: 1
30887 INFO: Starting: latency
30889 INFO: Method: 2/2
30890 INFO: Method Used: http
30890 INFO: Starting subtest: http-latency
30892 INFO: http-latency Test started at 1457451830892
30894 WARNING: REPLACE ME: Handle SubTest Start - http-latency
31619 INFO: progress: 0.1 current: 719 time left: 7434 test: http-latencyYou will have to look through the debug where it loads the file and see if you can load it..
Here is from their troubleshooting info
See I can load this - can you
http://speedtest.melita.com/speedtest/latency.txt
-
sorry here is all of it. and no I get a page error going to that url
12528 INFO: calculateDistances: 3100
12559 INFO: calculateDistances: 3200
12579 INFO: calculateDistances: 3300
12594 INFO: calculateDistances: 3400
12607 INFO: calculateDistances: 3500
12619 INFO: calculateDistances: 3600
12634 INFO: calculateDistances: 3700
12648 INFO: calculateDistances: 3800
12671 INFO: calculateDistances: 3900
12700 INFO: calculateDistances: 4000
12729 INFO: calculateDistances: 4100
12748 INFO: calculateDistances: 4200
12759 INFO: calculateDistances: 4300
12765 INFO: calculateDistances: 4400
12767 INFO: Distances loaded: 39164
12947 INFO: Distances sorted
12947 INFO: TileMapContainer.placeMarkers
12950 INFO: place markers: 6
12951 INFO: Current Zoom Level: 6 - max Distance: 20 distance pairs: 39164
12965 INFO: getMarkers Done
12965 INFO: Groups: 4484
13250 INFO: markers placed: 4487
13251 INFO: Table Map Dragger Loaded
13252 INFO: load topmap
13252 INFO: object Added: topmap
13252 INFO: [object _-Ei]
13252 INFO: 114.5 11.45
13252 INFO: 5
13253 INFO: wavehash:undefined
14367 INFO: bring to front
14376 INFO: 2495,2497,2492,2494,2498
14376 INFO: 2496,2498,2493,2495,2499
44290 INFO: onRelease Dragger
44290 INFO: Stopped panning, top left: 38.34277,8.96346, center: 35.93469,14.47860, bottom right: 33.45097,19.99374, zoom: 6
52290 INFO: Showing debug window
59086 INFO: bring to front
59100 INFO: 2495,2497,2492,2494,2498
59101 INFO: 2496,2498,2493,2495,2499
60765 INFO: onRelease Dragger
60767 INFO: serverflyoutbutton click
60769 INFO: removed old dragger
60773 INFO: wavehash:undefined
60774 INFO: stopTimer current Count:8310865169
60775 INFO: stopTimer desired Count:8310866837
60775 INFO: ServerId set to: 2493
60981 INFO: trackEvent: test_started
60984 INFO: serverflyout click
61297 INFO: delete object: [object _-9W]
61530 INFO: Tile Map Container Loaded
61535 INFO: object Added: tabletilemapcontainer
61565 INFO: y: 103 factor: 1.819078947368421
61565 INFO: y: 105 factor: 1.838815789473684
62044 INFO: object Added: test
62045 INFO: object Added: speedtest
62047 INFO: object Added: speedtest-download-graph
62049 INFO: object Added: finalresults
62051 INFO: object Added: speedtest-download-graph-final
62531 INFO: MethodId set to: 0
62531 INFO: Vars: preferredserverid=2992
62532 INFO: Vars: startmode=serverclick
62533 INFO: Vars: promo=
62534 INFO: Starting test
62537 INFO: Starting: throttling
62541 INFO: Method: 1/2
62542 INFO: Method Used: tcp
62545 INFO: Method: 1/2
62546 INFO: Method Used: tcp
62547 INFO: Starting: latency
62549 INFO: Method: 1/2
62550 INFO: Method Used: tcp
62553 INFO: Starting subtest: socket-latency
62558 INFO: socket-latency Test started at 1457451962558
62561 WARNING: REPLACE ME: Handle SubTest Start - socket-latency
77562 ERROR: Latency test returned an error: [AnchorEvent type="error" bubbles=false cancelable=false eventPhase=2] timeout
77565 DEBUG: test started: false
77567 INFO: cleaning up: socket-latency
77569 INFO: MethodId set to: 1
77662 INFO: Starting: latency
77666 INFO: Method: 2/2
77667 INFO: Method Used: http
77668 INFO: Starting subtest: http-latency
77671 INFO: http-latency Test started at 1457451977671
77676 WARNING: REPLACE ME: Handle SubTest Start - http-latency
82562 ERROR: SocketConnection 0 securityErrorHandler: [SecurityErrorEvent type="securityError" bubbles=false cancelable=false eventPhase=2 text="Error #2048"]
88997 ERROR: Latency test returned an error while trying to read the latency file.
88998 DEBUG: test started: false
89003 INFO: Loading Error Strings
89005 INFO: MethodId set to: 0
89006 INFO: Vars: preferredserverid=2992
89007 INFO: Vars: startmode=serverclick
89010 INFO: Vars: promo=
89012 INFO: Closing all TCP connections
89014 INFO: Connections closed: 0
89017 WARNING: REPLACE ME: HandleFatal - http-latency
89021 INFO: EndTestHandler Loaded
89027 INFO: object Added: endtest
89045 INFO: trackEvent: test_error
89999 ERROR: UNCAUGHT ERROR
90002 ERROR: ArgumentError: Error #2109
90011 ERROR: UNCAUGHT ERROR
90013 ERROR: ArgumentError: Error #2109
65989 ERROR: UNCAUGHT ERROR
65991 ERROR: ArgumentError: Error #2109
66008 ERROR: UNCAUGHT ERROR
66012 ERROR: ArgumentError: Error #2109
66027 ERROR: UNCAUGHT ERROR
66029 ERROR: ArgumentError: Error #2109
11535 ERROR: UNCAUGHT ERROR
11539 ERROR: ArgumentError: Error #2109
11746 ERROR: UNCAUGHT ERROR
11747 ERROR: ArgumentError: Error #2109
11838 ERROR: UNCAUGHT ERROR
11839 ERROR: ArgumentError: Error #2109
13307 ERROR: UNCAUGHT ERROR
13308 ERROR: ArgumentError: Error #2109
13329 ERROR: UNCAUGHT ERROR
13331 ERROR: ArgumentError: Error #2109
13338 ERROR: UNCAUGHT ERROR
13341 ERROR: ArgumentError: Error #2109
19624 ERROR: UNCAUGHT ERROR
19627 ERROR: ArgumentError: Error #2109
19682 ERROR: UNCAUGHT ERROR
19683 ERROR: ArgumentError: Error #2109
19705 ERROR: UNCAUGHT ERROR
19706 ERROR: ArgumentError: Error #2109
20744 ERROR: UNCAUGHT ERROR
20747 ERROR: ArgumentError: Error #2109
20757 ERROR: UNCAUGHT ERROR
20760 ERROR: ArgumentError: Error #2109
84523 ERROR: UNCAUGHT ERROR
84527 ERROR: ArgumentError: Error #2109 -
I don't see in there where your even getting the server name you want to test too..
Looks to be more an error in your speedtest applet than any sort of network problem.. Not sure how you can get any test to work if you don't get the server url to go to.. See in my debug where it use the url http://speedtest.melita.com/
I don't see any server url anywhere in that debug log.. did you start it after you click on the server? Start the debug before you pick your server, and try it with a server that works. You should see the url your going to for test when you pick a different server.
Also validate that you can resolve
speedtest.melita.com
can you load this
http://speedtest.melita.com/speedtest/latency.txtjust direct in your browser?
-
can you load this
http://speedtest.melita.com/speedtest/latency.txtjust direct in your browser?
No I get a page error in my browser, do you want logs of server that works? I tried other browsers PCs and phone still the same error
-
what do you get when you try and resolve it.. Use nslookup, or dig or drill or even the diag lookup page on pfsense.
Try to ping the name - does it come back with IP or unknown host, etc.
Let me see if that domain has dnssec enabled that is broken
edit: I don't show them having dnssec available… But its quite possible your having issue with connectivity to their authoritative servers..
But I do show their dns to be hosed from online testers
I show their 1 server for sure not answering
;; ANSWER SECTION:
melita.com. 3600 IN NS ns1.melitacable.com.
melita.com. 3600 IN NS ns.melitacable.com.;; ADDITIONAL SECTION:
ns.melitacable.com. 3600 IN A 212.56.128.132
ns1.melitacable.com. 3600 IN A 212.56.128.196so while .196 answers, I can not get a response from .132
; <<>> DiG 9.9.5-3ubuntu0.7-Ubuntu <<>> @212.56.128.132 melita.com NS
; (1 server found)
;; global options: +cmd
;; connection timed out; no servers could be reachedSo it would seem they have issues.. Might be connectivity from parts of the world, etc.
Well now another query works... So they could be having issues.. If your resolving and having problems talking to their NS then yes that could explain why using forwarder works since your just asking for something that a NS already has cached.
