DNS Resolver problems

johnpoz

That plex issue with secure plex sure seems to be rebinding protection.. Not DNS exactly.. Yeah public domains shouldn't resolve to rfc1918 address space..

So you could make an exception
server:
private-domain: "example.com"

For the domain your trying to hit, or you could just use a host override to point whatever your accessing outside locally so its not public lookup that returns rfc1918

Forwarder does rebinding protection as well you would need something like
rebind-domain-ok=/mydomain.com/

https://doc.pfsense.org/index.php/DNS_Rebinding_Protections

In the advanced section of the forwarder to allow your domain to return private IP space. or you could just turn off rebinding protection. How exactly are you trying to access plex??

More than likely your shitty off the shelf routers not going to provide rebinding protection. As to your speedtest… What is the url your using to access that speedtest??

Me personally I don't access my plex from outside other than with vpn.. Clickity Clickity on my vpn network, click open plex app on phone or ipad there you go.. Same goes for any computer, I just vpn in and hit the web page of my plex server.

rebind.png_thumb

Chrismallia

HI johnpoz

You are 100 percent right, the plex problem was the rebinding and ye lol you where again right shitty routers do not have dns rebinding protection and looks like untangle does not have it also so A++ to pfsense :P, I use the phone app or some users use the web browser to access plex, the problem seams to be in using browser but hey it is not worth loosing rebinding protection over it It makes much more sence as you say to use VPN. As for the speedtest I go to speedtest.net and choose my ISP server Madlina, strange part is if i user speedtest.net and select a different server other then my isp it works, and when I specify a public dns in dhcp server madlina works, I turned of dns overwrite in general setup but still same problem

Chrismallia

@hda:

System: General Setup, you do not need "allow DNS serverlist overridden checked.."
Services: DNS Resolver, listening Network interfaces: select only the inside LAN's,

Both the clients have received a DHCP-lease, with DNS 127.0.0.1/192.168.1.1 right ? (So no static with own public DNS)
You have allowed firewall LAN all outgoing ? (at least you want [IPv4 TCP/UDP LAN net * This Firewall 53 (DNS)] )

Hi I removed the overwrite in general
2 the 192.168.1.2 has a static dhcp set in the pfsense dhcp
3 resolver listining interface I can not select LAN on its own I get
The following input errors were detected:

This system is configured to use the DNS Resolver as its DNS server, so Localhost or All must be selected in Network Interfaces.
when I select local host I do ot get dns

hda

@Chrismallia:

resolver listining interface I can not select LAN on its own I get
The following input errors were detected:

This system is configured to use the DNS Resolver as its DNS server, so Localhost or All must be selected in Network Interfaces.
when I select local host I do ot get dns

Correct, I forgot to point for Localhost too. Use Ctrl+mouseclick to select LAN(s) and Localhost. (But 'All' should work OK)

Chrismallia

@hda:

@Chrismallia:

resolver listining interface I can not select LAN on its own I get
The following input errors were detected:

This system is configured to use the DNS Resolver as its DNS server, so Localhost or All must be selected in Network Interfaces.
when I select local host I do ot get dns

Correct, I forgot to point for Localhost too. Use Ctrl+mouseclick to select LAN(s) and Localhost. (But 'All' should work OK)

here are the pic same problem

7.png_thumb

8.png_thumb

hda

Then to me it looks like DNSSEC-support problem at test-site.
You could test this with unchecking DNSSEC support. But not recommended for the ultimate Resolver use ;)

N.B. There is another tough criterium, see Services: DNS Resolver: Advanced (Harden DNSSEC data).

Chrismallia

@hda:

Then to me it looks like DNSSEC-support problem at test-site.
You could test this with unchecking DNSSEC support. But not recommended for the ultimate Resolver use ;)

N.B. There is another tough criterium, see Services: DNS Resolver: Advanced (Harden DNSSEC data).

Hi unchecked both but same problem. lol its a mystery

johnpoz

How do you pick "Madlina"

in speedtest? I want to look to what IP/FQDN your testing too..

What city are you using that allows you to select Madlina? Can you post a screen shot showing you picking this - see example below

2016-03-08_091648.png_thumb

Chrismallia

Hi I am from Malta so in Malta and Madlina is where my isp servers are Melita plc

madlina.png_thumb

johnpoz

Ok I am using resolver and have no issues testing to that server.

I would suggest you do a sniff on your machine when you try and test to that server, vs when you test to a server that works. Or even easier enable debug.. So click on your map before you start test and type debug and you should get a window - see attached… What errors/info do you get in there?

enabledebug.png_thumb

Chrismallia

@johnpoz:

Ok I am using resolver and have no issues testing to that server.

I would suggest you do a sniff on your machine when you try and test to that server, vs when you test to a server that works

No idea I installed pfsense on a different pc and same results it only works when I use public dns. sorry what do you mean by doing a sniff?

johnpoz

see my edit, enable debug.

Does this resolve, do a nslookup or dig, use dns diag in pfsense

; <<>> DiG 9.9.5-3ubuntu0.7-Ubuntu <<>> speedtest.melita.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 49494
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;speedtest.melita.com. IN A

;; ANSWER SECTION:
speedtest.melita.com. 100 IN A 212.56.138.60

;; AUTHORITY SECTION:
melita.com. 2714 IN NS ns1.melitacable.com.
melita.com. 2714 IN NS ns.melitacable.com.

;; Query time: 153 msec
;; SERVER: 192.168.9.253#53(192.168.9.253)
;; WHEN: Tue Mar 08 09:47:37 CST 2016
;; MSG SIZE rcvd: 112

doesthisresolve.png_thumb

Chrismallia

Here is what I got

error.png_thumb

johnpoz

there is going to more to it than that - scroll through it… Can you resolve what I posted speedtest.melita.com

So I show socket latency fails as well, but then it goes to http latency

5780 INFO: socket-latency Test started at 1457451815780
15781 WARNING: REPLACE ME: Handle SubTest Start - socket-latency
30784 ERROR: Latency test returned an error: [AnchorEvent type="error" bubbles=false cancelable=false eventPhase=2] timeout
30785 DEBUG: test started: false
30786 INFO: cleaning up: socket-latency
30787 INFO: MethodId set to: 1
30887 INFO: Starting: latency
30889 INFO: Method: 2/2
30890 INFO: Method Used: http
30890 INFO: Starting subtest: http-latency
30892 INFO: http-latency Test started at 1457451830892
30894 WARNING: REPLACE ME: Handle SubTest Start - http-latency
31619 INFO: progress: 0.1 current: 719 time left: 7434 test: http-latency

You will have to look through the debug where it loads the file and see if you can load it..

Here is from their troubleshooting info

See I can load this - can you
http://speedtest.melita.com/speedtest/latency.txt

latencyerror.png_thumb

lattest.png_thumb

Chrismallia

sorry here is all of it. and no I get a page error going to that url
12528 INFO: calculateDistances: 3100
12559 INFO: calculateDistances: 3200
12579 INFO: calculateDistances: 3300
12594 INFO: calculateDistances: 3400
12607 INFO: calculateDistances: 3500
12619 INFO: calculateDistances: 3600
12634 INFO: calculateDistances: 3700
12648 INFO: calculateDistances: 3800
12671 INFO: calculateDistances: 3900
12700 INFO: calculateDistances: 4000
12729 INFO: calculateDistances: 4100
12748 INFO: calculateDistances: 4200
12759 INFO: calculateDistances: 4300
12765 INFO: calculateDistances: 4400
12767 INFO: Distances loaded: 39164
12947 INFO: Distances sorted
12947 INFO: TileMapContainer.placeMarkers
12950 INFO: place markers: 6
12951 INFO: Current Zoom Level: 6 - max Distance: 20 distance pairs: 39164
12965 INFO: getMarkers Done
12965 INFO: Groups: 4484
13250 INFO: markers placed: 4487
13251 INFO: Table Map Dragger Loaded
13252 INFO: load topmap
13252 INFO: object Added: topmap
13252 INFO: [object _-Ei]
13252 INFO: 114.5 11.45
13252 INFO: 5
13253 INFO: wavehash:undefined
14367 INFO: bring to front
14376 INFO: 2495,2497,2492,2494,2498
14376 INFO: 2496,2498,2493,2495,2499
44290 INFO: onRelease Dragger
44290 INFO: Stopped panning, top left: 38.34277,8.96346, center: 35.93469,14.47860, bottom right: 33.45097,19.99374, zoom: 6
52290 INFO: Showing debug window
59086 INFO: bring to front
59100 INFO: 2495,2497,2492,2494,2498
59101 INFO: 2496,2498,2493,2495,2499
60765 INFO: onRelease Dragger
60767 INFO: serverflyoutbutton click
60769 INFO: removed old dragger
60773 INFO: wavehash:undefined
60774 INFO: stopTimer current Count:8310865169
60775 INFO: stopTimer desired Count:8310866837
60775 INFO: ServerId set to: 2493
60981 INFO: trackEvent: test_started
60984 INFO: serverflyout click
61297 INFO: delete object: [object _-9W]
61530 INFO: Tile Map Container Loaded
61535 INFO: object Added: tabletilemapcontainer
61565 INFO: y: 103 factor: 1.819078947368421
61565 INFO: y: 105 factor: 1.838815789473684
62044 INFO: object Added: test
62045 INFO: object Added: speedtest
62047 INFO: object Added: speedtest-download-graph
62049 INFO: object Added: finalresults
62051 INFO: object Added: speedtest-download-graph-final
62531 INFO: MethodId set to: 0
62531 INFO: Vars: preferredserverid=2992
62532 INFO: Vars: startmode=serverclick
62533 INFO: Vars: promo=
62534 INFO: Starting test
62537 INFO: Starting: throttling
62541 INFO: Method: 1/2
62542 INFO: Method Used: tcp
62545 INFO: Method: 1/2
62546 INFO: Method Used: tcp
62547 INFO: Starting: latency
62549 INFO: Method: 1/2
62550 INFO: Method Used: tcp
62553 INFO: Starting subtest: socket-latency
62558 INFO: socket-latency Test started at 1457451962558
62561 WARNING: REPLACE ME: Handle SubTest Start - socket-latency
77562 ERROR: Latency test returned an error: [AnchorEvent type="error" bubbles=false cancelable=false eventPhase=2] timeout
77565 DEBUG: test started: false
77567 INFO: cleaning up: socket-latency
77569 INFO: MethodId set to: 1
77662 INFO: Starting: latency
77666 INFO: Method: 2/2
77667 INFO: Method Used: http
77668 INFO: Starting subtest: http-latency
77671 INFO: http-latency Test started at 1457451977671
77676 WARNING: REPLACE ME: Handle SubTest Start - http-latency
82562 ERROR: SocketConnection 0 securityErrorHandler: [SecurityErrorEvent type="securityError" bubbles=false cancelable=false eventPhase=2 text="Error #2048"]
88997 ERROR: Latency test returned an error while trying to read the latency file.
88998 DEBUG: test started: false
89003 INFO: Loading Error Strings
89005 INFO: MethodId set to: 0
89006 INFO: Vars: preferredserverid=2992
89007 INFO: Vars: startmode=serverclick
89010 INFO: Vars: promo=
89012 INFO: Closing all TCP connections
89014 INFO: Connections closed: 0
89017 WARNING: REPLACE ME: HandleFatal - http-latency
89021 INFO: EndTestHandler Loaded
89027 INFO: object Added: endtest
89045 INFO: trackEvent: test_error
89999 ERROR: UNCAUGHT ERROR
90002 ERROR: ArgumentError: Error #2109
90011 ERROR: UNCAUGHT ERROR
90013 ERROR: ArgumentError: Error #2109
65989 ERROR: UNCAUGHT ERROR
65991 ERROR: ArgumentError: Error #2109
66008 ERROR: UNCAUGHT ERROR
66012 ERROR: ArgumentError: Error #2109
66027 ERROR: UNCAUGHT ERROR
66029 ERROR: ArgumentError: Error #2109
11535 ERROR: UNCAUGHT ERROR
11539 ERROR: ArgumentError: Error #2109
11746 ERROR: UNCAUGHT ERROR
11747 ERROR: ArgumentError: Error #2109
11838 ERROR: UNCAUGHT ERROR
11839 ERROR: ArgumentError: Error #2109
13307 ERROR: UNCAUGHT ERROR
13308 ERROR: ArgumentError: Error #2109
13329 ERROR: UNCAUGHT ERROR
13331 ERROR: ArgumentError: Error #2109
13338 ERROR: UNCAUGHT ERROR
13341 ERROR: ArgumentError: Error #2109
19624 ERROR: UNCAUGHT ERROR
19627 ERROR: ArgumentError: Error #2109
19682 ERROR: UNCAUGHT ERROR
19683 ERROR: ArgumentError: Error #2109
19705 ERROR: UNCAUGHT ERROR
19706 ERROR: ArgumentError: Error #2109
20744 ERROR: UNCAUGHT ERROR
20747 ERROR: ArgumentError: Error #2109
20757 ERROR: UNCAUGHT ERROR
20760 ERROR: ArgumentError: Error #2109
84523 ERROR: UNCAUGHT ERROR
84527 ERROR: ArgumentError: Error #2109

johnpoz

I don't see in there where your even getting the server name you want to test too..

Looks to be more an error in your speedtest applet than any sort of network problem.. Not sure how you can get any test to work if you don't get the server url to go to.. See in my debug where it use the url http://speedtest.melita.com/

I don't see any server url anywhere in that debug log.. did you start it after you click on the server? Start the debug before you pick your server, and try it with a server that works. You should see the url your going to for test when you pick a different server.

Also validate that you can resolve

speedtest.melita.com

can you load this
http://speedtest.melita.com/speedtest/latency.txt

just direct in your browser?

Chrismallia

@johnpoz:

can you load this
http://speedtest.melita.com/speedtest/latency.txt

just direct in your browser?

No I get a page error in my browser, do you want logs of server that works? I tried other browsers PCs and phone still the same error

johnpoz

what do you get when you try and resolve it.. Use nslookup, or dig or drill or even the diag lookup page on pfsense.

Try to ping the name - does it come back with IP or unknown host, etc.

Let me see if that domain has dnssec enabled that is broken

edit: I don't show them having dnssec available… But its quite possible your having issue with connectivity to their authoritative servers..

But I do show their dns to be hosed from online testers

I show their 1 server for sure not answering

;; ANSWER SECTION:
melita.com. 3600 IN NS ns1.melitacable.com.
melita.com. 3600 IN NS ns.melitacable.com.

;; ADDITIONAL SECTION:
ns.melitacable.com. 3600 IN A 212.56.128.132
ns1.melitacable.com. 3600 IN A 212.56.128.196

so while .196 answers, I can not get a response from .132

; <<>> DiG 9.9.5-3ubuntu0.7-Ubuntu <<>> @212.56.128.132 melita.com NS
; (1 server found)
;; global options: +cmd
;; connection timed out; no servers could be reached

So it would seem they have issues.. Might be connectivity from parts of the world, etc.

Well now another query works... So they could be having issues.. If your resolving and having problems talking to their NS then yes that could explain why using forwarder works since your just asking for something that a NS already has cached.

dnsproblems.png_thumb

Chrismallia

In the browser I get
This webpage is not available

DNS_PROBE_FINISHED_NXDOMAIN

In pfsense dns lookup I get

Host must be a valid hostname or IP address.

In cmd ipconfig I get

Ping request could not find host http://speedtest.melita.com/speedtest/latency.txt. Please check the name and try again.

johnpoz

yeah your having issues resolving their dns… you could try a trace in say nslookup or dig.

But that explains your problem - your having problems resolving that domain.. You could try putting in a host over ride.

I show that server resolving to.. 212.56.138.60

So in the resolver create a host override for speedtest with melita.com as domain and that IP.. then see if you can ping by name

Where I see a major issue is they have a TTL of 100 seconds

So when they do resolve, it doesn't stay cached long

;; ANSWER SECTION:
speedtest.melita.com. 100 IN A 212.56.138.60

;; AUTHORITY SECTION:
melita.com. 3600 IN NS ns.melitacable.com.
melita.com. 3600 IN NS ns1.melitacable.com.

;; ADDITIONAL SECTION:
ns.melitacable.com. 3600 IN A 212.56.128.132
ns1.melitacable.com. 3600 IN A 212.56.128.196

Trying to query their servers seems to be hit and miss.. Sometimes it works, and then it fails… So even when you do get it resolved, it only stays cached for 100 seconds.

If they are your isp you might want to contact them their dns is messed up!!!

Their SOA is WRONG too...

;; QUESTION SECTION:
;speedtest.melita.com. IN SOA

;; AUTHORITY SECTION:
melita.com. 3561 IN SOA helium.melitacable.com. domains.melitacable.com. 2016022500 28800 7200 2419200 86400

SOA should point to 1 of their name servers..