Domain in General Setup and DynDNS
-
No pfsense name and domain have nothing to do with what you fqdn you might point at your public IP via dyndns.
Are you using the forwarder or the resolver? I do believe the forwarder people have been running into an issue where conf file gets created and it sets local use only so remote networks like vpn client can not query. If using unbound then you would need to edit your ACL to allow for your vpn clients network to query unbound. Same would go for if using the bind package, your acls would have to allow for query from your remote network.
Also if using unbound what interface(s) do you have unbound listening on and what IP do you have your remove vpn users doing the query too?
-
Thanks for clearing that up. I have also added a second FQDN dynamic dns record, so, either FQDN resolves to the same WAN IP.
I just setup the forwarder following these instructions:
http://www.arnan.me/2013/12/pfsense-openvpn-site-site-dns-resolving/The domain override list has one of the domain names.
However, querying the name or the private IP address on the other side of VPN times out.
I am pretty sure a firewall rule is not blocking this traffic, which is attached. Logs are clean.
-
I don't even need to look at that its from 2013.. How is that current? Are you using pfsense 2.1?? Unbound was not a package in 2.1
What are you using the forwarder or the resolver? Bind? did you setup/edit your ACLs if using where did I say anything about firewall rules? If using the forwarder.. Do a search there a multiple threads about the forwarder and conf file causing problem.
Here is the bug report about it
https://redmine.pfsense.org/issues/6730Where do you have those rules that your allowing 135 and 445??
-
That tutorial is the closest I could find ???
I am using 2.3.2 release version.
The DNS forwarder is being used. I have no idea whether I am using unbound or bind for this purpose.
Those firewall rules are on the WAN interface.
-
Huh? So you disabled unbound (resolver) and enabled forwarder (dnsmasq).. Bind is an add on package you would have to know for sure if you installed it ;) Did you go into the resolver and enable forwarder mode? Or you actually using the forwarder?
WTF would you think you need to enable netbios and smb from the internet into your LAN for?? Did you forward it or just turn on the firewall rules?? Where did you forward it? Are you not doing NAT and pfsense wan is inside your network?? if so why would openvpn be terminating to this pfsense?
-
Guess that's what happens with insufficient knowledge and way too many differing tutorials/how-tos. I thought that resolver (unbound) was sufficient for name resolution, until I saw that outdated how-to. I will try to setup unbound again.
Another one of the (probably) outdated tutorials required me to turn on these: Enable NAT reflection for 1:1 and Enable automatic outbound NAT for Reflection. Should those be off, if I am using unbound?
Thanks for pointing me the right path.
Non-sequitur - Why is bind still available as an installable package in 2.3.2, if it was removed for 2.3? Did it make a comeback?
-
yes it made a comeback.
Not sure what your doing with nat? You don't have to touch that for a remote vpn to query your dns.
And why do you have those ports open on your wan 135, and 445??
-
As I have a windows network – and no WINS server. I had to open NETBIOS ports and SMB -- The plan was to resurrect my Tomato wireless router that was running SMB server, before I read more about it. Then I decided to dump WINS completely and setup DNS.
-
through your wan?? From the public internet?? What?
-
I was trying to get name resolution and Windows network shares working between the two LANs connected by the VPN tunnel. Eg., Access \subnet1pc\folder1 show up as such in a Windows machine in subnet 2 in the network neighborhood.
-
That rule wouldn't be on your wan. And broadcasting for names sure isn't going to work across subnets. Just use dns for name resolution of your machines. But those rules on your wan are not doing anything if your connection is via a tunnel. I would remove them.
-
Got it, let me get DNS name resolution working across the tunnel from either LAN. Thank you for the lucid explanations.
