Can not resolve a DNS
-
no with an actual tool that does a query.. page can not be reached doesn't mean your dns didn't work..
Use drill like dok did, or dig or host or nslookup.. A tools that actually does a query that you can see the results in.. For all you know your browser is looking in its cache that it got back a nx before.. and has to wait for the neg cache to expire..
Your browser has a dns cache, your OS dns client has a cache, pfsense has a cache. You need to understand what is exactly happening.. And if you can not query or just some browser error, or maybe the site failed..
-
when I do dns lookup melita.com it results the ip fine. when I ping melita.com from a windows cms I get >ping melita.com
Ping request could not find host melita.com. Please check the name and try again. when I ping the ip it pings fine -
windows "cms" ?? what is that? content management system? did you mean command prompt?
what are you using for dns lookup - what tool? And what are you doing the query too? Maybe your machine is infected with something and hijacking connections??
Please post your ping command and your "dns" command output.
ping melita.com
Pinging melita.com [212.56.128.204] with 32 bytes of data:
Reply from 212.56.128.204: bytes=32 time=157ms TTL=53
Reply from 212.56.128.204: bytes=32 time=157ms TTL=53
Reply from 212.56.128.204: bytes=32 time=157ms TTL=53
Reply from 212.56.128.204: bytes=32 time=157ms TTL=53Ping statistics for 212.56.128.204:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 157ms, Maximum = 157ms, Average = 157msAnd again going to mention your dns tools will do a direct query, doing a ping could be getting answer from you OS dns client cache of neg response. If your saying yoru dns query works.. The flush your windows local cache and try your ping by name again
ipconfig /flushdns
-
Hi I hit the s by mistake I meant CMD. There is nothing wrong with the machines I tried the same on a fresh install laptop with same results, now when I change my dns settings manually in windows to google it opens the site fine and this is happening across all my machines phones and I also have a linux Manjaro pc same problem. I used dns lookup in pfsense and it resolves it fine but on clients no
C:\Users\Chris>ping melita.com
Ping request could not find host melita.com. Please check the name and try again. -
but if you do a dns query via nslookup or dig or drill or host from that same machine your saying it resolves??
If so then flush the machines local cache and try your ping again!!
from your cmd, ipconfig /flushdns
dns query for it - does it work?
then ping it..
If ping says can not resolve then you got something wrong on the machines built in dns client.
-
I flushed it but same problem I did nslookup in cmd
C:\Users\Chris>nslookup 212.56.128.204
Server: pfSense.localdomain
Address: 192.168.0.1DNS request timed out.
timeout was 2 seconds.
*** Request to pfSense.localdomain timed-outC:\Users\Chris>nslookup melita.com
Server: pfSense.localdomain
Address: 192.168.0.1*** pfSense.localdomain can't find melita.com: Server failed
I am sure it is not my machines/devices as using google dns on the machines or replacing pfsense with a different router solves it
-
Ping from the pfsense box works Diagnostics/ping
PING melita.com (212.56.128.204): 56 data bytes
64 bytes from 212.56.128.204: icmp_seq=0 ttl=60 time=9.888 ms
64 bytes from 212.56.128.204: icmp_seq=1 ttl=60 time=11.754 ms
64 bytes from 212.56.128.204: icmp_seq=2 ttl=60 time=16.079 ms–- melita.com ping statistics ---
3 packets transmitted, 3 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 9.888/12.574/16.079/2.593 msThe problems looks between the pfsense and devices communication
-
C:\Users\Chris>nslookup melita.com
Server: pfSense.localdomain
Address: 192.168.0.1*** pfSense.localdomain can't find melita.com: Server failed
Yeah sure looks like your having a issue resolving it.. Do you have pfsense using itself for dns?? Or do you have it using something else?? Thought you said your dns query for it worked?? From that you first got a timeout, pfsense was trying to resolve?? Then you get back serv failed.. Which normally means could not talk to the NS it.. So is psfense using itself, ie this will use resolver out of the box in resolver mode and pfsense asking the resolver for stuff it wants to resolve.
nslookup is not as good at helping debug dns issues as dig is. What I would suggest you do is install dig on your windows box, or use linux with dig or drill and do a trace.. This will talk to the roots and walk down the tree just like unbound does in resolver mode. This should tell you where there is an issue.
so example..
> dig +trace +nodnssec melita.com ; <<>> DiG 9.11.0-P1 <<>> +trace +nodnssec melita.com ;; global options: +cmd . 494382 IN NS j.root-servers.net. . 494382 IN NS m.root-servers.net. . 494382 IN NS a.root-servers.net. . 494382 IN NS c.root-servers.net. . 494382 IN NS e.root-servers.net. . 494382 IN NS d.root-servers.net. . 494382 IN NS k.root-servers.net. . 494382 IN NS h.root-servers.net. . 494382 IN NS f.root-servers.net. . 494382 IN NS i.root-servers.net. . 494382 IN NS b.root-servers.net. . 494382 IN NS l.root-servers.net. . 494382 IN NS g.root-servers.net. ;; Received 239 bytes from 192.168.9.253#53(192.168.9.253) in 0 ms com. 172800 IN NS a.gtld-servers.net. com. 172800 IN NS b.gtld-servers.net. com. 172800 IN NS c.gtld-servers.net. com. 172800 IN NS d.gtld-servers.net. com. 172800 IN NS e.gtld-servers.net. com. 172800 IN NS f.gtld-servers.net. com. 172800 IN NS g.gtld-servers.net. com. 172800 IN NS h.gtld-servers.net. com. 172800 IN NS i.gtld-servers.net. com. 172800 IN NS j.gtld-servers.net. com. 172800 IN NS k.gtld-servers.net. com. 172800 IN NS l.gtld-servers.net. com. 172800 IN NS m.gtld-servers.net. ;; Received 527 bytes from 192.203.230.10#53(e.root-servers.net) in 15 ms melita.com. 172800 IN NS ns.melitacable.com. melita.com. 172800 IN NS ns1.melitacable.com. ;; Received 118 bytes from 192.55.83.30#53(m.gtld-servers.net) in 124 ms melita.com. 86400 IN A 212.56.128.204 melita.com. 86400 IN NS ns1.melitacable.com. melita.com. 86400 IN NS ns.melitacable.com. ;; Received 134 bytes from 212.56.128.132#53(ns.melitacable.com) in 156 msYou see it get roots, ask them for NS for .com, then ask .com NS who is NS for melita.com, then ask one of those NS for for the A record..
You can just download dig for free as part of bind, then just install the "tools"
https://www.isc.org/downloads/Or just do it direct from pfsense with drill
[2.3.2-RELEASE][root@pfsense.local.lan]/root: drill -T melita.com com. 172800 IN NS h.gtld-servers.net. com. 172800 IN NS l.gtld-servers.net. com. 172800 IN NS a.gtld-servers.net. com. 172800 IN NS e.gtld-servers.net. com. 172800 IN NS f.gtld-servers.net. com. 172800 IN NS d.gtld-servers.net. com. 172800 IN NS g.gtld-servers.net. com. 172800 IN NS j.gtld-servers.net. com. 172800 IN NS b.gtld-servers.net. com. 172800 IN NS m.gtld-servers.net. com. 172800 IN NS k.gtld-servers.net. com. 172800 IN NS i.gtld-servers.net. com. 172800 IN NS c.gtld-servers.net. melita.com. 172800 IN NS ns.melitacable.com. melita.com. 172800 IN NS ns1.melitacable.com. melita.com. 86400 IN A 212.56.128.204 melita.com. 86400 IN NS ns1.melitacable.com. melita.com. 86400 IN NS ns.melitacable.com.If it fails - you can u the verbosity with
drill -T -V 5 melita.com
-
Hi here is the dig
C:\Users\Chris>dig melita.com
; <<>> DiG 9.11.0-P1 <<>> melita.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 661
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
; COOKIE: 95b8d2028f289628 (echoed)
;; QUESTION SECTION:
;melita.com. IN A;; Query time: 0 msec
;; SERVER: 192.168.0.1#53(192.168.0.1)
;; WHEN: Sun Nov 27 16:04:07 W. Europe Standard Time 2016
;; MSG SIZE rcvd: 51 -
No this not the dig I showed you.. Do a full trace.. and forget any dnssec stuff.. Maybe that is what is failing for you, which is why lets do it without the dnssec, etc.
dig +trace +nodnssec melita.com
-
:) sorry is this it
C:\Users\Chris>dig trace nodnssec melita.com
; <<>> DiG 9.11.0-P1 <<>> trace nodnssec melita.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 539
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;trace. IN A;; AUTHORITY SECTION:
. 2594 IN SOA a.root-servers.net. nstld.verisign-grs.com. 2016112700 1800 900 604800 86400;; Query time: 63 msec
;; SERVER: 192.168.0.1#53(192.168.0.1)
;; WHEN: Sun Nov 27 16:35:12 W. Europe Standard Time 2016
;; MSG SIZE rcvd: 109;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 44812
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;nodnssec. IN A;; AUTHORITY SECTION:
. 2594 IN SOA a.root-servers.net. nstld.verisign-grs.com. 2016112700 1800 900 604800 86400;; Query time: 62 msec
;; SERVER: 192.168.0.1#53(192.168.0.1)
;; WHEN: Sun Nov 27 16:35:12 W. Europe Standard Time 2016
;; MSG SIZE rcvd: 112;; connection timed out; no servers could be reached
-
Dude copy and paste!! you need the + signs…
do you not even read what it outputs
;; QUESTION SECTION:
;trace. IN AAre you hungover or something? Need a cup of coffee or 3?
edit: Oh your EU time.. Maybe your already started hitting the hooch? ;)
-
C:\Users\Chris>dig +trace +nodnssec melita.com
; <<>> DiG 9.11.0-P1 <<>> +trace +nodnssec melita.com
;; global options: +cmd
;; Received 12 bytes from 192.168.0.1#53(192.168.0.1) in 0 ms:) sorry
-
that is your full output??
Is 192.168.0.1 pfsense? And you have it resolver mode? It should of atleast given you the root servers.. You got something wrong..
Try it with just the +trace option
dig +trace melita.com
Also dig NS what does that give you back?
C:\>dig NS ; <<>> DiG 9.11.0-P1 <<>> NS ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 33584 ;; flags: qr rd ra ad; QUERY: 1, ANSWER: 13, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;. IN NS ;; ANSWER SECTION: . 487240 IN NS j.root-servers.net. . 487240 IN NS m.root-servers.net. . 487240 IN NS a.root-servers.net. . 487240 IN NS c.root-servers.net. . 487240 IN NS e.root-servers.net. . 487240 IN NS d.root-servers.net. . 487240 IN NS k.root-servers.net. . 487240 IN NS h.root-servers.net. . 487240 IN NS f.root-servers.net. . 487240 IN NS i.root-servers.net. . 487240 IN NS b.root-servers.net. . 487240 IN NS l.root-servers.net. . 487240 IN NS g.root-servers.net. ;; Query time: 0 msec ;; SERVER: 192.168.9.253#53(192.168.9.253) ;; WHEN: Sun Nov 27 09:49:40 Central Standard Time 2016 ;; MSG SIZE rcvd: 239 -
yes 192.168.0.1 is my pfsense and left everything default
C:\Users\Chris>dig +trace melita.com
; <<>> DiG 9.11.0-P1 <<>> +trace melita.com
;; global options: +cmd
;; Received 12 bytes from 192.168.0.1#53(192.168.0.1) in 0 ms -
C:\Users\Chris>dig NS
; <<>> DiG 9.11.0-P1 <<>> NS
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 65221
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 13, AUTHORITY: 0, ADDITIONAL: 1;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;. IN NS;; ANSWER SECTION:
. 512472 IN NS l.root-servers.net.
. 512472 IN NS h.root-servers.net.
. 512472 IN NS d.root-servers.net.
. 512472 IN NS f.root-servers.net.
. 512472 IN NS m.root-servers.net.
. 512472 IN NS a.root-servers.net.
. 512472 IN NS b.root-servers.net.
. 512472 IN NS j.root-servers.net.
. 512472 IN NS k.root-servers.net.
. 512472 IN NS i.root-servers.net.
. 512472 IN NS c.root-servers.net.
. 512472 IN NS e.root-servers.net.
. 512472 IN NS g.root-servers.net.;; Query time: 0 msec
;; SERVER: 192.168.0.1#53(192.168.0.1)
;; WHEN: Sun Nov 27 16:57:10 W. Europe Standard Time 2016
;; MSG SIZE rcvd: 239 -
WTF???
So try the +trace +nodnssec command on some other domain that works..
say pfsense.org
C:\>dig +trace +nodnssec pfsense.org ; <<>> DiG 9.11.0-P1 <<>> +trace +nodnssec pfsense.org ;; global options: +cmd . 485772 IN NS j.root-servers.net. . 485772 IN NS m.root-servers.net. . 485772 IN NS a.root-servers.net. . 485772 IN NS c.root-servers.net. . 485772 IN NS e.root-servers.net. . 485772 IN NS d.root-servers.net. . 485772 IN NS k.root-servers.net. . 485772 IN NS h.root-servers.net. . 485772 IN NS f.root-servers.net. . 485772 IN NS i.root-servers.net. . 485772 IN NS b.root-servers.net. . 485772 IN NS l.root-servers.net. . 485772 IN NS g.root-servers.net. ;; Received 239 bytes from 192.168.9.253#53(192.168.9.253) in 0 ms org. 172800 IN NS b0.org.afilias-nst.org. org. 172800 IN NS a2.org.afilias-nst.info. org. 172800 IN NS c0.org.afilias-nst.info. org. 172800 IN NS a0.org.afilias-nst.info. org. 172800 IN NS d0.org.afilias-nst.org. org. 172800 IN NS b2.org.afilias-nst.org. ;; Received 442 bytes from 192.33.4.12#53(c.root-servers.net) in 13 ms pfsense.org. 86400 IN NS ns1.netgate.com. pfsense.org. 86400 IN NS ns2.netgate.com. ;; Received 87 bytes from 199.249.112.1#53(a2.org.afilias-nst.info) in 12 ms pfsense.org. 300 IN A 208.123.73.69 pfsense.org. 300 IN NS ns2.netgate.com. pfsense.org. 300 IN NS ns1.netgate.com. ;; Received 135 bytes from 192.207.126.6#53(ns1.netgate.com) in 54 msyou didn't put in some domain overrides or anything for this melita.com did you???
Ok I was able to duplicate what you saw.. Your ACL is only set to allow vs allow snoop..
> dig +trace +nodnssec melita.com ; <<>> DiG 9.11.0-P1 <<>> +trace +nodnssec melita.com ;; global options: +cmd ;; Received 12 bytes from 192.168.9.253#53(192.168.9.253) in 1 msGo into your unbound acl and change to allow snoop vs allow.. Then try the +trace dig again.
-
sorry dude did the acl but same
C:\Users\Chris>dig +trace +nodnssec pfsense.org
; <<>> DiG 9.11.0-P1 <<>> +trace +nodnssec pfsense.org
;; global options: +cmd
;; Received 12 bytes from 192.168.0.1#53(192.168.0.1) in 0 ms -
I really really thank you for all your time and help. But if it is getting a headache for you please do not feel obligated in anyway to resolve this for me. Thanks again friend
-
I disabled resolver and enabled the forwarder, in forwarder the site resolves and works fine.
