Help Setting Up DNS Resolver
-
It is possible that the config file has been changed to override the settings. Go to the diag/edit file page and open /conf/config.xml then search for the loopback address, and see if it shows up.
-
So you look at you see it listening on loopback?
-
It is possible that the config file has been changed to override the settings. Go to the diag/edit file page and open /conf/config.xml then search for the loopback address, and see if it shows up.
I searched the config.xml for "loopback" and was not able to find any occurrence.
Tried just "loop" as well and found no occurrence.
Tried searching for 127.0.0.1 and it came back with two occurrences. One under FreeRadius on element "vareapconfocspurl" with a value of "http://127.0.0.1/ocsp/". Then another under using squid guard on element "redirect" with a value of "http://127.0.0.1".
I am not using SquidGuard. I was probably trying it out a long while back.
-
So you look at you see it listening on loopback?
Here is the screenshot of the command you asked me to run.
-
Here is the screenshot of the command…
Well, that should work. I have the same.
There is likely more to your basic pfSense setup that is undetermined.
You could revert to a simple config.xml, like from a fresh install ?
Clear-out-house ;) -
The loopback address regarding the Radius server is probably fine, as long as you are running free Radius as a server on the firewall it should be pointing to 127.0.0.1 as the location to go for authentication.
The one to do with squidguard though may not be. if you half configured it then left it, then it is possible it could be blocking things.
When we did the setup here, we had a few problems setting up squidguard the way we wanted it. Would have deployed a few days earlier probably. It was causing some unusual behaviour, like randomly deciding to block certain websites such as google or microsoft. I have it up and running now over 5 interfaces at the moment and don't have a loopback address anywhere in my config. if you're not using it remove the package just to see if anything changes. -
The loopback address regarding the Radius server is probably fine, as long as you are running free Radius as a server on the firewall it should be pointing to 127.0.0.1 as the location to go for authentication.
The one to do with squidguard though may not be. if you half configured it then left it, then it is possible it could be blocking things.
When we did the setup here, we had a few problems setting up squidguard the way we wanted it. Would have deployed a few days earlier probably. It was causing some unusual behaviour, like randomly deciding to block certain websites such as google or microsoft. I have it up and running now over 5 interfaces at the moment and don't have a loopback address anywhere in my config. if you're not using it remove the package just to see if anything changes.I do not have the SquidGuard package installed. I may have installed it at one time in the past, probably when I was first setting up pfsense, but it has long since been uninstalled. My uneducated guess is that the entries in the config file are artifacts from this uninstalled package but I am not sure. I would be willing to delete the lines from the config file related to squidgaurd with some guidance if you think it will help.
The packages I have installed are as follows
FreeRadius
pfBlocker (both pfBlocker and DNSBL are disabled right now)
snort (running only on LAN2 which is my primary LAN) -
Squidguard does not block DNS queries. Read the Snort logs, and make it NOT block traffic.
-
Squidguard does not block DNS queries. Read the Snort logs, and make it NOT block traffic.
I do not see anything that stands out in the snort logs.
So snort doesn't muddy the waters. I have now set snort not to block and saved. Then for good measure I went back into the snort config screen and disabled snort.
I then went to run a DNS lookup for www.cbs.com, still no reply from 127.0.0.1
I have attached a screen shot from my firewall log right after I ran the DNS lookup (my clock read 11:16 when I ran the DNS Lookup). Not sure if that will help with troubleshooting this or not.
After that I also re-added the DNS Server Entry for 192.168.0.1 under System/General Setup. When I run DNS Lookup I am getting a successful response from 192.168.0.1 but no response from 127.0.0.1
 -
I tried pinging 127.0.0.1 and came back 100% packet loss. Cannot believe I hadn't already tried that.
So not a DNS configuration issue. Seems like there's something wrong with my systems configuration.
-
Dude, if you have ping blocked to localhost, I'd suggest to flush your config down the drain and start from scratch.
-
If you can not ping loopback, you got something really borked for sure. I would go with dok suggestion.. Nuke it from orbit!!
-
A reboot fixed both the pinging issue and the dns resolver issue.
Not sure why. I rebooted last night before I started the thread and it was not working after that reboot.
By the time I rebooted I had disabled nearly all my packages and any questionable firewall rules testing after each one with no luck. Rebooted with my fingers crossed and I was able to ping the loopback.
I slowly re-enabled the fire wall rules testing between each one and rebooted after they were all re-enabled and things are still working as expected.
I re-enabled the packages I was using one by one with a reboot and test between each one and things are still working as expected.
Not really sure what the problem was? Maybe just a config stuck in limbo? I really am not sure. The only other configuration I recall tinkering with while trying to debug this was rearranging some of the outbound NAT mappings.
I wish I had an explanation for myself for what was messing this up. I spent a few hours on troubleshooting and am regretful that a simple two minute reboot was the solution. I guess my take away from this is to perform multiple reboots while troubleshooting.
I am hoping the case is closed on this. I will keep testing tonight and tomorrow to make sure I am still able to ping and resolve.
