DNS stopped working

KOM

Your clients should be getting pfSense LAN IP for their DNS, and pfSense handles the lookups via the Resolver. I don't use pfSense DHCP server so I don't know how those all inter-relate. WHat is the actual error you're seeing? Do the requests just time out or is there a message? What's the output of nslookup www.google.com on one of your clients?

lovingHDTV

They time out.

KOM

What's the output of nslookup www.google.com on one of your clients?

lovingHDTV

C:\Users\David>nslookup www.google.com
DNS request timed out.
timeout was 2 seconds.
Server: UnKnown
Address: 192.168.1.1

DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.
*** Request to UnKnown timed-out

C:\Users\David>

mkyb14

Having the exact same issue. Made no changes and it stopped working last night 1/18/17. computers are all set to DHCP, Pfsense is in a VM (FYI).

Screenshots of the various DNS locations in Pfsense
https://drive.google.com/file/d/0B15p4ppbxdipMFczSHlvVm1SRVU/view?usp=sharing
https://drive.google.com/file/d/0B15p4ppbxdipUUNnTk02bk1HbE0/view?usp=sharing
https://drive.google.com/file/d/0B15p4ppbxdipLWRMT1plOXNCd1k/view?usp=sharing

if there's another screenshot I can share to understand why, please let me know.
no ping, no traceroute, no nslookup will work.

I'm at a loss. Did a factory reset, assigned the interfaces and IP's. Can ping around locally, nothing externally.

KOM

Anything of note in Status - System Logs - System - General or Status - System Logs - System - DNS Resolver?

mkyb14

As for the logs for DNS Resolver, I see a bunch of
notice:init module 1: iterator
same : validator

repeats a few times in the past 10 minutes.

lovingHDTV

I see nothing of note in general, just that the system rebooted

Under Resolver it is empty, no messaging at all.

david

johnpoz

validate that your dns of choice be it the resolver or the forwarder is listening, ie running.. What is the logs for which your using?

Do a simple sockstat


[2.3.2-RELEASE][root@pfsense.local.lan]/root: sockstat -4l | grep :53
unbound  unbound    98827 4  udp4   192.168.9.253:53      *:*
unbound  unbound    98827 5  tcp4   192.168.9.253:53      *:*
unbound  unbound    98827 8  udp4   192.168.2.253:53      *:*
unbound  unbound    98827 9  tcp4   192.168.2.253:53      *:*
unbound  unbound    98827 15 udp4   192.168.3.253:53      *:*
unbound  unbound    98827 16 tcp4   192.168.3.253:53      *:*
unbound  unbound    98827 19 udp4   192.168.4.253:53      *:*
unbound  unbound    98827 20 tcp4   192.168.4.253:53      *:*
unbound  unbound    98827 21 udp4   192.168.6.253:53      *:*
unbound  unbound    98827 22 tcp4   192.168.6.253:53      *:*
unbound  unbound    98827 25 udp4   192.168.7.253:53      *:*
unbound  unbound    98827 26 tcp4   192.168.7.253:53      *:*
unbound  unbound    98827 27 udp4   127.0.0.1:53          *:*
unbound  unbound    98827 28 tcp4   127.0.0.1:53          *:*
[2.3.2-RELEASE][root@pfsense.local.lan]/root:

I limited mine to my ipv4 in this check, its also listening on the ipv6 address.

Check your rules on the interface, that your allowing access to that pfsense interface that dns is listening on from that network. Validate that you can ping that IP, validate if you can not ping or do not have it open on your rules that your client shows a mac for that IP in its arp table.

Be it pfsense can forward or resolver has little to do with if it will answer your dns query, it should respond back with nx or refused, or servfail if it can not lookup what your asking for, etc. But it shouldn't timeout, and it should be able to resolve the PTR for your IP of pfsense..

If your going to use nslookup to test with then put in debug mode.


C:\>nslookup
Default Server:  pfsense.local.lan
Address:  192.168.9.253

> set debug
> www.google.com
Server:  pfsense.local.lan
Address:  192.168.9.253

------------
Got answer:
    HEADER:
        opcode = QUERY, id = 2, rcode = NOERROR
        header flags:  response, want recursion, recursion avail.
        questions = 1,  answers = 1,  authority records = 0,  additional = 0

    QUESTIONS:
        www.google.com, type = A, class = IN
    ANSWERS:
    ->  www.google.com
        internet address = 172.217.0.4
        ttl = 73 (1 min 13 secs)

------------
Non-authoritative answer:
------------
Got answer:
    HEADER:
        opcode = QUERY, id = 3, rcode = NOERROR
        header flags:  response, want recursion, recursion avail.
        questions = 1,  answers = 1,  authority records = 0,  additional = 0

    QUESTIONS:
        www.google.com, type = AAAA, class = IN
    ANSWERS:
    ->  www.google.com
        AAAA IPv6 address = 2607:f8b0:4009:813::2004
        ttl = 300 (5 mins)

------------
Name:    www.google.com
Addresses:  2607:f8b0:4009:813::2004
          172.217.0.4

>

So you can tell what was asked and what the nameserver responded back with, etc..

lovingHDTV

I get nothing:
[2.2.4-RELEASE][root@pfsense.home]/root: sockstat | grep :53
root miniupnpd 86865 16 udp6 *:5351 :

when setting nslookup into debug mode I get a more robust timing message.

EDIT:
When I go to DNS resolver, there is a red square that says unbound Service is Stopped. Is that the same thing as DNS Resolver?

david

chpalmer

Under status/services. Is the unbound service running?

mkyb14

Similar to lovingHD's.

[https://drive.google.com/file/d/0B15p4ppbxdipNWJaVzNxVWtleE0/view?usp=sharing/url]

status/Service : everything's green but pfblocker which is disabled.](https://drive.google.com/file/d/0B15p4ppbxdipNWJaVzNxVWtleE0/view?usp=sharing/url]<br /><br />status/Service : everything's green but pfblocker which is disabled.)

lovingHDTV

OK that was it!

I saw this in the logs:
php: rc.bootup: The command '/usr/local/sbin/unbound -c /var/unbound/unbound.conf' returned exit code '1', the output was '/var/unbound/unbound.conf:88: error: cannot open include file '/var/unbound/pfb_dnsbl.conf': No such file or directory read /var/unbound/unbound.conf failed: 1 errors in configuration file [1484921851] unbound[37111:0] fatal error: Could not read config file: /var/unbound/unbound.conf'

Sorry for not seeing it before.

I saw I had something in the advanced box that matched the log:
server:include: /var/unbound/pfg_dnsbl.conf

I didn't see that file on the file system, so I removed it from the setup window and now it is working!

I've no idea what that file is, why it was setup that way, or why things changed, but removing it lets the resolver run.

I guess that file "used" to exist, but no longer does.

EDIT: I did add the pfBlockerNG packages several months ago. I don't remember making the change to the resolver, and looked back at the how to I used to set it up and it doesn't talk about making the change. I wonder if they are related, due to the name of the file. I've disable the package as well.

thanks for all the help,
david