DNS stopped working
-
What's the output of nslookup www.google.com on one of your clients?
-
C:\Users\David>nslookup www.google.com
DNS request timed out.
timeout was 2 seconds.
Server: UnKnown
Address: 192.168.1.1DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.
*** Request to UnKnown timed-outC:\Users\David>
-
Having the exact same issue. Made no changes and it stopped working last night 1/18/17. computers are all set to DHCP, Pfsense is in a VM (FYI).
Screenshots of the various DNS locations in Pfsense
https://drive.google.com/file/d/0B15p4ppbxdipMFczSHlvVm1SRVU/view?usp=sharing
https://drive.google.com/file/d/0B15p4ppbxdipUUNnTk02bk1HbE0/view?usp=sharing
https://drive.google.com/file/d/0B15p4ppbxdipLWRMT1plOXNCd1k/view?usp=sharingif there's another screenshot I can share to understand why, please let me know.
no ping, no traceroute, no nslookup will work.I'm at a loss. Did a factory reset, assigned the interfaces and IP's. Can ping around locally, nothing externally.
-
Anything of note in Status - System Logs - System - General or Status - System Logs - System - DNS Resolver?
-
As for the logs for DNS Resolver, I see a bunch of
notice:init module 1: iterator
same : validatorrepeats a few times in the past 10 minutes.
-
I see nothing of note in general, just that the system rebooted
Under Resolver it is empty, no messaging at all.
david
-
validate that your dns of choice be it the resolver or the forwarder is listening, ie running.. What is the logs for which your using?
Do a simple sockstat
[2.3.2-RELEASE][root@pfsense.local.lan]/root: sockstat -4l | grep :53 unbound unbound 98827 4 udp4 192.168.9.253:53 *:* unbound unbound 98827 5 tcp4 192.168.9.253:53 *:* unbound unbound 98827 8 udp4 192.168.2.253:53 *:* unbound unbound 98827 9 tcp4 192.168.2.253:53 *:* unbound unbound 98827 15 udp4 192.168.3.253:53 *:* unbound unbound 98827 16 tcp4 192.168.3.253:53 *:* unbound unbound 98827 19 udp4 192.168.4.253:53 *:* unbound unbound 98827 20 tcp4 192.168.4.253:53 *:* unbound unbound 98827 21 udp4 192.168.6.253:53 *:* unbound unbound 98827 22 tcp4 192.168.6.253:53 *:* unbound unbound 98827 25 udp4 192.168.7.253:53 *:* unbound unbound 98827 26 tcp4 192.168.7.253:53 *:* unbound unbound 98827 27 udp4 127.0.0.1:53 *:* unbound unbound 98827 28 tcp4 127.0.0.1:53 *:* [2.3.2-RELEASE][root@pfsense.local.lan]/root:I limited mine to my ipv4 in this check, its also listening on the ipv6 address.
Check your rules on the interface, that your allowing access to that pfsense interface that dns is listening on from that network. Validate that you can ping that IP, validate if you can not ping or do not have it open on your rules that your client shows a mac for that IP in its arp table.
Be it pfsense can forward or resolver has little to do with if it will answer your dns query, it should respond back with nx or refused, or servfail if it can not lookup what your asking for, etc. But it shouldn't timeout, and it should be able to resolve the PTR for your IP of pfsense..
If your going to use nslookup to test with then put in debug mode.
C:\>nslookup Default Server: pfsense.local.lan Address: 192.168.9.253 > set debug > www.google.com Server: pfsense.local.lan Address: 192.168.9.253 ------------ Got answer: HEADER: opcode = QUERY, id = 2, rcode = NOERROR header flags: response, want recursion, recursion avail. questions = 1, answers = 1, authority records = 0, additional = 0 QUESTIONS: www.google.com, type = A, class = IN ANSWERS: -> www.google.com internet address = 172.217.0.4 ttl = 73 (1 min 13 secs) ------------ Non-authoritative answer: ------------ Got answer: HEADER: opcode = QUERY, id = 3, rcode = NOERROR header flags: response, want recursion, recursion avail. questions = 1, answers = 1, authority records = 0, additional = 0 QUESTIONS: www.google.com, type = AAAA, class = IN ANSWERS: -> www.google.com AAAA IPv6 address = 2607:f8b0:4009:813::2004 ttl = 300 (5 mins) ------------ Name: www.google.com Addresses: 2607:f8b0:4009:813::2004 172.217.0.4 >So you can tell what was asked and what the nameserver responded back with, etc..
-
I get nothing:
[2.2.4-RELEASE][root@pfsense.home]/root: sockstat | grep :53
root miniupnpd 86865 16 udp6 *:5351 :when setting nslookup into debug mode I get a more robust timing message.
EDIT:
When I go to DNS resolver, there is a red square that says unbound Service is Stopped. Is that the same thing as DNS Resolver?david
-
Under status/services. Is the unbound service running?
-
Similar to lovingHD's.
[https://drive.google.com/file/d/0B15p4ppbxdipNWJaVzNxVWtleE0/view?usp=sharing/url]
status/Service : everything's green but pfblocker which is disabled.](https://drive.google.com/file/d/0B15p4ppbxdipNWJaVzNxVWtleE0/view?usp=sharing/url]<br /><br />status/Service : everything's green but pfblocker which is disabled.)
-
OK that was it!
I saw this in the logs:
php: rc.bootup: The command '/usr/local/sbin/unbound -c /var/unbound/unbound.conf' returned exit code '1', the output was '/var/unbound/unbound.conf:88: error: cannot open include file '/var/unbound/pfb_dnsbl.conf': No such file or directory read /var/unbound/unbound.conf failed: 1 errors in configuration file [1484921851] unbound[37111:0] fatal error: Could not read config file: /var/unbound/unbound.conf'Sorry for not seeing it before.
I saw I had something in the advanced box that matched the log:
server:include: /var/unbound/pfg_dnsbl.confI didn't see that file on the file system, so I removed it from the setup window and now it is working!
I've no idea what that file is, why it was setup that way, or why things changed, but removing it lets the resolver run.
I guess that file "used" to exist, but no longer does.
EDIT: I did add the pfBlockerNG packages several months ago. I don't remember making the change to the resolver, and looked back at the how to I used to set it up and it doesn't talk about making the change. I wonder if they are related, due to the name of the file. I've disable the package as well.
thanks for all the help,
david
