How to forward DNS querys to another DNS server than thoose under System > General?
-
@jknott said in How to forward DNS querys to another DNS server than thoose under System > General?:
Configure DHCP for that subnet to point to the desired DNS server. Simple stuff.
Due to Security "design" the clients may not talk directly to the DNS server
-
So your internal clients can not query the internal dns, or they can not query something that can query external services.
Seems pretty stupid to not let your internal clients query your own internal dns...
-
https://nlnetlabs.nl/documentation/unbound/ start reading and use the custom settings.
-
There is a reason why i put design between "". ;)
I have fought against that design but No they won't change it.
Clients can talk to external DNS servers as much as they like but thoose servers does not contain the entries needed.
The may talk to the internal DNS as long as it's done through a proxy. Therefore the question if you can configure PFsense to act as that proxy without having to use the internal DNS for the PFsense box itself. -
Ok - to have pfsense be able to query an internal dns for some internal domain(s) its as simple as a domain override.. No need to setup of forwarding.. Just the domain override.
Resolver will resolve, if you setup domain override for say intdomain.tld pointing to your internal NS when client asks pfsene for something.intdomain.tld pfsense will go ask the NS servers listed in the override, the client wont.
Keep in mind that these internal NS must be on a different vlan than your clients or there is nothing pfsense can do sfrom stoping clients from just pointing directly to that NS.
You will need to allow unbound to use whatever interface it needs to talk to these internal NS for outbound queries, and you will most likely need to setup whatever domains these are as private - since if they return a rfc1918 address pfsense will not hand it back to the client as a rebind. You can setup overrides for both forward and reverse zones.
-
@johnpoz
It's better but still not what I need since this needs to be manually maintained every time they add an internal domain.Pfsense is not and has never ever been involved in stopping the clients from talking to the DNS server. That's done in an upstream firewall which is completly out of my control as is the DNS design
I need to send the DNS queris to the internal DNS server so therefore i ask again, please tell me how to do forwarding to an internal DNS server.
-
Use the forwarder (dnsmasq) or just put unbound (resolver) in forwarding mode..
How many freaking internal domains do they add in say a year?
-
@johnpoz
Sorry but as I stated earlier "They cannot use the DNS servers specified under System > General since they are external DNS servers (and need to be that) which doesn't have the internal hosts"Since it's Lab/dev, they do change a lot
-
Use Bind package... You can do whatever you want there.. You can setup specific forwarders..
-
@johnpoz said in How to forward DNS querys to another DNS server than thoose under System > General?:
Use Bind package... You can do whatever you want there.. You can setup specific forwarders..
Thanks. I will dig into that. Just got to fix an interesting bug in an appliance they are testing first. Regardless of ip settings on the device, it calls google dns on 8.8.8.8
-
What appliance? Many an iot sort of device are hard coded for specific dns.
Only sort of work around is a redirect.
-
It is a type of IoT "thingy" running android but when it has a setable DNS you kind of expect it to follow that. It has been reported to the supplier as a bug
-
You will likely have to detail this "design" with a detailed diagram.
