Unable to resolve certain sites DNS Resolver

[bigraz1968]

It seems like the firewall is holding some stale information somewhere and rebooting isn't fixing the issue.

[bigraz1968]

Hi John

The two clients are my TV's have the issue My Netflix smart app. doesn't work I get the message 'Unable to connect' I use the builtin browser to load Netflix and Netflix still doesn't load. Other sites will load. Sharp TV support worked on the issue and finally said the problem is my router.

I hookup my Chromebook and Netflix.com doesn't load. It just says 'Waiting on cache' an then it stops loading

I hookup another laptop and that laptop loads Netflix without issue.

The common denominator is machines that had a static DHCP reservation don't work, but machines not assigned statically have no issues

[johnpoz]

doesn't answer the question.. What happens when you query - and does it happen for all things or just some sites?

Lets see an example dig or nslookup query (dig is BETTER) from client that works, and from client that doesn't work.

edit: Well what are you doing different in your static reservation? You know you can point to different dns.. Or you could have different rules, etc.

Simple solution would be to sniff on pfsense to see exactly what the client is trying to do, etc. Netflix apps can be hard coded to try and query say google dns.

[bigraz1968]

DNS is working. Just a couple frequent sites I use will not resolve. I picked Netflix because in my house it is used frequently. I can do a working client but unable to perform dig on a broken client. I am at work.

[bigraz1968]

Nslookup query from working machine

C:\Users\rdevone-desktop>nslookup netflix.com
Server: pfSense.localdomain
Address: 192.168.1.1

Non-authoritative answer:
Name: netflix.com
Address: 45.76.252.24

[johnpoz]

ok well that is a cached response from 192.168.1.1 (assume pfsense IP since it resolve to pfsense.localdomain)... so lets see something broken when you get home..

I take it you did not mess with the the unbound views and acls..

[bigraz1968]

I take it you did not mess with the the unbound views and acls.. No I don't know what that is. I haven't made any changes at all.

You always have been so helpful. I really appreciate your help. My family is going to kill me if I don't get this fixed soon.

Thanks

Randy

[bigraz1968]

Johnpoz;

I did a dig on one of the clients that is having a issue and the dig command completes successfully as it did on a client that has no issue.

Thanks

Randy

[bigraz1968]

Johnpoz;

I made a mistake. I did the dig with the wrong DNS server. I switched the DNS to my resolver and I get 'connection timed out, no servers can be reached'.

Thanks

Randy

[johnpoz]

so you can not get any sort of answer from pfsense? From this client? Or you saying that certain looks fail?

[bigraz1968]

Correct. for Netflix.com Most sites do resolve. If I switch to a client in my DMZ. Netflix resolves successfully. DMZ uses the resolver as well.

[johnpoz]

Here is the thing the resolve doesn't care what network your on local - if you can talk to it, then it the same no matter what local network your on.. UNLESS you have messed with the acls or created views.

What are your firewall rules on this interface?

[Gertjan]

@johnpoz said in Unable to resolve certain sites DNS Resolver:

What are your firewall rules on this interface?

+1 (again).

[bigraz1968]

[Gertjan]

Ok,
The questions :
Who is / what interface is 192.168.1.1 ?
192.168.1.50 ?

What are you hiding here :

What are you doing here :

The image is not complete.

What happens if you put on position 2 a "Pass all rule" like this :

[johnpoz]

Rule are evaluated top down, first rule to trigger wins no other rules are evaluated.. Shoving stuff out your wan dhcp could cause you problems.

Do you have any rules on floating?

So your doing dns redirection? Also curious what this 192.168.1.50 if its on your lan 192.168.1/24? Then that rule would NEVER come into play since devices don't talk to their gateway to talk to device on their own network. So not sure what this is expected to do.

Lets see your full rule set both on this interface and your floating and any redirections (port forwards your attempting) Also anything using explicit proxy would not do dns itself - it asks the proxy to do do the dns for it.. When it sends the proxy the FQDN it wants to get too.

These rules not making much sense to be honest.

[bigraz1968]

Gertjan;
192.168.1.50 is my AD server. That rule isn't needed anymore and can be removed. 192.168.1.1 is my firewall. I haven't tried this: What happens if you put on position 2 a "Pass all rule" like this : but I will try when I get home

Johnpoz;

I route out of my Wan_DHCP because some of my services can't work through the VPN. I'm not doing any DNS Redirection, not on purpose

[bigraz1968]

My rules can be cleaned up but this has been working for a long time before this resolution issue started happening.

[Gertjan]

Also : de activate pfBlocker (thus cleaning your Floating rules) for the time being.

This rule :

on interface LAN - on position 2 - and test.
Then 3, and test.
etc.
When things (DNS) start to not-work anymore, you have found your offending rule.

[johnpoz]

I understand letting stuff out your wan vs vpn - but that is NOT how you should do it.. You prevent any intervlan traffic with such a rule..

Move the anyrule to the top.. Does that make your problem go away... Looking at such a mess makes my brian hurt! ;)

What are you expecting to happen with the multicast rule? And what the F is wan service ports? And your blocking from talking to pretty much the whole planet there with your pfblocker rules? Good luck resolving when the authoritative name server you need to ask is blocked, etc..

What is the IP of the clients that are having problems? And are they in this TV alias? What is in that TV alias?