• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

Newbie to pfsense, got typo in WAN host name How to fix?

Problems Installing or Upgrading pfSense Software
pfsense
4
28
2.7k
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • J
    johnpoz LAYER 8 Global Moderator
    last edited by johnpoz Oct 29, 2018, 3:35 PM Oct 29, 2018, 3:32 PM

    Well that is what the PTR for that IP resolves to on the public internet..

    ;; QUESTION SECTION:
    ;242.125.218.74.in-addr.arpa. IN PTR

    ;; ANSWER SECTION:
    242.125.218.74.in-addr.arpa. 86400 IN PTR tezcelinc.net.

    You need to FIX it there.. not on pfsense.

    NS for that are listed as
    ;; AUTHORITY SECTION:
    125.218.74.in-addr.arpa. 3600 IN NS dns4.rr.com.
    125.218.74.in-addr.arpa. 3600 IN NS ns1.biz.rr.com.
    125.218.74.in-addr.arpa. 3600 IN NS ns2.biz.rr.com.

    Let me know if you decide you don't want that IP listed and will edit my post to hide it.

    An intelligent man is sometimes forced to be drunk to spend time with his fools
    If you get confused: Listen to the Music Play
    Please don't Chat/PM me for help, unless mod related
    SG-4860 24.11 | Lab VMs 2.7.2, 24.11

    1 Reply Last reply Reply Quote 0
    • M
      markp4289
      last edited by Oct 29, 2018, 3:35 PM

      John;
      It is suppose to vpn.texcelinc.net

      1 Reply Last reply Reply Quote 0
      • J
        johnpoz LAYER 8 Global Moderator
        last edited by johnpoz Oct 29, 2018, 3:41 PM Oct 29, 2018, 3:36 PM

        Well get with the owner of the IP.. they control the PTR of IPs in the netblocks they own..

        OrgName: Time Warner Cable Internet LLC

        I am thinking you don't understand how PTRs work maybe ;)

        You can control the forward for any domain you register and have control of the NS listed. But a PTR for an IP is going to be controlled by the owner of the netblock.. And they control the dns, ie the SOA..

        In an arp table you have an IP.. to resolve said IP you would query the PTR of said IP..

        Ie as listed in my query you see above.

        ;; AUTHORITY SECTION:
        125.218.74.in-addr.arpa. 3045 IN SOA ns1.biz.rr.com. dnsadmin.rr.com. 2003101324 10800 3600 604800 3600

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.7.2, 24.11

        1 Reply Last reply Reply Quote 0
        • M
          markp4289
          last edited by Oct 29, 2018, 3:41 PM

          John;
          Calling TWC right now.

          1 Reply Last reply Reply Quote 0
          • J
            johnpoz LAYER 8 Global Moderator
            last edited by johnpoz Oct 29, 2018, 3:49 PM Oct 29, 2018, 3:46 PM

            If you have a biz connection then yeah they prob update it for you - the TTL is 24 hours... So anyone that has that cached you will have to wait on, etc..

            But that really shouldn't have any effect on someone resolving a fqdn vpn.domain.tld to get to your IP... That would be what you control if you are the owner of said domain.tld Nor would it have anything to do with what fqdn or SAN is listed in a cert... Where they mostly come into play is say an email server sending email saying hey my name is smtp.domain.tld... And when the recv smtp server tries to look up the PTR for that IP it gets back something.else.tld - which screams the owner of smtp server doesn't have a clue - this is prob spam ;) heheeh For what your most likely doing getting users to access vpn.domain.tld the PTR doesn't really matter.. But if they will change it then yeah its good idea to have forwards and reverse for an IP match up when possible.

            Example - here is arp table for my pfsense wan at home.
            login-to-view

            This is the PTR of that IP owned by my ISP.. But I can point any forward (a record) I want to it.. vpn.mydomain.tld if I own the domain.. Or can have records edited, etc..

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.7.2, 24.11

            1 Reply Last reply Reply Quote 0
            • M
              markp4289
              last edited by Oct 29, 2018, 3:52 PM

              John;
              our registar is bluehost I just

              1 Reply Last reply Reply Quote 0
              • J
                johnpoz LAYER 8 Global Moderator
                last edited by Oct 29, 2018, 3:54 PM

                @markp4289 said in Newbie to pfsense, got typo in WAN host name How to fix?:

                vpn.texcelinc.net

                Yeah I see that..
                ;; AUTHORITY SECTION:
                texcelinc.net. 300 IN SOA ns1.bluehost.com.

                That resolves just fine - but WOW what a short ttl on a SOA record... Uggghhh!! That resolves just fine - but that has zero to do with PTR

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                1 Reply Last reply Reply Quote 0
                • J
                  johnpoz LAYER 8 Global Moderator
                  last edited by Oct 29, 2018, 3:56 PM

                  BTW - let me know if you want me to clean up the public IPs and fqdn that resolve to this IP - some people have issues with posting such info on public forum.. I only posted it because you had already done so, etc. but be happy to clean up the whole thread replacing with placeholder names..

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                  1 Reply Last reply Reply Quote 0
                  • M
                    markp4289
                    last edited by Oct 29, 2018, 3:59 PM

                    pfsense is suppose to protect me so you can leave it alone

                    1 Reply Last reply Reply Quote 0
                    • J
                      johnpoz LAYER 8 Global Moderator
                      last edited by johnpoz Oct 29, 2018, 4:01 PM Oct 29, 2018, 4:00 PM

                      hehee - ok.. pfsense doesn't stop someone doesn't like something you say here on the board and pointing some bot net at your ip to flood your connection with a ddos... Just saying...

                      Bot nets can be hired for pennies these days..

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                      1 Reply Last reply Reply Quote 0
                      • S
                        stephenw10 Netgate Administrator
                        last edited by Oct 29, 2018, 4:08 PM

                        Never really dug too deep into that but is it not possible dhclient sent that to the provider?
                        Unless that was similarly typo'd at some other point.

                        In which case I would expect it to expire at some point.

                        But either way the issue here appears to be that the VPN server certificate was created with the old host name and clients are refusing it right?

                        In which case just regenerate the server cert.

                        Steve

                        1 Reply Last reply Reply Quote 0
                        • J
                          johnpoz LAYER 8 Global Moderator
                          last edited by johnpoz Oct 29, 2018, 4:34 PM Oct 29, 2018, 4:33 PM

                          @stephenw10 said in Newbie to pfsense, got typo in WAN host name How to fix?:

                          Never really dug too deep into that but is it not possible dhclient sent that to the provider?

                          No... I don't think so - never seen a provider update their PTR records with hostname via dhcp client.. Not saying it not possible.. And not really a good idea to be honest.. Since its quite possible you wouldn't want the PTR to reflect host name of the router, but the forward name of say a smtp server you have behind that public IP, etc.

                          If his ISP is allowing him have a PTR of his choice - then a simple call to them should get it fixed up. You could also just have your dns look like it owns the netspace.. So for example just created record in unbound for my pfsense for my public IP.. And now it shows this in the arp table.

                          login-to-view

                          But that has zero to do with how anyone else on the planet would resolve it... Just makes anyone using my unbound as their dns resolve that PTR. Simple local-data-ptr in the custom box easiest way to do it ;)

                          And as discussed this would have nothing to do with any sort of cert not complaining about a common or san name in a cert.

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                          1 Reply Last reply Reply Quote 0
                          • J
                            jimp Rebel Alliance Developer Netgate
                            last edited by Oct 29, 2018, 4:37 PM

                            If it's what you see in the ARP page, that should be what is resolved locally, so either the hostname under System > General or maybe a host override.

                            If it's the GUI cert that has an unexpected hostname, then you can make a new cert manually, or use pfSsh.php playback generateguicert after correcting the hostname, or (Even better) use ACME to get a real trusted cert.

                            If it's a VPN cert, make a new server cert.

                            If you can't find where else the wrong hostname is present, download a config.xml backup and then open it in a text editor. Do a search inside for the incorrect name.

                            Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                            Need help fast? Netgate Global Support!

                            Do not Chat/PM for help!

                            1 Reply Last reply Reply Quote 0
                            • M
                              markp4289
                              last edited by Oct 29, 2018, 5:02 PM

                              Hmmmm; My WAN link is static IP and config that's why I thought it was my typo. I just got off the phone with TWC took an about to get to the Level III that knew what I was talking about. This is the 4 th TWC problem that I've had in 7 days.

                              1 Reply Last reply Reply Quote 0
                              • J
                                johnpoz LAYER 8 Global Moderator
                                last edited by johnpoz Oct 29, 2018, 5:34 PM Oct 29, 2018, 5:30 PM

                                Looks like they BROKE it to me.. now all you get back is SOA when you query the SOA for that PTR ;)

                                So vs them fixing it to the actual fqdn you wanted to be returned, they just removed the record completely ;)

                                An intelligent man is sometimes forced to be drunk to spend time with his fools
                                If you get confused: Listen to the Music Play
                                Please don't Chat/PM me for help, unless mod related
                                SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                                1 Reply Last reply Reply Quote 0
                                • S
                                  stephenw10 Netgate Administrator
                                  last edited by Oct 29, 2018, 5:43 PM

                                  Nice. 🙄

                                  Though still not clear to me why that should be an issue. If this is just VPN clients refusing the cert just regenerate it.

                                  Steve

                                  1 Reply Last reply Reply Quote 0
                                  • J
                                    johnpoz LAYER 8 Global Moderator
                                    last edited by Oct 29, 2018, 5:45 PM

                                    Its not an issue what his PTR reports or doesn't report has ZERO to do with his overall problem.. I believe what he saw in his arp table just confused him..

                                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                                    If you get confused: Listen to the Music Play
                                    Please don't Chat/PM me for help, unless mod related
                                    SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                                    1 Reply Last reply Reply Quote 1
                                    • M
                                      markp4289
                                      last edited by Oct 29, 2018, 7:03 PM

                                      After TWC deleted PTR records.
                                      login-to-view

                                      1 Reply Last reply Reply Quote 0
                                      • J
                                        johnpoz LAYER 8 Global Moderator
                                        last edited by Oct 29, 2018, 7:10 PM

                                        yup that is what I show for those IPs PTR ;)

                                        I don't see any vpn one though? the forward points to .242 but the PTR is just gone.

                                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                                        If you get confused: Listen to the Music Play
                                        Please don't Chat/PM me for help, unless mod related
                                        SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                                        1 Reply Last reply Reply Quote 0
                                        • M
                                          markp4289
                                          last edited by Oct 29, 2018, 7:12 PM

                                          So it looks like the General setup generates the LAN hostname but nowhere is the WAN hostname entered. How do I get the WAN hostname in there?

                                          1 Reply Last reply Reply Quote 0
                                          16 out of 28
                                          • First post
                                            16/28
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.