Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Add DNS server on pfsense machine

    Scheduled Pinned Locked Moved General pfSense Questions
    23 Posts 5 Posters 9.7k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • dam034D
      dam034
      last edited by

      Yes, I know I have to add static DHCP leases, in such a way as to assign the same private IP address to the MAC address which I want.

      But the fact is to assign a different name (and more than one) from the DHCP client name.

      So I want to separate the DHCP server from the DNS resolver.

      Is it possible?

      Thanks

      1 Reply Last reply Reply Quote 0
      • GertjanG
        Gertjan
        last edited by

        Well, DHCP and DNS are separate functionalities anyway.

        You can add as many host overrides into the DS (resolver or forwarder) as you want. They can point to the same IP if needed.

        Be careful : not having a DNS on pfSense can have nasty effect for the firewall itself : like the issue : "Help, my pfSense can upgrade neither install packages", etc.

        No "help me" PM's please. Use the forum, the community will thank you.
        Edit : and where are the logs ??

        dam034D 1 Reply Last reply Reply Quote 0
        • stephenw10S
          stephenw10 Netgate Administrator
          last edited by

          You can install bind if you want, it's available as a pfSense package. But I agree it looks like Unbound can do everything you want.

          Steve

          1 Reply Last reply Reply Quote 0
          • dam034D
            dam034 @Gertjan
            last edited by

            @gertjan and @stephenw10 Can you show me how to do what you advice me, so I can choose the better?

            Thanks

            1 Reply Last reply Reply Quote 0
            • stephenw10S
              stephenw10 Netgate Administrator
              last edited by

              It looks like you just need to add host overrides in Unbound for the hosts you want to resolve there.

              https://docs.netgate.com/pfsense/en/latest/book/services/dns-resolver.html#host-overrides

              Steve

              1 Reply Last reply Reply Quote 0
              • dam034D
                dam034
                last edited by

                Now I didn't understand good how to do.

                There are two cases:

                • if I want to override a existing DNS (e.g. "forum.netgate.com") assigning it an A record pointing to 10.45.2.43;
                • if I want to create a new DNS zone, which can be the same domain of the pfsense machine or not, creating many A and CNAME records.

                Can you explain please?

                Thanks

                1 Reply Last reply Reply Quote 0
                • JeGrJ
                  JeGr LAYER 8 Moderator
                  last edited by

                  @dam034 said in Add DNS server on pfsense machine:

                  if I want to override a existing DNS (e.g. "forum.netgate.com") assigning it an A record pointing to 10.45.2.43;

                  As already said: make a Host override, Host: forum, Domain: netgate.com and assign it an internal IP 10.45.2.43. Your pfSense afterwards will answer any request for forum.netgate.com with 10.45.2.43 to your clients.

                  if I want to create a new DNS zone, which can be the same domain of the pfsense machine or not, creating many A and CNAME records.

                  You don't create a DNS zone per se. You don't need to, as you don't run a complete DNS server, that needs(!) a zone to load DNS entries. The DNS Resolver (unbound) can simply act on single Host Overrides and resolve the defined hostname to an IP.

                  So you want to create "dummy.here" and point it to 10.45.2.43? Do the same as above with the forum!
                  Host: dummy
                  Domain: here
                  IP: 10.45.2.43
                  -> save

                  Afterwards check on a client on LAN with "host", "dig", "nslookup" (depending on your OS). It's as easy as that. If you configure pfSense in general settings to the domain "here" and configure DHCP accordingly, all static IP mappings you create with DHCP are also automatically known to the DNS resolver (check the corresponding box in the DNS resolver screen for that), so you can "populate" your "domain" .here with static IP mappings and overrides without having the need to create a complex DNS setup with bind.

                  Don't forget to upvote ๐Ÿ‘ those who kindly offered their time and brainpower to help you!

                  If you're interested, I'm available to discuss details of German-speaking paid support (for companies) if needed.

                  1 Reply Last reply Reply Quote 0
                  • dam034D
                    dam034
                    last edited by

                    I didn't understand only one step: if the pfsense domain is "here", DHCP and static IPs create the DNS resolver, can I add more hostnames in "here" domain in host override?

                    And if there is a DHCP client named "hello", and in DNS override I want to point "hello.here" to another IP, can I do it?

                    Thanks

                    1 Reply Last reply Reply Quote 0
                    • johnpozJ
                      johnpoz LAYER 8 Global Moderator
                      last edited by

                      you don't have to register dhcp clients in unbound.

                      And then just create whatever host overrides you want.

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                      1 Reply Last reply Reply Quote 0
                      • dam034D
                        dam034
                        last edited by

                        Have I to disable the DHCP registration to override a DHCP client name?

                        Thanks

                        1 Reply Last reply Reply Quote 0
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator
                          last edited by

                          You don't have to but having the same name that points to 2 different ips is never good thing. But you could have 2 or more names that point to the same IP.

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                          1 Reply Last reply Reply Quote 0
                          • stephenw10S
                            stephenw10 Netgate Administrator
                            last edited by

                            No, you can add it as a host override and still register it. It overrides the dhcp lease registeration.

                            Not sure why you would want to that though.

                            Steve

                            1 Reply Last reply Reply Quote 0
                            • dam034D
                              dam034
                              last edited by

                              I'm thinking like that because they could be some DHCP clients names already registered in host override section.
                              Indeed, I tried to add a host override name "pohp.here" which points to an external IP, but when a DHCP client named "pohp" connects, the DNS points to the DHCP client machine, not to the external IP.

                              Is it possible to override? Or have I to disable DHCP clients registration?

                              Thanks

                              1 Reply Last reply Reply Quote 0
                              • johnpozJ
                                johnpoz LAYER 8 Global Moderator
                                last edited by

                                Why would you point pohp.here to an external IP if you have a client called pohp?

                                Really not understanding your use case... But if your going to put in by hand IP address for clients fqdn, then there is ZERO point to having them register dhcp address into unbound..

                                You have dhcp clients register in dns when your are NOT going to put in records by hand for them.

                                An intelligent man is sometimes forced to be drunk to spend time with his fools
                                If you get confused: Listen to the Music Play
                                Please don't Chat/PM me for help, unless mod related
                                SG-4860 24.11 | Lab VMs 2.8, 24.11

                                1 Reply Last reply Reply Quote 0
                                • dam034D
                                  dam034
                                  last edited by

                                  I did an example, now I can explain better:

                                  1. there is a DHCP client named "server";
                                  2. I want to point "server.here" to it;
                                  3. I add an host override "server.here" pointing to the machine written in step 1;
                                  4. there could be another machine which the DHCP client name is "server".

                                  I'm writing this because I don't administer fully the LAN, and some customers can connect to the wifi, and there could be some inconvenient DHCP clients names.

                                  Should have I to disable the DHCP registration or is there a way to stay secure?

                                  Thanks

                                  1 Reply Last reply Reply Quote 0
                                  • stephenw10S
                                    stephenw10 Netgate Administrator
                                    last edited by stephenw10

                                    Hmm, I tested that before posting and found it worked fine.

                                    Are you sure you are seeing the same hostname and domain?

                                    Edit: And it's still working after the client lease renewed.

                                    Steve

                                    1 Reply Last reply Reply Quote 0
                                    • johnpozJ
                                      johnpoz LAYER 8 Global Moderator
                                      last edited by

                                      @dam034 said in Add DNS server on pfsense machine:

                                      there could be another machine which the DHCP client name is "server".

                                      And why would you need to resolve those? So don't have dhcp register in unbound.. And just put in the host overrides for the stuff you want/need to resolve.

                                      To be honest I really don't understand resolving dhcp clients by name in the first place.. If the box is important enough to you want to get to it by name.. Than it should have a reservation for dhcp so it always get the same IP. So register static dhcp. Or just set the box to be static IP and setup dns to resolve name to that IP, etc..

                                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                                      If you get confused: Listen to the Music Play
                                      Please don't Chat/PM me for help, unless mod related
                                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                                      1 Reply Last reply Reply Quote 0
                                      • stephenw10S
                                        stephenw10 Netgate Administrator
                                        last edited by

                                        Well you could argue that clients with dynamic IPs are most likely to need DNS resolution to address them. ๐Ÿ˜‰

                                        But I hear what you're saying.

                                        Either way I have that setup here and it works exactly as expected. I suspect there is actually a mismatch here. For example you enter client1 somewhere and you think it should resolve to an override you have as client1.domain1.net but in fact your client is trying to resolve soemthing different like client1.sub.domain1.net because something is misconfigured.

                                        Steve

                                        1 Reply Last reply Reply Quote 0
                                        • johnpozJ
                                          johnpoz LAYER 8 Global Moderator
                                          last edited by

                                          There is a difference between "clients" that get dhcp and "servers" he is using the name server.. While sure you might want to hand info out to the server via dhcp, so you can easy change stuff later like different router or dns, etc.

                                          But server should have a dhcp reservation.

                                          Random clients that are on and off the network, if you have a need to resolve them sure have register their names. But then why would you need to put in a host override? Why would you not just use different sub or domain then..

                                          Just still not getting this use case.

                                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                                          If you get confused: Listen to the Music Play
                                          Please don't Chat/PM me for help, unless mod related
                                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                                          1 Reply Last reply Reply Quote 1
                                          • stephenw10S
                                            stephenw10 Netgate Administrator
                                            last edited by

                                            Yeah, the easiest way to avoid this would just be to not add dynamic leases to Unbound.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.