DNS Resolver Status, no data?

johnpoz

I have no idea.. You have provided ZERO info on your setup..

Here resolver mode.., changed to forward mode google, stats

Its not freaking rocket science here people

Your typical user is going to have ZERO understanding of what those stats even mean to be honest ;) Anyone that would actually want/need them would be able to pull them from the cmd line anyway..

Now back to resolver mode because forwarding = uuuuggghhhh!

provels

That's entirely possible. But I'm in Resolver mode now. All I ever saw in Forwarder mode was data for the servers setup in General, which figures. Why should it ask anybody else? A Resolver goes straight to the roots. But until recently I saw no data at all in either mode. Doesn't resolver use that cache data to know which root server will give it the fastest reply? Without the cache, what happens? Dud DNS?

johnpoz

It uses the roots to do the first lookups.. Picks 1 at random... They all that the same info... Your just asking 1 of the root servers for the NS of com, or net or edu or whatever you asking.

It then keeps a cache at how fast these different NS it talks to respond.. If it finds out that hey root A answers faster than C... Its going to first try A, before it asks C for anything, etc. etc.

Your typical user has zero use for this info.. Al he wants to know is hey I ask for www.google.com and got back an IP..

You would really only need to look at this info when troubleshooting the most odd sorts of issues.. Other than just curiosity sake - or overall health to see if your seeing any sort of timeouts and what sort of response times your getting, etc.

There back to showing stats for normal resolver stuff the second after changing back

And to be honest would prob not ever look at it in this sort of output.. Its too much info... Your prob going to ask for the infra cache info for the specific domain you are having issues resolving from, etc..

Why they even put this on a menu item - is nothing more than eye candy if you ask me.

KOM

And now my list is back to No Data...

I don't think details of my setup have anything to do with a stats page being filled by a service that is running.

And now I have some limited data there. All this in the span of 5 minutes. This makes no sense unless this page has a short time threshold before it wipes everything.

johnpoz

You have something wrong if your not seeing data and actually using the resolver... After it does one query.. It will store that info.

Is your resolving actual working? what does your resolver log show?

For all we know your resolver is running but your not actually asking it anything.

Maybe you got a browser cache issue that is not showing the info should be showing - do the query from the cmd line of pfsense. One sec and give an example.

Grimson

@kom said in DNS Resolver Status, no data?:

And now I have some limited data there. All this in the span of 5 minutes. This makes no sense unless this page has a short time threshold before it wipes everything.

How often is unbound restarting on your system? Check the logs.

johnpoz

Here is from cmd line

$0_1552504214462_infracachedump.png$

All the web gui does it take the output of that and present it..

No unbound is not going to wipe that data on any sort of schedule.. This the data it uses to know which NS are best to talk to, etc.

Take a look to see how many actual queries have happened since unbound restarted

total.num.queries=287
total.num.queries_ip_ratelimited=0
total.num.cachehits=218
total.num.cachemiss=69

Use
unbound-control -c /var/unbound/unbound.conf stats_noreset

Look through for total, etc. How many queries happened, etc. since unbound restarted. If 0 then no nothing going to be in the stats for the infa.

KOM

You have something wrong if your not seeing data and actually using the resolver... After it does one query.. It will store that info.

I think pfSense might be doing something wrong. I am definitely using Resolver. I can resolve via Diagnostics - DNS Lookup. The stats page seems to be randomly full or empty.

Resolver log shows:

Jan 23 21:36:20 	unbound 	78590:0 	info: start of service (unbound 1.8.1).
Jan 23 21:36:20 	unbound 	78590:0 	notice: init module 0: iterator

and those are the latest updates.

Interestingly, a manual nslookup shows the answering DNS server to be one of my AD DCs. Back when I first installed pfSense (2.1.x), I had it configured for DNS Forwarder, and I put my AD DNS into General Settings - DNS Servers. Later on, I disabled Forwarder and ran Resolver instead. Resolver is definitely NOT in forwarder mode. And yet it's still sending request to my DC.

johnpoz

If your an AD shop your clients should directly be asking your AD dns anyway... Have it forward to pfsense if you want.. But might as well just have your AD resolve, etc.

Do the command I asked before - lets see how many queries have been asked of unbound.

KOM

unbound-control -c /var/unbound/unbound.conf dump_infra

returns blank, and my stats page is back to No Data. So bizarre.

johnpoz

and lets see this

[2.4.4-RELEASE][admin@sg4860.local.lan]/root: unbound-control -c /var/unbound/unbound.conf stats_noreset | grep total.num
total.num.queries=336
total.num.queries_ip_ratelimited=0
total.num.cachehits=251
total.num.cachemiss=85
total.num.prefetch=0
total.num.zero_ttl=0
total.num.recursivereplies=85
[2.4.4-RELEASE][admin@sg4860.local.lan]/root:

How many queries so mine went from 200 something to 336 in the couple of minutes.

KOM

total.num.queries=7233
total.num.queries_ip_ratelimited=0
total.num.cachehits=6981
total.num.cachemiss=252
total.num.prefetch=4892
total.num.zero_ttl=4748
total.num.recursivereplies=252

and Stats is still blank.

provels

@kom No idea if this means anything, but I had a 10 minute time drift between my VM and Real Life. Looks like NTP to pool.ntp.org wasn't quite working for me. Corrected and now seems to be working. Coincidence?

johnpoz

Lets see whats in the infra cache.. ask unbound who it would ask for specific domain... For example just did microsoft.

[2.4.4-RELEASE][admin@sg4860.local.lan]/root: unbound-control -c /var/unbound/unbound.conf lookup www.microsoft.com
The following name servers are used for lookup of www.microsoft.com.
;rrset 84738 13 0 2 0
com.    84738   IN      NS      d.gtld-servers.net.
com.    84738   IN      NS      c.gtld-servers.net.
com.    84738   IN      NS      a.gtld-servers.net.
com.    84738   IN      NS      k.gtld-servers.net.
com.    84738   IN      NS      e.gtld-servers.net.
com.    84738   IN      NS      m.gtld-servers.net.
com.    84738   IN      NS      i.gtld-servers.net.
com.    84738   IN      NS      b.gtld-servers.net.
com.    84738   IN      NS      f.gtld-servers.net.
com.    84738   IN      NS      l.gtld-servers.net.
com.    84738   IN      NS      j.gtld-servers.net.
com.    84738   IN      NS      h.gtld-servers.net.
com.    84738   IN      NS      g.gtld-servers.net.
;rrset 84738 1 1 11 5
com.    84738   IN      DS      30909 8 2 E2D3C916F6DEEAC73294E8268FB5885044A833FC5459588F4A9184CFC41A5766
com.    84738   IN      RRSIG   DS 8 1 86400 20190326170000 20190313160000 16749 . OMtKk6RTDzvphZVSK+udXiB77g87GGNMnV5R/8cczdZapo1xVuawqufRPh/u8p3zJIvdGgjOPt7YCSXlrwE0jDWT8R4qtsGlrClDIy3fy39cN1ORFZGhpV7dmyAWpi7pFnpWaI0X5tMoiUu4spmCSS08DzqedVIhcAxiDFLtso05Upi2RpIMaMD7eU4YWsCHpkzxmmBYPNbyWb0ryxEpyzXgrb40Dq9hlUAZna6SUsQ81rsFMxH6G7GCuFhMvreZOX6D77ML0hgLhbbEnNlS+7EjyghZtBy+I3JTzI0onWgbaIpJbH+LbFI9XmcRUFDsV5FzGRkvi+a9U+uEuKuhlg== ;{id = 16749}
;rrset 84738 1 0 1 0
g.gtld-servers.net.     171138  IN      A       192.42.93.30
;rrset 84738 1 0 1 0
g.gtld-servers.net.     171138  IN      AAAA    2001:503:eea3::30
;rrset 84738 1 0 1 0
h.gtld-servers.net.     171138  IN      A       192.54.112.30
;rrset 84738 1 0 1 0
h.gtld-servers.net.     171138  IN      AAAA    2001:502:8cc::30
;rrset 84738 1 0 1 0
j.gtld-servers.net.     171138  IN      A       192.48.79.30
;rrset 84738 1 0 1 0
j.gtld-servers.net.     171138  IN      AAAA    2001:502:7094::30
;rrset 84738 1 0 1 0
l.gtld-servers.net.     171138  IN      A       192.41.162.30
;rrset 84738 1 0 1 0
l.gtld-servers.net.     171138  IN      AAAA    2001:500:d937::30
;rrset 84738 1 0 1 0
f.gtld-servers.net.     171138  IN      A       192.35.51.30
;rrset 84738 1 0 1 0
f.gtld-servers.net.     171138  IN      AAAA    2001:503:d414::30
;rrset 84738 1 0 1 0
b.gtld-servers.net.     171138  IN      A       192.33.14.30
;rrset 84738 1 0 1 0
b.gtld-servers.net.     171138  IN      AAAA    2001:503:231d::2:30
;rrset 84738 1 0 1 0
i.gtld-servers.net.     171138  IN      A       192.43.172.30
;rrset 84738 1 0 1 0
i.gtld-servers.net.     171138  IN      AAAA    2001:503:39c1::30
;rrset 84738 1 0 1 0
m.gtld-servers.net.     171138  IN      A       192.55.83.30
;rrset 84738 1 0 1 0
m.gtld-servers.net.     171138  IN      AAAA    2001:501:b1f9::30
;rrset 84738 1 0 1 0
e.gtld-servers.net.     171138  IN      A       192.12.94.30
;rrset 84738 1 0 1 0
e.gtld-servers.net.     171138  IN      AAAA    2001:502:1ca1::30
;rrset 84738 1 0 1 0
k.gtld-servers.net.     171138  IN      A       192.52.178.30
;rrset 84738 1 0 1 0
k.gtld-servers.net.     171138  IN      AAAA    2001:503:d2d::30
;rrset 84738 1 0 1 0
a.gtld-servers.net.     171138  IN      A       192.5.6.30
;rrset 84738 1 0 1 0
a.gtld-servers.net.     171138  IN      AAAA    2001:503:a83e::2:30
;rrset 84738 1 0 1 0
c.gtld-servers.net.     171138  IN      A       192.26.92.30
;rrset 84738 1 0 1 0
c.gtld-servers.net.     171138  IN      AAAA    2001:503:83eb::30
;rrset 84738 1 0 1 0
d.gtld-servers.net.     171138  IN      A       192.31.80.30
;rrset 84738 1 0 1 0
d.gtld-servers.net.     171138  IN      AAAA    2001:500:856e::30
Delegation with 13 names, of which 0 can be examined to query further addresses.
It provides 26 IP addresses.
2001:500:856e::30       rto 321 msec, ttl 256, ping 13 var 77 rtt 321, tA 0, tAAAA 0, tother 0, EDNS 0 probed.
192.31.80.30            rto 355 msec, ttl 652, ping 7 var 87 rtt 355, tA 0, tAAAA 0, tother 0, EDNS 0 probed.
2001:503:83eb::30       not in infra cache.
192.26.92.30            rto 330 msec, ttl 298, ping 14 var 79 rtt 330, tA 0, tAAAA 0, tother 0, EDNS 0 probed.
2001:503:a83e::2:30     rto 330 msec, ttl 716, ping 14 var 79 rtt 330, tA 0, tAAAA 0, tother 0, EDNS 0 probed.
192.5.6.30              rto 651 msec, ttl 267, ping 55 var 149 rtt 651, tA 0, tAAAA 0, tother 0, EDNS 0 probed.
2001:503:d2d::30        not in infra cache.
192.52.178.30           rto 347 msec, ttl 143, ping 7 var 85 rtt 347, tA 0, tAAAA 0, tother 0, EDNS 0 probed.
2001:502:1ca1::30       not in infra cache.
192.12.94.30            rto 315 msec, ttl 298, ping 3 var 78 rtt 315, tA 0, tAAAA 0, tother 0, EDNS 0 probed.
2001:501:b1f9::30       rto 285 msec, ttl 267, ping 17 var 67 rtt 285, tA 0, tAAAA 0, tother 0, EDNS 0 probed.
192.55.83.30            not in infra cache.
2001:503:39c1::30       not in infra cache.
192.43.172.30           rto 301 msec, ttl 878, ping 1 var 75 rtt 301, tA 0, tAAAA 0, tother 0, EDNS 0 probed.
2001:503:231d::2:30     rto 473 msec, ttl 652, ping 21 var 113 rtt 473, tA 0, tAAAA 0, tother 0, EDNS 0 probed.
192.33.14.30            not in infra cache.
2001:503:d414::30       not in infra cache.
192.35.51.30            not in infra cache.
2001:500:d937::30       not in infra cache.
192.41.162.30           rto 342 msec, ttl 603, ping 6 var 84 rtt 342, tA 0, tAAAA 0, tother 0, EDNS 0 probed.
2001:502:7094::30       rto 361 msec, ttl 268, ping 17 var 86 rtt 361, tA 0, tAAAA 0, tother 0, EDNS 0 probed.
192.48.79.30            rto 297 msec, ttl 595, ping 1 var 74 rtt 297, tA 0, tAAAA 0, tother 0, EDNS 0 probed.
2001:502:8cc::30        rto 374 msec, ttl 268, ping 10 var 91 rtt 374, tA 0, tAAAA 0, tother 0, EDNS 0 probed.
192.54.112.30           rto 302 msec, ttl 716, ping 2 var 75 rtt 302, tA 0, tAAAA 0, tother 0, EDNS 0 probed.
2001:503:eea3::30       rto 325 msec, ttl 255, ping 13 var 78 rtt 325, tA 0, tAAAA 0, tother 0, EDNS 0 probed.
192.42.93.30            rto 333 msec, ttl 652, ping 5 var 82 rtt 333, tA 0, tAAAA 0, tother 0, EDNS 0 probed.
[2.4.4-RELEASE][admin@sg4860.local.lan]/root:

KOM

@johnpoz My output is similar to yours.

I suspect I've managed to confuse things by having DNS listed in General Setup - DNS Servers even though I'm using Resolver. There is no reason why it should return results from my AD DCs. The General Setup servers should be completely ignored when running with Resolver.

The time on my pfSense VM is correct.

johnpoz

ignored by who? Sure resolver will ignore them, but not pfsense.

So it shows such entries

Delegation with 13 names, of which 0 can be examined to query further addresses.
It provides 26 IP addresses.
2001:500:856e::30       rto 321 msec, ttl 256, ping 13 var 77 rtt 321, tA 0, tAAAA 0, tother 0, EDNS 0 probed.
192.31.80.30            rto 355 msec, ttl 652, ping 7 var 87 rtt 355, tA 0, tAAAA 0, tother 0, EDNS 0 probed.
2001:503:83eb::30       not in infra cache.
192.26.92.30            rto 330 msec, ttl 298, ping 14 var 79 rtt 330, tA 0, tAAAA 0, tother 0, EDNS 0 probed.
2001:503:a83e::2:30     rto 330 msec, ttl 716, ping 14 var 79 rtt 330, tA 0, tAAAA 0, tother 0, EDNS 0 probed.
192.5.6.30              rto 651 msec, ttl 267, ping 55 var 149 rtt 651, tA 0, tAAAA 0, tother 0, EDNS 0 probed.

That have data in them... Then your infra cache is there and being used... Why your not seeing the info your gui is cosmetic, and or browser problem, etc..

Your on 2.4.4p2?

KOM

Delegation with 13 names, of which 0 can be examined to query further addresses.
It provides 26 IP addresses.
2001:501:b1f9::30       not in infra cache.
192.55.83.30            expired, rto 43388736 msec, tA 0 tAAAA 0 tother 0.
2001:503:d414::30       not in infra cache.
192.35.51.30            expired, rto 43388736 msec, tA 0 tAAAA 0 tother 0.
2001:502:8cc::30        not in infra cache.
192.54.112.30           expired, rto 43388736 msec, tA 0 tAAAA 0 tother 0.
2001:503:39c1::30       not in infra cache.
192.43.172.30           expired, rto 43388736 msec, tA 0 tAAAA 0 tother 0.
2001:502:1ca1::30       not in infra cache.

You learn something new every day. I thought that those DNS were ignored unless Forwarder was in use, or Resolver in forward mode. The info even says that. It doesn't say anything about pfSense using it internally for whatever reason.

Yes, latest version.

johnpoz

@kom said in DNS Resolver Status, no data?:

192.55.83.30 expired, rto 43388736 msec, tA 0 tAAAA 0 tother 0.

Dude that is expired... RTO was it could NEVER talk to it.. All of yours is like that... Looks to me your resolver Not WORKING AT ALL!!

Do the command for some domain you talk to all the time from a client on your network asking pfsense for dns.

Look in your system widget what does it show for dns?

If you have more than loopback there - then yes its possible pfsense could ask any of those NS for dns.

KOM

I had turned off the DNS Servers dealie long ago to save on vertical space in the browser. It's showing me that my AD DCs are my DNS.

At this point, I fully admit that I have no idea what's going on or why. So even when you are using Resolver, if you include any servers in General Settings then it's going to silently forward instead?

johnpoz

NO!! Pfsense (itself) will use what you have listed in the general setup... But if a client asks resolver on pfsense running listening on port 53, then that will either resolve or forward.

But if you do not have loopback listed - then when pfsense needs to check if update, or look for packages, etc. its going to ask those name servers. When you go to the dns lookup menu... its going to ask what is set for in the general tab or gets from dhcp on your wan, etc.

Out of the box pfsense should only ask itself.. which should be the resolver in resolver mode, with dnssec enabled.

Your settings show that your not even doing dnssec.. And from what you showed... Id doubt your resolver can even talk to atleast not the NS for MS, etc.

From a client on your network do a query to pfsense lan IP... Do you get an answer?

Here is 2 example of specifically asking pfsense (resolver) for query of a fqdn

On your client when you do nslookup it comes back with your pfsense as the NS, see how mine says sg4860.local.lan - 192.168.9.253.. That is pfsense lan IP.

See when do a dig, I specifically called out my pfsense lan IP and it answered.