Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Big DNS Problems *Illustrated*

    Scheduled Pinned Locked Moved General pfSense Questions
    82 Posts 5 Posters 15.3k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • MikeV7896M
      MikeV7896
      last edited by

      You shouldn't need to add a custom option for "plex.direct" anyway... pfSense already adds one to the config file it generates by default.

      The S in IOT stands for Security

      1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator
        last edited by johnpoz

        @virgiliomi said in Big DNS Problems *Illustrated*:

        You shouldn't need to add a custom option for "plex.direct" anyway... pfSense already adds one to the config file it generates by default.

        Since when?

        There is nothing in the unbound showing that it does that - sorry but I believe your mistaken.. If you want prevent rebind issues with plex.direct you would have to put it in there yourself.

        Here this direct from the /var/unbound.conf

        # DNS Rebinding
        # For DNS Rebinding prevention
        private-address: 10.0.0.0/8
        private-address: ::ffff:a00:0/104
        private-address: 172.16.0.0/12
        private-address: ::ffff:ac10:0/108
        private-address: 169.254.0.0/16
        private-address: ::ffff:a9fe:0/112
        private-address: 192.168.0.0/16
        private-address: ::ffff:c0a8:0/112
        private-address: fd00::/8
        private-address: fe80::/10
        # Set private domains in case authoritative name server returns a Private IP address
        
        

        There is nothing there for plex.direct to turn off rebind for it - maybe you turned off rebind completely if your not having issues with plex.direct..

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.8, 24.11

        S 1 Reply Last reply Reply Quote 0
        • MikeV7896M
          MikeV7896
          last edited by

          Not sure. But I know if I go into /var/unbound/unbound.conf, there's already

          private-domain: "plex.direct"
          domain-insecure: "plex.direct" 
          

          in there. And it's well above the area where custom options from the config page go.

          The S in IOT stands for Security

          1 Reply Last reply Reply Quote 0
          • johnpozJ
            johnpoz LAYER 8 Global Moderator
            last edited by johnpoz

            Is it under this heading

            # Set private domains in case authoritative name server returns a Private IP address
            

            See my previous post edit on what is listed there.

            If you setup a domain override?

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.8, 24.11

            1 Reply Last reply Reply Quote 0
            • S
              skalyx @johnpoz
              last edited by

              So, the cause of my problems cannot be linked to this entry in custom options? I am surprised by the fact that I do not have any DNS problems since I removed it. I still need to see if it does fix it over time.
              In fact, I was restored my PFsense last day and could not activate my DNS resolver until I removed : private-domain: "plex.direct". So, it may be the cause of my problem. I do not remember why I put that and have not had any Plex issue since the time I removed the entry.

              1 Reply Last reply Reply Quote 0
              • MikeV7896M
                MikeV7896
                last edited by MikeV7896

                @johnpoz Ahh... so a domain override will put it there. That would be why then. I have one there, but it's basically to save Unbound a few steps since I was having issues with Plex resolution. Learn something new every day.

                @skalyx I kinda went off on a tangent related to that option, not realizing that something else in my setup was putting it in the unbound configuration automatically. It seems odd to me that a setting related to Plex would clear up your issue with TIDAL though.

                Apologies for the confusion.

                The S in IOT stands for Security

                S 1 Reply Last reply Reply Quote 0
                • S
                  skalyx @MikeV7896
                  last edited by

                  @virgiliomi No worries, mate! Thanks to participating in my post! I am also surprised to the fact this entry caused problems with my DNS resolver and Tidal. I do not know... I will have to check further.

                  I now have Plex issues... I am forced to put it again. I get: "Unable to connect to "HDPlex" securely."
                  I will put it once again and hope my problem is not linked to it.
                  I will update !

                  1 Reply Last reply Reply Quote 0
                  • johnpozJ
                    johnpoz LAYER 8 Global Moderator
                    last edited by johnpoz

                    Where are you overriding it to go? I don't use tidal - to honest not sure what plex is trying to do there at all..

                    Maybe chrome is doing its own sort of rebind protection? Best thing to do is sniff to see exactly what the client is asking for and what is or isn't getting returned, etc.

                    Can tell you for sure with out turning off rebind for plex.direct your going to run into issues - and prob only get indirect connections to your local plex box.

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                    1 Reply Last reply Reply Quote 0
                    • MikeV7896M
                      MikeV7896
                      last edited by MikeV7896

                      @johnpoz I'm overriding it to go to one of Plex's servers still (one of their secondary servers)... just saving Unbound a couple of resolution steps. I was running into timeout issues occasionally. I don't use TIDAL, so no idea what might be going on with that.

                      The S in IOT stands for Security

                      1 Reply Last reply Reply Quote 0
                      • johnpozJ
                        johnpoz LAYER 8 Global Moderator
                        last edited by johnpoz

                        So your overriding it to go direct to the authoritative ns for plex? Yeah that would turn off dnssec and rebind..

                        Once the domain is resolved once - the authoritatives would be cached for the life of the ttl, and would not have to resolve any more? Would just have to ask the cached NS for the domain direct, if a record TTL had expired.

                        If your having timeouts on resolving - try turning on prefetch, and even the serve 0 ttl option.. This can help if you have slow resolving for specific domains.

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                        S 1 Reply Last reply Reply Quote 0
                        • MikeV7896M
                          MikeV7896
                          last edited by

                          Already had prefetch on... will turn on Serve 0 TTL also.

                          Again, apologies to the OP for the slight tangent... what turned out to be me trying to point something out has instead helped me... hopefully your issue can be resolved too, though not sure what has been given to me is at all related to your problem.

                          The S in IOT stands for Security

                          1 Reply Last reply Reply Quote 0
                          • johnpozJ
                            johnpoz LAYER 8 Global Moderator
                            last edited by

                            So just looked and the TTL on those ns for plex.direct are quite long

                            example

                            ;; ANSWER SECTION:
                            ns-plexdirect.plex.tv.  604800  IN      A       82.94.168.7
                            
                            

                            Is your unbound restarting a lot @virgiliomi -- once that is looked up once, you should not have to resolve the NS for plex.direct again for quite some time.. 7 Days to be exact ;)

                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                            If you get confused: Listen to the Music Play
                            Please don't Chat/PM me for help, unless mod related
                            SG-4860 24.11 | Lab VMs 2.8, 24.11

                            1 Reply Last reply Reply Quote 0
                            • S
                              skalyx @johnpoz
                              last edited by

                              @johnpoz Are you talking to me John? I do not really understand your message.
                              Do you have any idea what my problem might be caused from?

                              BTW, private-domain: "plex.direct" fixed "Unable to connect to "HDPlex" securely.".

                              1 Reply Last reply Reply Quote 0
                              • MikeV7896M
                                MikeV7896
                                last edited by

                                @johnpoz Gonna PM you and we can continue chatting there so the topic can go back to the OP's issue. ☺

                                The S in IOT stands for Security

                                1 Reply Last reply Reply Quote 0
                                • johnpozJ
                                  johnpoz LAYER 8 Global Moderator
                                  last edited by johnpoz

                                  Yeah sorry @skalyx me and @virgiliomi kind of got on a bit of tangent there from your problem.

                                  So putting in plex.direct back into custom fixed your plex problem - but your still having issues with tidal? I guess I do the free trial thing and see if could duplicate your problem.

                                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                                  If you get confused: Listen to the Music Play
                                  Please don't Chat/PM me for help, unless mod related
                                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                                  S 1 Reply Last reply Reply Quote 0
                                  • S
                                    skalyx @johnpoz
                                    last edited by

                                    @johnpoz
                                    No worries!
                                    For the moment, TIDAL is working fine haha. Problems happen from time to time not constantly so I will have to see over time.

                                    1 Reply Last reply Reply Quote 0
                                    • S
                                      skalyx
                                      last edited by skalyx

                                      UPDATE: I got the problem again with known website such as cloudflare.com etc. I will try to remove plex entry again in custom option (DNS Resolver).

                                      Do you have any idea to help me out?

                                      1 Reply Last reply Reply Quote 0
                                      • johnpozJ
                                        johnpoz LAYER 8 Global Moderator
                                        last edited by

                                        that plex.direct would have zero to do with resolving something on cloudflare unless your are maybe using it as reverse proxy for your plex? And even then it should not be a problem.

                                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                                        If you get confused: Listen to the Music Play
                                        Please don't Chat/PM me for help, unless mod related
                                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                                        S 1 Reply Last reply Reply Quote 0
                                        • stephenw10S
                                          stephenw10 Netgate Administrator
                                          last edited by

                                          Yeah, this seems much more likely to be a DNS resolution issue. I would try running the resolver directly in resolving mode if you are going to have DNSSec enabled and see if the issue repeats.

                                          Steve

                                          1 Reply Last reply Reply Quote 0
                                          • S
                                            skalyx @johnpoz
                                            last edited by

                                            @johnpoz Yes, it is logical. I do not use reverse proxy.

                                            @stephenw10 Hmm. Could you please let me know how I can run the DNS resolver directly in resolving mode?

                                            Thanks,

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.