DNS Lookups failing

Gertjan

I didn't do a lot of research - reading the OpenDNS doc, but right now I'm not sure if OpenDNS supports "DNS over TLS".
See here : last message https://support.opendns.com/hc/en-us/community/posts/115019265903-DNS-over-TLS.
So be careful about TLS here.

I just threw in

and activated Unbound's Forwarding mode, like this :

The rest was Ok direct :

Note : I did not test with TLS !! Just plain DNS forwarding.

It took me 30 seconds to set it up ....

Btw : Of course, I have a OpenDNS account setup correctly, and running - They have my WAN IP, so they will accept my DNS, and answer.

This morning I tested Google "gimeyourdata!!" DNS servers, worked also just fine.

It's time you tell use what you did wrong, so we can tell you what you did wrong.
This ought to work.

edit
@pmrozik said in DNS Lookups failing:

well as with the repository itself:

Oh, even pfSense itself has no DNS any more.

That's normal : as soon a people start typing 8.8.8.8 they have this right afterwards :

Google should use another IPv4 like 6.6.6.6, it's far more appropriate.
.... Hummm : I do understand know the 8.8.4.4 ...

pmrozik

@johnpoz

After reading your post I turned on dnsmasq with these the following settings:

Still not resolving:

I then turned off the forwarder and tried unbound with the following settings:

Still broken.

@Gertjan I think that it was perhaps being used as a toaster? NextGen Toaster with an IP address?

johnpoz

So can you directly query these other ns with say dig or nslookup? What does the LOG say when you ask pfsense something..

Maybe your isp only allows access to 8.8.8.8

Do a simple query from a client to 8.8.4.4

$ dig @8.8.4.4 www.google.com                                                   
                                                                                
; <<>> DiG 9.14.2 <<>> @8.8.4.4 www.google.com                                  
; (1 server found)                                                              
;; global options: +cmd                                                         
;; Got answer:                                                                  
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 64095                       
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1            
                                                                                
;; OPT PSEUDOSECTION:                                                           
; EDNS: version: 0, flags:; udp: 512                                            
;; QUESTION SECTION:                                                            
;www.google.com.                        IN      A                               
                                                                                
;; ANSWER SECTION:                                                              
www.google.com.         237     IN      A       172.217.9.68                    
                                                                                
;; Query time: 14 msec                                                          
;; SERVER: 8.8.4.4#53(8.8.4.4)                                                  
;; WHEN: Wed Jun 05 05:42:48 Central Daylight Time 2019                         
;; MSG SIZE  rcvd: 59

Gertjan

Just to motivate you :

Using a fresh install, adding 8.8.8.8 and 8.8.4.4 and activate Forwarding in the Resolver (or use the Forwarder) works direct.
Same thing for OpenDNS - but you need an account, otherwise they will refuse DNS requests coming from you.

I can't tell you from here how you managed to 'break' things ...

Btw : asking for DNSSEC and forwarding .... that's probably a no-go and makes no sense.
Compare your unbound settings with my unbound settings.

johnpoz

@Gertjan said in DNS Lookups failing:

Btw : asking for DNSSEC and forwarding .

Yeah while its borked to do that.. It wouldn't stop the queries.. It just is pointless and doesn't get you anything at all..

For dnssec to work, you either resolve yourself... Or you forward to a resolver doing it, and if that is the case no reason to ask for it.. It going to do it for you either way..

Using forwarder, and asking for dnssec is just pointless, extra dns traffic for no reason.

bcruze

who is the ISP. and is there network equipment in front of the pfsense router?

Gertjan

@bcruze said in DNS Lookups failing:

who is the ISP. and is there network equipment in front of the pfsense router?

Like a router upstream that accepts only DNS requests with it's LAN IP as destination, and no one else ? Yeah, might be possible - there are people doing the same thing with pfSEnse.

But I guess @pmrozik administers this upstream router device as well - so, ... he would (should !?) know that.
IF an up stream router exists ...

johnpoz

The first thing I would do is validate he can actually query 8.8.4.4 or not.. This is simple enough to do via dig or nslookup from any client..

If does not get an answer - then sniff on pfsense wan and validate the query did go upstream with his public IP as source, and no answer came back, etc.

Gertjan

I just did that :

dig @8.8.4.4 test-domaine.fr ANY +short

The answer came back .... and was not short.
8.8.4.4 is in business today, that's for sure.

johnpoz

Any is deprecated and really shouldn't be used any more. Many a site will not respond when asked for that.

But yeah I would think something really major would have to be going on for them not to be working.. Its an anycast address so even if one region of the world was down you should get an answer from another location, etc.

We really need some useful info from the OP if he wants our help.