Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    WPAD for two networks

    Scheduled Pinned Locked Moved DHCP and DNS
    22 Posts 3 Posters 1.7k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • johnpozJ
      johnpoz LAYER 8 Global Moderator
      last edited by

      Unless your name is like your own actual name ;) Or a public one - I see no reason to obfuscate it.. I use local.lan for example.. Tells you zero about me, where I am at, etc. etc. So no reason to hide it.. And it for sure is not a public one you could look up..

      Yeah the unbound adding views can come in very handy, wish they would put support for them into the gui, like they have in the bind package.. But its prob very small user base that would or could or needs to use them.. Anyone that does can just do it in the options box fairly simply..

      I have no need of them to be honest, but happy to help someone else that finds a use for them. Guess they could be useful for someone that wants pfsense own Ip to resolve to the IP from that segment vs just the lan IP.. I just use sub domains, ie my dmz is dmz.local.lan and wlan.local.lan which do resolve to that networks IP..

      There have been questions on how to do that in the past - next time I see one asking that question maybe I will put together a little example..

      Have fun... Any other questions just ask, here to help.

      An intelligent man is sometimes forced to be drunk to spend time with his fools
      If you get confused: Listen to the Music Play
      Please don't Chat/PM me for help, unless mod related
      SG-4860 24.11 | Lab VMs 2.8, 24.11

      4 1 Reply Last reply Reply Quote 0
      • 4
        4o4rh @johnpoz
        last edited by

        @johnpoz hi john, below is the final custom config that i used.
        i had to add a local zone, because the only way i can get dns working is with unbound forwarding.

        i limit the outgoing interface to VPNs and openvpn is unable to resolve the server names unless i use forwarding.
        The default route is also to the VPNs, but i have a static route to the WAN for vpnbypass hosts.
        They use the DNS assigned to the wan.

        Ideally, i want openvpn to resolve the host names over the WAN, but the client network to use the DNS on pfsense which goes over the VPN.

        Any thoughts?

        server:
        private-domain: "plex.direct"
        private-domain: "my.lan"
        local-zone: "my.lan." static
        local-data: "my.lan. 10800 IN NS localhost."
        local-data: "my.lan. 10800 IN SOA pfsense. root. 1 3600 1200 604800 10800"
        local-data: "my.lan. 10800 IN A 192.168.2.1"
        local-data: "my.lan. 10800 IN A 192.168.3.1"
        
        local-zone: "use-application-dns.net" static
        access-control-view: 192.168.3.0/24 wpadview
        view:
        view-first: yes
        name: "wpadview"
        local-data: "wpad.my.lan. 90 IN A 192.168.3.1"
        
        include: /var/unbound/pfb_dnsbl.*conf
        
        1 Reply Last reply Reply Quote 0
        • johnpozJ
          johnpoz LAYER 8 Global Moderator
          last edited by

          So you run plex? And your also wanting to block firefox from using doh ;)

          i want openvpn to resolve the host names over the WAN,

          What host names? Some upstream NS of yours?

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.8, 24.11

          4 1 Reply Last reply Reply Quote 0
          • 4
            4o4rh @johnpoz
            last edited by 4o4rh

            @johnpoz i have plex on my nas for internal access only. the directive is there to fix an error that plex gives if it is not there. found it on the plex forum and it worked for me.

            basically have three LANs, 1) media i.e. tv, kodia, playstation, etc. 2) VOIP 3) internal devices.

            the voip and i.e. this forum go direct over the wan, but everything else goes over the vpn.
            trying to use quid for kid friendly filtering, but squid goes over the default gateway.
            That's why i had to switch the default gateway to the vpn pool.

            for the voip (to ensure continuous service), i put the dns defined for the wan on the dhcp dns so it bypasses unbound

            now because i have defined the outgoing interfaces as the vpn for unbound,
            my challenge is openvpn doesn't resolve the host names.

            The only way i can get it to work, is to put unbound in forwarding mode.
            I am probably doing someone wrong in principle right?
            everything was good with the wan as default, and the vpn blocked via rules when down,
            but it all changed when i introduced squid to the mix

            1 Reply Last reply Reply Quote 0
            • johnpozJ
              johnpoz LAYER 8 Global Moderator
              last edited by

              If unbound is not resolving using the vpn, then its the vpn as an issue, or sure some NS might block them I guess.. I would validate your queries are going out the vpn.

              There should be no reason your vpn to prevent you from doing normal vpn queries down the tunnel.. Unless they only want you to use their NS..

              Most vpn services are nothing more than data mining services anyway ;)

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.8, 24.11

              4 1 Reply Last reply Reply Quote 0
              • 4
                4o4rh @johnpoz
                last edited by

                @johnpoz you miss understand.

                the vpn client - server = myvpn.com

                when pfsense starts, the vpn is not established, so unbound can't resolve myvpn.com therefore the vpn never gets established. If i set unbound to forwarding, openvpn is able to resolve myvpn.com, establish the connection and then the queries go over the vpn.

                1 Reply Last reply Reply Quote 0
                • johnpozJ
                  johnpoz LAYER 8 Global Moderator
                  last edited by

                  You would setup pfsense vpn client to use IP to connect too..

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                  4 1 Reply Last reply Reply Quote 0
                  • 4
                    4o4rh @johnpoz
                    last edited by

                    @johnpoz housten, i have a problem.

                    if i use just thing in the custom config,

                    the pfsense box can resolve local, and internet, however,
                    the clients can only resolve local and not internet.
                    I was thrown off a little because web browsing worked via squid which could resolve on pfsense,
                    but direct nslookups from clients, etc stop working.
                    if i comment the below out, then of course everything is working except wpad on the 2nd network.

                    server:
                    local-zone: "use-application-dns.net" static
                    access-control-view: 192.168.3.0/24 wpadview
                    view:
                    view-first: yes
                    name: "wpadview"
                    local-data: "wpad.my.lan. 90 IN A 192.168.3.1"
                    
                    1 Reply Last reply Reply Quote 0
                    • johnpozJ
                      johnpoz LAYER 8 Global Moderator
                      last edited by johnpoz

                      Those settings would have no effect on what a client can normally resolve outside your view..

                      I can not duplicate your issue here..

                      So here are my settings

                      server:
                      private-domain: "plex.direct"
                      local-zone: "use-application-dns.net" static
                      access-control-view: 192.168.3.0/24 wpadview
                      view:
                      view-first: yes
                      name: "wpadview"
                      local-data: "wpad.my.lan. 90 IN A 192.168.3.1"
                      

                      I have set a different host override for my 9.0/24 lan

                      ; <<>> DiG 9.14.4 <<>> @192.168.9.253 wpad.my.lan
                      ; (1 server found)
                      ;; global options: +cmd
                      ;; Got answer:
                      ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 47783
                      ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
                      
                      ;; OPT PSEUDOSECTION:
                      ; EDNS: version: 0, flags:; udp: 4096
                      ;; QUESTION SECTION:
                      ;wpad.my.lan.                   IN      A
                      
                      ;; ANSWER SECTION:
                      wpad.my.lan.            3600    IN      A       192.168.9.42
                      
                      ;; Query time: 1 msec
                      ;; SERVER: 192.168.9.253#53(192.168.9.253)
                      ;; WHEN: Sat Sep 14 11:14:22 Central Daylight Time 2019
                      ;; MSG SIZE  rcvd: 56
                      

                      Then when I query from my 3 network

                      ; <<>> DiG 9.10.3-P4-Raspbian <<>> @192.168.3.253 wpad.my.lan
                      ; (1 server found)
                      ;; global options: +cmd
                      ;; Got answer:
                      ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 43959
                      ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
                      
                      ;; OPT PSEUDOSECTION:
                      ; EDNS: version: 0, flags:; udp: 4096
                      ;; QUESTION SECTION:
                      ;wpad.my.lan.                   IN      A
                      
                      ;; ANSWER SECTION:
                      wpad.my.lan.            90      IN      A       192.168.3.1
                      
                      ;; Query time: 0 msec
                      ;; SERVER: 192.168.3.253#53(192.168.3.253)
                      ;; WHEN: Sat Sep 14 11:15:34 CDT 2019
                      ;; MSG SIZE  rcvd: 56
                      

                      And it can query outside stuff just fine as well

                      ; <<>> DiG 9.10.3-P4-Raspbian <<>> @192.168.3.253 www.google.com
                      ; (1 server found)
                      ;; global options: +cmd
                      ;; Got answer:
                      ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 23600
                      ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
                      
                      ;; OPT PSEUDOSECTION:
                      ; EDNS: version: 0, flags:; udp: 4096
                      ;; QUESTION SECTION:
                      ;www.google.com.                        IN      A
                      
                      ;; ANSWER SECTION:
                      www.google.com.         3536    IN      A       172.217.4.36
                      
                      ;; Query time: 0 msec
                      ;; SERVER: 192.168.3.253#53(192.168.3.253)
                      ;; WHEN: Sat Sep 14 11:17:13 CDT 2019
                      ;; MSG SIZE  rcvd: 59
                      

                      And it breaks out of the view just fine as well for other stuff in the same local zone

                      ; <<>> DiG 9.10.3-P4-Raspbian <<>> @192.168.3.253 test.my.lan
                      ; (1 server found)
                      ;; global options: +cmd
                      ;; Got answer:
                      ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 36212
                      ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
                      
                      ;; OPT PSEUDOSECTION:
                      ; EDNS: version: 0, flags:; udp: 4096
                      ;; QUESTION SECTION:
                      ;test.my.lan.                   IN      A
                      
                      ;; ANSWER SECTION:
                      test.my.lan.            3600    IN      A       1.2.3.4
                      
                      ;; Query time: 0 msec
                      ;; SERVER: 192.168.3.253#53(192.168.3.253)
                      ;; WHEN: Sat Sep 14 11:23:19 CDT 2019
                      ;; MSG SIZE  rcvd: 56
                      

                      edit: BTW you understand that
                      local-zone: "use-application-dns.net" static

                      has nothing to do with this right, that is related to stopping firefox from using doh, when they make it default..

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                      1 Reply Last reply Reply Quote 0
                      • 4
                        4o4rh
                        last edited by

                        not sure why my results are different to you with the dig, i keep getting the primary address, but if i physically connect the the 2nd network, wpad resolves to the correct address.

                        the only issue is seem to have now is,
                        if i dig to a local host with FQDN i receive an the correct IN record.
                        if i dig to a local host without domain i receive the IN record as root-servers

                        shouldn't hostname by itself resolve from the DHCP list? is there a way to make that happen?

                        1 Reply Last reply Reply Quote 0
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator
                          last edited by johnpoz

                          @gwaitsi said in WPAD for two networks:

                          but if i physically connect the the 2nd network, wpad resolves to the correct address.

                          You have to be on that network as source to get the view.. How else did you think it worked?

                          Those queries are from different source boxes..

                          My main network is 192.168.9, my other network is 192.168.3

                          Those queries were done from box at 192.168.9.100, and linux box at 192.168.3.32 as source

                          I wasn't just changing the IP I did the query too... If you didn't understand that - they you don't understand what a view it ;)

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                          4 1 Reply Last reply Reply Quote 0
                          • 4
                            4o4rh @johnpoz
                            last edited by 4o4rh

                            @johnpoz Hi Johnno, how can you add an extra view again (for vlan) please.

                            server:
                            local-zone: "use-application-dns.net" static
                            access-control-view: 192.168.3.0/24 wpadview
                            view:
                            view-first: yes
                            name: "wpadview"
                            local-data: "wpad.my.lan. 90 IN A 192.168.3.1"

                            if i try to change the zone name or view name it gives me a syntax error

                            server:
                            local-zone: "use-application-dns.net" static
                            access-control-view: 192.168.4.0/24 wpadview
                            view:
                            view-first: yes
                            name: "wpadview"
                            local-data: "wpad.my.lan. 90 IN A 192.168.4.1"

                            1 Reply Last reply Reply Quote 0
                            • johnpozJ
                              johnpoz LAYER 8 Global Moderator
                              last edited by johnpoz

                              What are you trying to do, add another view? Plus keep that one?

                              You can not have the same name for view.. And you only need the one server: and you don't need that use-applictaion-dns.net that has nothing to do with the view.. That is so firefox wont use doh when they turn it on..

                              here.. This is 2 different views

                              server:
                              private-domain: "plex.direct"
                              local-zone: "use-application-dns.net" static
                              access-control-view: 192.168.3.0/24 wpadview
                              access-control-view: 192.168.2.0/24 newview
                              view:
                              view-first: yes
                              name: "wpadview"
                              local-data: "wpad.my.lan. 90 IN A 192.168.3.1"
                              view:
                              view-first: yes
                              name: "newview"
                              local-data: "wpad.my.lan. 90 IN A 192.168.2.1"
                              

                              The private-domain and use-application are NOT part of it, those are just in my custom..

                              from box on my 192.168.3 network

                              ; <<>> DiG 9.10.3-P4-Raspbian <<>> @192.168.3.253 wpad.my.lan
                              ; (1 server found)
                              ;; global options: +cmd
                              ;; Got answer:
                              ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 60098
                              ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
                              
                              ;; OPT PSEUDOSECTION:
                              ; EDNS: version: 0, flags:; udp: 4096
                              ;; QUESTION SECTION:
                              ;wpad.my.lan.                   IN      A
                              
                              ;; ANSWER SECTION:
                              wpad.my.lan.            90      IN      A       192.168.3.1
                              
                              ;; Query time: 0 msec
                              ;; SERVER: 192.168.3.253#53(192.168.3.253)
                              ;; WHEN: Sat Sep 28 06:04:44 CDT 2019
                              ;; MSG SIZE  rcvd: 56
                              

                              From box on my 192.168.2.0/24 network

                              ; <<>> DiG 9.10.3-P4-Ubuntu <<>> @192.168.2.253 wpad.my.lan
                              ; (1 server found)
                              ;; global options: +cmd
                              ;; Got answer:
                              ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 23959
                              ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
                              
                              ;; OPT PSEUDOSECTION:
                              ; EDNS: version: 0, flags:; udp: 4096
                              ;; QUESTION SECTION:
                              ;wpad.my.lan.                   IN      A
                              
                              ;; ANSWER SECTION:
                              wpad.my.lan.            90      IN      A       192.168.2.1
                              
                              ;; Query time: 0 msec
                              ;; SERVER: 192.168.2.253#53(192.168.2.253)
                              ;; WHEN: Sat Sep 28 06:04:08 CDT 2019
                              ;; MSG SIZE  rcvd: 56
                              

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.8, 24.11

                              4 1 Reply Last reply Reply Quote 0
                              • 4
                                4o4rh @johnpoz
                                last edited by

                                @johnpoz said in WPAD for two networks:

                                cool, i was wildly off course. thanks for that. need to provide the views for separate vlans.

                                1 Reply Last reply Reply Quote 0
                                • First post
                                  Last post
                                Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.