Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    DNS server not responding

    Scheduled Pinned Locked Moved General pfSense Questions
    30 Posts 6 Posters 2.4k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • kiokomanK
      kiokoman LAYER 8
      last edited by

      almost everything is here https://docs.netgate.com/pfsense/en/latest/
      if something is not clear just ask here, no prob

      ̿' ̿'\̵͇̿̿\з=(◕_◕)=ε/̵͇̿̿/'̿'̿ ̿
      Please do not use chat/PM to ask for help
      we must focus on silencing this @guest character. we must make up lies and alter the copyrights !
      Don't forget to Upvote with the 👍 button for any post you find to be helpful.

      1 Reply Last reply Reply Quote 0
      • GertjanG
        Gertjan
        last edited by

        37203ebd-cf5e-4ab9-9a70-0c121c08cbf5-image.png

        I advise to change UDP for "TCP & UDP" ;)

        No "help me" PM's please. Use the forum, the community will thank you.
        Edit : and where are the logs ??

        1 Reply Last reply Reply Quote 0
        • Y
          yodar44 @kiokoman
          last edited by

          @kiokoman
          it looks like i spoke too soon. most sites seem to be working, but not all. some that i haven't been to for a while say: Firefox can’t establish a connection to the server at www... etc. this only happens on the computer on the OPT port.
          [ i did try Gertjans TCP/UDP suggestion too. no help]
          this still seems to be a DNS problem. any suggestions?

          GertjanG 1 Reply Last reply Reply Quote 0
          • GertjanG
            Gertjan @yodar44
            last edited by

            @yodar44 said in DNS server not responding:

            any suggestions?

            Always ;)

            @yodar44 said in DNS server not responding:

            seems to be a DNS problem

            Normally, you can't stay in the "seem" state. Why would you ?
            When your browser can't connect to 'some. site', you fire up a command prompt, type nslookup + enter and then

            some.site
            

            and enter.
            It resolves : no DNS issue.
            It didn't resolve : DNS issue.

            Example :

            3eac6de6-6326-4e10-9f41-3ffdbb0d019f-image.png

            thus www.google.com resolves (for me) to two IP's, and IPv4 and IPv6.

            As @kiokoman already mentioned above, did you open TCP 80 and TCP 443 ?
            If not, your browser will not be able to connect to the outside world, because you did not gave him the possibility to do so.

            During testing, why not open everything on your OPT1 interface with an identical rule as you found on the LAN interface : you'll be sure outgoing connection will succeed, including FTP, SSH, all the mail connections, NTP, etc etc. When this works, you can decide to fine-grain your firewall rules.

            Example (this is my OpenVPN interface - but is also valid for your OPT1 interface )

            4bdc24b0-c210-445e-a970-af7a180d729c-image.png

            Also : because posting images is so easy on this forum - post your OPT1 firewall rules.

            No "help me" PM's please. Use the forum, the community will thank you.
            Edit : and where are the logs ??

            1 Reply Last reply Reply Quote 0
            • Y
              yodar44
              last edited by

              Screen Shot 10-29-19 at 11.43 AM.JPG

              Screen Shot 10-29-19 at 11.57 AM.JPG

              1 Reply Last reply Reply Quote 0
              • GertjanG
                Gertjan
                last edited by Gertjan

                This second rule

                08c05935-4b7b-4851-ad97-971484485ced-image.png

                should have been :

                0ad334c1-61f5-455e-96e2-66ec74cff968-image.png

                You're saved by the fact that the first rule is a "TCP pass all" (so TCP DNS requests to port 53 are handled by this rule).

                Again, I advise you to put a pass all rule on the fifth position ( IPv4 TCP and UDP ).

                Btw : did you change any of the DNS Resolver settings ?

                No "help me" PM's please. Use the forum, the community will thank you.
                Edit : and where are the logs ??

                1 Reply Last reply Reply Quote 0
                • johnpozJ
                  johnpoz LAYER 8 Global Moderator
                  last edited by johnpoz

                  Can tell there is something wrong..

                  See where when you do nslookup it comes back unknown for your dns..

                  That is not how it should look..

                  $ nslookup
                  Default Server:  sg4860.local.lan
                  Address:  192.168.9.253
                  
                  

                  This should come back with your pfsense fqdn.. If you can talk to pfsense for dns, dns is actually running on pfsense.. pfsense has to do no lookup at all for that to work.. So this would be basic sanity check.. If that does not come back with pfsnse name.. Then you have connectivity problem, unbound/dnsmasq/bind is not running on pfsense (whatever you are using).. Or there is some wrong with it for sure.

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                  GertjanG 1 Reply Last reply Reply Quote 0
                  • GertjanG
                    Gertjan @johnpoz
                    last edited by

                    @johnpoz said in DNS server not responding:

                    some wrong

                    For sure.
                    Like Resolver (unbound) using ACL - and nothing has been setup for OPT1.
                    Or its forwarding and that setup is faulty.
                    Or .... what ever.
                    It's time @yodar44 starts communicating a bit better as it's DNS ^^

                    No "help me" PM's please. Use the forum, the community will thank you.
                    Edit : and where are the logs ??

                    1 Reply Last reply Reply Quote 0
                    • johnpozJ
                      johnpoz LAYER 8 Global Moderator
                      last edited by

                      @Gertjan said in DNS server not responding:

                      Or its forwarding and that setup is faulty.

                      Even even forwarding and not working, the name of pfsense should come back when the dns client does the ptr for it.

                      Your ACL suggestion possible yeah.

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                      Y 1 Reply Last reply Reply Quote 0
                      • Y
                        yodar44 @johnpoz
                        last edited by

                        @johnpoz Screen Shot 10-30-19 at 10.08 AM 001.JPG Screen Shot 10-30-19 at 10.08 AM.JPG
                        i'm attaching screen shots of DNS resolver settings. do you see any thing wrong? i didn't change anything. it is same as it came.

                        1 Reply Last reply Reply Quote 0
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator
                          last edited by

                          what about your acl tab? Did you turn off the auto acl, or did you create your own? But if your acl were not allowing then you wouldn't ever get any answers.

                          You sure its just not restarting a lot.. Are you running pfblocker, are you doing any attempted dns redirect..

                          Here is the thing.. When put in the nslookup cmd and you don't get back the name of the dns your pointing to - this is telling you have a problem at basic level, and not just having issues resolving stuff.

                          Type just nslookup at the cmd line... You should see a name for your pfsense, like you in mine.

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                          Y 1 Reply Last reply Reply Quote 0
                          • Y
                            yodar44 @johnpoz
                            last edited by

                            @johnpoz
                            the acl tab is blank:
                            ServicesDNS ResolverAccess Lists
                            General Settings
                            Advanced Settings
                            Access Lists
                            Access Lists to Control Access to the DNS Resolver

                            i don't know what pfblocker is.
                            i didn't intentionally do any dns redirect.
                            my nslookup:
                            C:\WINDOWS\system32>nslookup
                            Default Server: UnKnown
                            Address: 2001:558:feed::1

                            how do i set what DNS i am pointing to?

                            GertjanG 1 Reply Last reply Reply Quote 0
                            • GertjanG
                              Gertjan @yodar44
                              last edited by Gertjan

                              @yodar44 said in DNS server not responding:

                              how do i set what DNS i am pointing to?

                              You said it yourself : your fist post :

                              @yodar44 said in DNS server not responding:

                              DNS Servers . . . . . . . . . . . : 10.100.1.1

                              and just above :

                              @yodar44 said in DNS server not responding:

                              Address: 2001:558:feed::1

                              which is ok for me .... I see the same "IPv6" address :
                              5b3beecc-3a09-4a66-b264-9ff308a47d99-image.png

                              Your OPT1 interface and for that matter pfSense is handling / has been set up to handle IPv6 ?
                              edit : use

                              ipconfig /all
                              

                              to see all the network details of your PC.

                              No "help me" PM's please. Use the forum, the community will thank you.
                              Edit : and where are the logs ??

                              1 Reply Last reply Reply Quote 0
                              • johnpozJ
                                johnpoz LAYER 8 Global Moderator
                                last edited by

                                @yodar44 said in DNS server not responding:

                                how do i set what DNS i am pointing to?

                                Via your dhcp.. Or directly on your client... What your pointing to there is a IPv6 address for Xfiniity dns..

                                And that should resolve to
                                cdns01.comcast.net.

                                ;; QUESTION SECTION:
                                ;1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.d.e.e.f.8.5.5.0.1.0.0.2.ip6.arpa. IN PTR
                                
                                ;; ANSWER SECTION:
                                1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.d.e.e.f.8.5.5.0.1.0.0.2.ip6.arpa. 7172 IN PTR cdns01.comcast.net.
                                

                                An intelligent man is sometimes forced to be drunk to spend time with his fools
                                If you get confused: Listen to the Music Play
                                Please don't Chat/PM me for help, unless mod related
                                SG-4860 24.11 | Lab VMs 2.8, 24.11

                                Y 1 Reply Last reply Reply Quote 0
                                • Y
                                  yodar44 @johnpoz
                                  last edited by

                                  @johnpoz
                                  this is my ipconfig/all
                                  Ethernet adapter Ethernet:

                                  Connection-specific DNS Suffix . : localdomain
                                  Description . . . . . . . . . . . : Realtek PCIe GBE Family Controller
                                  Physical Address. . . . . . . . . : DC-FE-07-0A-71-0B
                                  DHCP Enabled. . . . . . . . . . . : Yes
                                  Autoconfiguration Enabled . . . . : Yes
                                  IPv6 Address. . . . . . . . . . . : 2601:246:5680:ae30::bea3(Preferred)
                                  Lease Obtained. . . . . . . . . . : Wednesday, October 30, 2019 2:36:37 AM
                                  Lease Expires . . . . . . . . . . : Wednesday, November 6, 2019 2:36:37 AM
                                  Link-local IPv6 Address . . . . . : fe80::d9dd:4d34:3b6a:5c85%22(Preferred)
                                  IPv4 Address. . . . . . . . . . . : 10.100.1.3(Preferred)
                                  Subnet Mask . . . . . . . . . . . : 255.255.255.0
                                  Lease Obtained. . . . . . . . . . : Monday, October 28, 2019 4:16:13 PM
                                  Lease Expires . . . . . . . . . . : Wednesday, October 30, 2019 1:06:38 PM
                                  Default Gateway . . . . . . . . . : 10.100.1.1
                                  DHCP Server . . . . . . . . . . . : 10.100.1.1
                                  DHCPv6 IAID . . . . . . . . . . . : 383581703
                                  DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-1E-26-DC-F7-DC-FE-07-0A-71-0B
                                  DNS Servers . . . . . . . . . . . : 2001:558:feed::1
                                  2001:558:feed::2
                                  10.100.1.1
                                  2001:558:feed::1
                                  2001:558:feed::2
                                  NetBIOS over Tcpip. . . . . . . . : Enabled

                                  the only difference between the LAN and OPT is the .1 on OPT vs .10 on LAN
                                  ServicesDHCP ServerOPT: Range 10.100.1.1 From, 10.100.1.254 To
                                  ServicesDHCP ServerLAN: Range 192.168.1.10 From, 192.168.1.245 To

                                  is that significant?

                                  1 Reply Last reply Reply Quote 0
                                  • johnpozJ
                                    johnpoz LAYER 8 Global Moderator
                                    last edited by

                                    Well your client there has an IPv6 address... So yeah it perfers IPv6... Which in your setup is pretty hosed since now your asking comcast dns vs your own local dns..

                                    I would suggest you disable IPv6 until such time that you can even get IPv4 working.

                                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                                    If you get confused: Listen to the Music Play
                                    Please don't Chat/PM me for help, unless mod related
                                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                                    Y 1 Reply Last reply Reply Quote 0
                                    • Y
                                      yodar44 @johnpoz
                                      last edited by

                                      @johnpoz
                                      how do i disable ipv6?

                                      1 Reply Last reply Reply Quote 0
                                      • johnpozJ
                                        johnpoz LAYER 8 Global Moderator
                                        last edited by

                                        The easy way on windows, from an elevated cmd prompt

                                        reg add hklm\system\currentcontrolset\services\tcpip6\parameters /v DisabledComponents /t REG_DWORD /d 255
                                        

                                        Reboot

                                        To put it back exactly how it was before

                                        reg delete hklm\system\currentcontrolset\services\tcpip6\parameters\ /v DisabledComponents /f
                                        

                                        reboot.

                                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                                        If you get confused: Listen to the Music Play
                                        Please don't Chat/PM me for help, unless mod related
                                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                                        Y 1 Reply Last reply Reply Quote 0
                                        • Y
                                          yodar44 @johnpoz
                                          last edited by

                                          @johnpoz
                                          ok, now ipconfig/all says
                                          Ethernet adapter Ethernet:

                                          Connection-specific DNS Suffix . : localdomain
                                          Description . . . . . . . . . . . : Realtek PCIe GBE Family Controller
                                          Physical Address. . . . . . . . . : DC-FE-07-0A-71-0B
                                          DHCP Enabled. . . . . . . . . . . : Yes
                                          Autoconfiguration Enabled . . . . : Yes
                                          IPv4 Address. . . . . . . . . . . : 10.100.1.3(Preferred)
                                          Subnet Mask . . . . . . . . . . . : 255.255.255.0
                                          Lease Obtained. . . . . . . . . . : Wednesday, October 30, 2019 2:24:19 PM
                                          Lease Expires . . . . . . . . . . : Wednesday, October 30, 2019 4:06:34 PM
                                          Default Gateway . . . . . . . . . : 10.100.1.1
                                          DHCP Server . . . . . . . . . . . : 10.100.1.1
                                          DNS Servers . . . . . . . . . . . : 10.100.1.1
                                          NetBIOS over Tcpip. . . . . . . . : Enabled

                                          but nslookup still says
                                          C:\WINDOWS\system32>nslookup
                                          DNS request timed out.
                                          timeout was 2 seconds.
                                          Default Server: UnKnown
                                          Address: 10.100.1.1

                                          so it seems that something in the pfsense settings is causing the problem. ??

                                          1 Reply Last reply Reply Quote 0
                                          • johnpozJ
                                            johnpoz LAYER 8 Global Moderator
                                            last edited by

                                            There is nothing in the settings you showed that is odd.. Is it running?

                                            Do you even have connectivity to pfsense? Why is your dhcp lease so short? And such an time?

                                            Up the logging level in the unbound/advanced to atleast 3... And enable logging of queries..

                                            In your options box at the bottom of unbound

                                            server:
                                            log-queries: yes
                                            log-replies: yes
                                            

                                            And then we can see what is going on... I don't even think your talking to the pfsense Because your getting timeouts.. So unbound is not running, or you can not talk to it... You have no rules in the floating tab?

                                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                                            If you get confused: Listen to the Music Play
                                            Please don't Chat/PM me for help, unless mod related
                                            SG-4860 24.11 | Lab VMs 2.8, 24.11

                                            Y 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.