Odd Hostname Resolution

M42Orion

Just got Pfsense running yesterday and all my devices are recognized on the network. This network includes two Roku devices. I also have two network 8-port switches named Switch1 and Switch2 accordingly. They have static address of 192.168.1.7 and 192.168.1.8.

When viewing the ARP table both Roku devices appear in the hostname column but the network switches are also resolved as Roku devices in the hostname column. Why would Pfsense call these network switches Roku? Other hostnames on the network are appearing normally in ARP table for the relative IP address.

Thanks.

johnpoz

What switches do you have exactly?

What are the mac address for their IPs..

IPs resolve to a name via dns. So if your dns says roku.domain.tld for that IP.. Or that is the hostname that client reported in the dhcp lease.. Maybe you have old leases for those IPs from you roku devices?

M42Orion

The switches are Netgear GS108T managed switches and their MAC addresses are correct for the IPs listed. Likewise the two Roku devices MACs are correct and different from the network switches. So for now I have four Roku devices listed in my ARP table instead of two. All the leases were recently renewed but no difference in fixing the hostname disparity.

I did experiment in the DNS Resolver service and in the Host Override section set 192.168.1.7 with Host=Switch1 but it is still being called Roku. So my limited experience with Pfsense at this stage is not helping.

Also ran DNS Lookup and had it look up Switch1 which resolved to correct IP address of 192.168.1.7 Record Type=A. Switch2 could not be resolved for 192.168.1.8. ARP table still reports them both as Roku.

Both Roku devices are listed as 192.168.1.5 and 192.168.1.9. But DNS Lookup only shows the one at 192.168.1.9 and not the second one even though both are listed in ARP Table.

The Roku devices are connected to wirelessly to my Access Point which is also connected via ethernet to one of the switch ports.

Thanks for your reply.

johnpoz

So you did a PTR query, ie

dig -x

you can not lookup IP directly really a PTR query.

So you have your wireless AP using the mac for all devices behind it.. So yeah that is going to cause you weirdness for sure.

Here are my rokus, how they look in the arp table and why they show up that was is that is what is returned via PTR query, ie the reverse..

They are both wireless, and notice they have different macs - do you have multiple IPs for the same mac address for anything?

M42Orion

Hi John,

I am trying to grasp what you have been showing in this post. All my Macs only match their respective IP addresses, so there are no dupes. This is what the ARP table is showing currently for the Rokus and switches:

LAN 192.168.1.9 88a9:2b:3e:e9 Roku Expires in 1192 seconds ethernet
LAN 192.168.1.8 38:94:ed:26:33:d6 Roku Expires in 789 seconds ethernet
LAN 192.168.1.5 88a9:28:13:31 Roku Expires in 1200 seconds ethernet
LAN 192.168.1.7 44:94:fc:9b:50:76 Roku Expires in 744 seconds ethernet

192.168.1.7 and 192.168.1.8 should be Switch1 and Switch2.

Had no luck running the dig -x command. Not familiar with it. Did try it in the Windows command window but was no recognized.

The flag symbols are covering over de for whatever reason on here.

johnpoz

Dig would be have to be added to windows, its a part of the bind package from isc..

but you can do the query with nslookup like this.

$ nslookup
Default Server:  pi-hole.local.lan
Address:  192.168.3.10

> set querytype=PTR
> 99.7.168.192.in-addr.arpa
Server:  pi-hole.local.lan
Address:  192.168.3.10

Non-authoritative answer:
99.7.168.192.in-addr.arpa       name = Roku-Kitchen.local.lan

Those are not coming back fqdn, so not sure exactly where its getting that.. But just setup a host override for your IPs that you would like them to resolve too.. I take it these Ips are reservations? If so just load static reservations in unbound.

M42Orion

In the DNS Resolver these are the Host Overides I current have set:

Switch1 localdomain 192.168.1.7
Switch2 localdomain 192.168.1.8

Originally when the Netgear AP was attached to a Netgear router those addresses were reserved. I have not done that yet in this new Pfsense box I built. I assumed that Host Overrides would be similar to Address reservations.

Sorry I am not finding "Unbound"

johnpoz

host overrides have nothing to do with the addresses that might be reserved in dhcp... they are just dns entries.

Do they work..

You query switch1.localdomain and it returns, then it would return that for PTR..

example..

I just made aaswitch1 so it would be top of my list for easy screenshot of host override.

But without a valid ptr where pfsense looks for dns, no its not going to return the host name you want to return for that IP.

johnpoz

@M42Orion said in Odd Hostname Resolution:

Sorry I am not finding "Unbound"

So your using the forwarder and not default unbound? To use dns forwarder (dnsmasq) in pfsense you would have to disable unbound (resolver)... If you put your host overrides in forwarder, they would not work unless you enabled forwarder and disable resolver (unbound).

Which one are are you using?

Unbound is the resolver, and is what pfsense uses out of the box!

M42Orion

Well I did try DNS forwarder but it did not make any difference, so I unchecked Enabled. Had to assign it Port 54 because of a conflict msg. I did not have "Strict binding" checked at the time. Host override for Switch1 was set below it. I see no "unbound" choice on the forwarder page.

M42Orion

Ok, I have DNS Resolver disabled and DNS Forwarder Enabled and this is what I just got which is at least an improvement but no hostname.

LAN 192.168.1.7 44:94:fc:9b:50:76 Expires in 1196 seconds ethernet
LAN 192.168.1.8 38:94:ed:26:33:d6 Expires in 1177 seconds ethernet

M42Orion

Ok, now I disabled Forwarder and enabled Resolver and all is well!

LAN 192.168.1.7 44:94:fc:9b:50:76 Switch1.localdomain Expires in 1170 seconds ethernet
LAN 192.168.1.8 38:94:ed:26:33:d6 Switch2.localdomain Expires in 1152 seconds ethernet

Thank you much for the assist and patience.

johnpoz

Yeah its a common problem where users setup the host overrides in the wrong one be it forwarder or resolver, when they are actually using the other ;)

Glad you got it sorted! Enjoy...

If you were using forwarder, and it had dhcp leases registered that might explain why you were seeing roku ;) If roku at one time had those Ips