Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    DNS Stops working

    Scheduled Pinned Locked Moved DHCP and DNS
    36 Posts 5 Posters 3.5k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • GertjanG
      Gertjan
      last edited by

      I guess you know what you did here (LAN) :

      0c61bcda-d3a3-4f11-a04b-5e6c19298a16-image.png

      DNS traffic is allowed to go to to IP 168.168.40.1 (you did not mention where this IP is : on LAN ? On some other LAN ? - I presume it's some DNS server - looking at the traffic counter, traffic is send to that DNS server)
      The alias "Playstation" (You did not mention if the Playstation does work well - presume, looking at the traffic counters, it does show traffic)
      Your DNS block rule works .... and that's why you said "DNS stops working".
      (so : remove this rule and you'll be fine ^^)

      Just a question : take any device on your LAN, a PC, and type

      ipconfig /all
      

      What is the DNS it's using ?
      Related question : does your DHCP hands over the correct (= 168.168.40.1 )DNS ?

      No "help me" PM's please. Use the forum, the community will thank you.
      Edit : and where are the logs ??

      manjotscM 1 Reply Last reply Reply Quote 0
      • manjotscM
        manjotsc @Gertjan
        last edited by manjotsc

        @Gertjan 192.168.40.1 is pfsense box ip, I am using it pfblockerng on it, what's why I made those rules, but when DNS stops working PlayStation also are affect, entire lan and guest is effected. This issue doesn't happens all the time, it's like once a week it occurs.

        Vendor: HP
        Version: P01 Ver. 02.50
        Release Date: Wed Jul 17 2024
        Boot Method: UEFI
        24.11-RELEASE (amd64)
        FreeBSD 15.0-CURRENT
        CPU Type: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz
        Current: 3606 MHz, Max: 3400 MHz
        4 CPUs : 1 package(s) x 4 core(s)

        GertjanG 1 Reply Last reply Reply Quote 0
        • GertjanG
          Gertjan @manjotsc
          last edited by Gertjan

          @manjotsc said in DNS Stops working:

          192.168.40.1 is pfsense box ip

          Tip : use the build in alias "Firewall itself" (the first in the list).

          @manjotsc said in DNS Stops working:

          it's like once a week it occurs.

          At that moment, check if unbound, the DNS resolver on pfSense is actually running.
          The best way to do that is using console or SSH access, and type

          [2.4.4-RELEASE][admin@pfsense.brit-hotel-fumel.net]/root: ps ax | grep unbound
          76224  -  S         0:55.87 /usr/local/sbin/lighttpd_pfb -f /var/unbound/pfb_dnsbl_lighty.conf
          83945  -  Ss       17:13.80 /usr/local/sbin/unbound -c /var/unbound/unbound.conf
          66966  0  S+        0:00.00 grep unbound
          

          As you can see, mine is running for** 17 hours and 13 minutes.

          Also, check the GUI DNS logs : was unbound restarted ? How long did it take ?

          ** edit : see remark @johnpoz below

          No "help me" PM's please. Use the forum, the community will thank you.
          Edit : and where are the logs ??

          1 Reply Last reply Reply Quote 0
          • johnpozJ
            johnpoz LAYER 8 Global Moderator
            last edited by

            That is showing you cpu time, not elapsed clock time ;)

            If you want to see etime you have to call that out..

            example - find the pid

            [2.4.4-RELEASE][admin@sg4860.local.lan]/root: ps ax | grep unbound
            33787  -  Is        0:41.49 /usr/local/sbin/unbound -c /var/unbound/unbound.conf
            25758  0  S+        0:00.00 grep unbound
            [2.4.4-RELEASE][admin@sg4860.local.lan]/root: ps -p 33787 -o etime
                 ELAPSED
              1-23:27:48
            [2.4.4-RELEASE][admin@sg4860.local.lan]/root: ps -p 33787 -o etimes
            ELAPSED
             170882
            [2.4.4-RELEASE][admin@sg4860.local.lan]/root: 
            

            Then ask for etime or etimes (which will be in seconds)

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.8, 24.11

            manjotscM 1 Reply Last reply Reply Quote 0
            • GertjanG
              Gertjan
              last edited by

              Nice - thanks.

              [2.4.4-RELEASE][admin@pfsense.brit-hotel-fumel.net]/root: ps ax | grep unbound
              76224  -  S         0:55.96 /usr/local/sbin/lighttpd_pfb -f /var/unbound/pfb_dnsbl_lighty.conf
              83945  -  Ss       17:22.86 /usr/local/sbin/unbound -c /var/unbound/unbound.conf
              98238  0  S+        0:00.00 grep unbound
              [2.4.4-RELEASE][admin@pfsense.brit-hotel-fumel.net]/root: ps -p 83945 -o etime
                   ELAPSED
                4-00:48:20
              

              4 days .... ok for me.

              No "help me" PM's please. Use the forum, the community will thank you.
              Edit : and where are the logs ??

              1 Reply Last reply Reply Quote 0
              • manjotscM
                manjotsc @johnpoz
                last edited by manjotsc

                @johnpoz @Gertjan This is what I got,

                Annotation 2020-01-14 114508.png

                Vendor: HP
                Version: P01 Ver. 02.50
                Release Date: Wed Jul 17 2024
                Boot Method: UEFI
                24.11-RELEASE (amd64)
                FreeBSD 15.0-CURRENT
                CPU Type: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz
                Current: 3606 MHz, Max: 3400 MHz
                4 CPUs : 1 package(s) x 4 core(s)

                1 Reply Last reply Reply Quote 0
                • manjotscM
                  manjotsc
                  last edited by

                  @Gertjan @johnpoz My pfsense box uptime 2 Days 5 Hours and outbound is for been running for 17 mintues, is that wierd?

                  Vendor: HP
                  Version: P01 Ver. 02.50
                  Release Date: Wed Jul 17 2024
                  Boot Method: UEFI
                  24.11-RELEASE (amd64)
                  FreeBSD 15.0-CURRENT
                  CPU Type: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz
                  Current: 3606 MHz, Max: 3400 MHz
                  4 CPUs : 1 package(s) x 4 core(s)

                  1 Reply Last reply Reply Quote 0
                  • johnpozJ
                    johnpoz LAYER 8 Global Moderator
                    last edited by

                    well in means its restarting - do you have it registering dhcp? Did you just make a change to host or domain overrides... Did pfblocker update, etc..

                    Problem is when restarts cache is lost, while its restarting nothing can respond to dns, etc.

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                    manjotscM 1 Reply Last reply Reply Quote 0
                    • manjotscM
                      manjotsc @johnpoz
                      last edited by manjotsc

                      @johnpoz @Gertjan Maybe because it set to every hour, for update what's why maybe. And I didn't understand this part " do you have it registering dhcp?" can you tell you check about this, thanks.

                      Annotation 2020-01-15 125319.png

                      Vendor: HP
                      Version: P01 Ver. 02.50
                      Release Date: Wed Jul 17 2024
                      Boot Method: UEFI
                      24.11-RELEASE (amd64)
                      FreeBSD 15.0-CURRENT
                      CPU Type: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz
                      Current: 3606 MHz, Max: 3400 MHz
                      4 CPUs : 1 package(s) x 4 core(s)

                      manjotscM GertjanG 2 Replies Last reply Reply Quote 0
                      • manjotscM
                        manjotsc @manjotsc
                        last edited by

                        @Gertjan @johnpoz It started happing again, Now when I start downloading something file large files, DNS stops working.

                        Thanks,

                        Vendor: HP
                        Version: P01 Ver. 02.50
                        Release Date: Wed Jul 17 2024
                        Boot Method: UEFI
                        24.11-RELEASE (amd64)
                        FreeBSD 15.0-CURRENT
                        CPU Type: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz
                        Current: 3606 MHz, Max: 3400 MHz
                        4 CPUs : 1 package(s) x 4 core(s)

                        1 Reply Last reply Reply Quote 0
                        • GertjanG
                          Gertjan @manjotsc
                          last edited by

                          @manjotsc said in DNS Stops working:

                          " do you have it registering dhcp?

                          Do you have checked this one :

                          89fad6f0-3430-4ee9-af0a-0d774102bbbe-image.png

                          If so, when a new lease is asked and granted, the Resolver is restarted.
                          Compare DHCP logs and DNS Resolver log. You can see it happen.

                          If you have a device that insists in asking a new DHCP lease every xx minutes, then yes, your Resolver get's restarted every xx minutes. Something you do not want at all ...

                          @manjotsc said in DNS Stops working:

                          Maybe because it set to every hour,

                          So you get what you want : a guaranteed Resolver restart every hour.
                          And the risk that feed servers are blacklisting your download attempts.

                          @manjotsc said in DNS Stops working:

                          Now when I start downloading something file large files, DNS stops working.

                          Loading some file from the net doesn't use the DNS.
                          In the beginningt, the URL of the file is resolved. The IP connection is made, and packets just stream through the router/firewall.
                          Whatever the Resolver is doing at that moment, it has nothing to do with this data stream.

                          If you want to look for system instability :
                          Remove ALL packages.
                          Check for 'strange' system messages : enter the console, option 8 and type "dmesg". See if new logs are added. Are they NIC related ?

                          No "help me" PM's please. Use the forum, the community will thank you.
                          Edit : and where are the logs ??

                          manjotscM 2 Replies Last reply Reply Quote 0
                          • manjotscM
                            manjotsc @Gertjan
                            last edited by

                            @Gertjan DHCP Registration, is not checked.

                            Vendor: HP
                            Version: P01 Ver. 02.50
                            Release Date: Wed Jul 17 2024
                            Boot Method: UEFI
                            24.11-RELEASE (amd64)
                            FreeBSD 15.0-CURRENT
                            CPU Type: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz
                            Current: 3606 MHz, Max: 3400 MHz
                            4 CPUs : 1 package(s) x 4 core(s)

                            1 Reply Last reply Reply Quote 0
                            • manjotscM
                              manjotsc @Gertjan
                              last edited by manjotsc

                              @Gertjan This is what I am getting on logs,

                              ----------------------------------------------- Before Reboot ---------------------------------------------

                              Screenshot_2020-06-05 pfSense manjot net - Status Dashboard1.png

                              alt text

                              --------------------------------------------- After Reboot -------------------------------------------------

                              alt text

                              Vendor: HP
                              Version: P01 Ver. 02.50
                              Release Date: Wed Jul 17 2024
                              Boot Method: UEFI
                              24.11-RELEASE (amd64)
                              FreeBSD 15.0-CURRENT
                              CPU Type: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz
                              Current: 3606 MHz, Max: 3400 MHz
                              4 CPUs : 1 package(s) x 4 core(s)

                              GertjanG 1 Reply Last reply Reply Quote 0
                              • GertjanG
                                Gertjan @manjotsc
                                last edited by

                                @manjotsc said in DNS Stops working:

                                This is what I am getting on logs,

                                Both logs show a lot of what happens during DNS resolving.
                                Logging as much info - note that both logs images show lines that all took please in 1 second (!!).
                                Logging this much info really takes a hit on the system.
                                DNS resolving over port 853 (TLS) implies huge processing, because everything has to be encrypted - en of course decrypted - re encrypted on the other side. Reply times like 0.120 seconds or 120 milliseconds become 'normal'.
                                You do have AES-NI, but, still SDNS takes more time then classic DNS.

                                Do you have to supply 8.8.8.8 and 1.1.1.1 your private DNS info ? Please remember : these are companies. The fact that they don't bill you is because you gave them valuable info. Do you have to ? Did you try other DNS sources, like the official Internet DNS root servers ?

                                Another thing : do the http://www.dslreports.com/speedtest test.

                                4ed9a843-af5c-4ddd-8a8d-efdc0f4ab62c-image.png

                                No A's means : .... would you experience right now .... the WAN connection gets congested.

                                No "help me" PM's please. Use the forum, the community will thank you.
                                Edit : and where are the logs ??

                                manjotscM 1 Reply Last reply Reply Quote 0
                                • manjotscM
                                  manjotsc @Gertjan
                                  last edited by manjotsc

                                  @Gertjan Can you help me find Root DNS servers, I made searchg, couln't find.

                                  Annotation 2020-06-05 221423.png

                                  Thanks,

                                  Vendor: HP
                                  Version: P01 Ver. 02.50
                                  Release Date: Wed Jul 17 2024
                                  Boot Method: UEFI
                                  24.11-RELEASE (amd64)
                                  FreeBSD 15.0-CURRENT
                                  CPU Type: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz
                                  Current: 3606 MHz, Max: 3400 MHz
                                  4 CPUs : 1 package(s) x 4 core(s)

                                  S GertjanG 2 Replies Last reply Reply Quote 0
                                  • S
                                    SteveITS Galactic Empire @manjotsc
                                    last edited by

                                    @manjotsc said in DNS Stops working:

                                    Can you help me find Root DNS servers

                                    If you don't enable "DNS Query Forwarding" in the DNS resolver settings, then pfSense will query Internet root servers by default.
                                    https://docs.netgate.com/pfsense/en/latest/book/services/dns-resolver.html

                                    Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                                    When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
                                    Upvote 👍 helpful posts!

                                    1 Reply Last reply Reply Quote 0
                                    • GertjanG
                                      Gertjan @manjotsc
                                      last edited by

                                      @manjotsc said in DNS Stops working:

                                      Can you help me find Root DNS servers, I made searchg, couln't find.

                                      As @teamits said : you, and unbound do not nedd to find them.
                                      These 13 servers are exceptional : their host name and IP adrresses (IPv4 and IPv6 ) are build into unbound.
                                      Here they are : https://www.iana.org/domains/root/servers (install Google and use these words : DNS root servers)

                                      Use this command on pfSense to see them :

                                      dig . ns
                                      

                                      No "help me" PM's please. Use the forum, the community will thank you.
                                      Edit : and where are the logs ??

                                      manjotscM 2 Replies Last reply Reply Quote 0
                                      • manjotscM
                                        manjotsc @Gertjan
                                        last edited by

                                        @Gertjan @johnpoz I'll try alternative dns servers and monitor.

                                        Thanks, for your help and time.

                                        Vendor: HP
                                        Version: P01 Ver. 02.50
                                        Release Date: Wed Jul 17 2024
                                        Boot Method: UEFI
                                        24.11-RELEASE (amd64)
                                        FreeBSD 15.0-CURRENT
                                        CPU Type: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz
                                        Current: 3606 MHz, Max: 3400 MHz
                                        4 CPUs : 1 package(s) x 4 core(s)

                                        1 Reply Last reply Reply Quote 0
                                        • manjotscM
                                          manjotsc @Gertjan
                                          last edited by

                                          @Gertjan @johnpoz I tried few other dns servers, same issue. DNS stops working and went to pfsense Diagnostics then ping, for exemple i tried ping 1.1.1.1 from WAN it pings but from lan side and guest side it does not ping. It looks like something is blocking on lan and guest from reaching dns servers.

                                          Vendor: HP
                                          Version: P01 Ver. 02.50
                                          Release Date: Wed Jul 17 2024
                                          Boot Method: UEFI
                                          24.11-RELEASE (amd64)
                                          FreeBSD 15.0-CURRENT
                                          CPU Type: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz
                                          Current: 3606 MHz, Max: 3400 MHz
                                          4 CPUs : 1 package(s) x 4 core(s)

                                          GertjanG 1 Reply Last reply Reply Quote 0
                                          • GertjanG
                                            Gertjan @manjotsc
                                            last edited by

                                            @manjotsc said in DNS Stops working:

                                            blocking on lan

                                            That something is called a firewall rule. The default one works just fine.
                                            Or you've busted the routing.

                                            No "help me" PM's please. Use the forum, the community will thank you.
                                            Edit : and where are the logs ??

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.