Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Transparently Intercept and Redirect DNS Traffic to an Internal DNS

    Scheduled Pinned Locked Moved NAT
    54 Posts 9 Posters 20.3k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • gnitingG
      gniting @johnpoz
      last edited by

      @johnpoz I tried this setup and it works, as in I do get the right host name at the pihole end, but I get the following error as well:

      ❯ dig @8.8.8.8 dns-redirect-test.com
      ;; reply from unexpected source: 192.168.8.2#53, expected 8.8.8.8#53
      ;; reply from unexpected source: 192.168.8.2#53, expected 8.8.8.8#53
      ;; reply from unexpected source: 192.168.8.2#53, expected 8.8.8.8#53
      
      ; <<>> DiG 9.10.6 <<>> @8.8.8.8 dns-redirect-test.com
      ; (1 server found)
      ;; global options: +cmd
      ;; connection timed out; no servers could be reached
      

      192.168.8.2 is the IP of the pihole.
      LAN1 (on which all devices sit) is 192.168.7.x
      LAN2 (on which pihole sits) is 192.168.8.x

      Probably something to do with properly setting up an outbound NAT rule but I've tried diff configs, none seem to resolve the issue.

      Any pointers are welcome.

      M johnpozJ 2 Replies Last reply Reply Quote 0
      • M
        Marv21 @gniting
        last edited by

        @ibbetsion
        The NAT Rule is only valid for the .7. net?

        gnitingG 1 Reply Last reply Reply Quote 0
        • gnitingG
          gniting @Marv21
          last edited by

          @Marv21 the redirect NAT rule is set up for the .7. net.
          In the image below, SYNAPSE_LAN = .7. net.
          20b192b4-c01a-49cb-ad5b-4b68c140d29d-image.png

          M 2 Replies Last reply Reply Quote 0
          • M
            Marv21 @gniting
            last edited by

            @ibbetsion
            dns_ok is 192.168.8.2 then - right?

            gnitingG 1 Reply Last reply Reply Quote 0
            • M
              Marv21 @gniting
              last edited by

              @ibbetsion

              Where are you running this Dig command from?
              A client from the 7 or the 8 Net?

              gnitingG 1 Reply Last reply Reply Quote 0
              • gnitingG
                gniting @Marv21
                last edited by

                @Marv21 Sorry for omitting that, dns_ok is an alias that I use for those hosts that are allowed to make queries to external DNS servers. Any local host not in this alias/group should be re-routed to the local DNS server at 192.168.8.2

                M 1 Reply Last reply Reply Quote 0
                • gnitingG
                  gniting @Marv21
                  last edited by

                  @Marv21 the dig command is running from a host on the 7 Net.

                  1 Reply Last reply Reply Quote 0
                  • johnpozJ
                    johnpoz LAYER 8 Global Moderator @gniting
                    last edited by johnpoz

                    @ibbetsion said in Transparently Intercept and Redirect DNS Traffic to an Internal DNS:

                    ; reply from unexpected source: 192.168.8.2#53, expected 8.8.8.8#53

                    No shit what do you think was going to happen... This is why you put your NS your going to redirect to on a different vlan.. Or you have to forward it to loopback.. So pfsense does the query, and then sends the answer..

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                    gnitingG 1 Reply Last reply Reply Quote 0
                    • gnitingG
                      gniting @johnpoz
                      last edited by

                      @johnpoz the NS is on a different subnet...

                      johnpozJ 1 Reply Last reply Reply Quote 1
                      • M
                        Marv21 @gniting
                        last edited by Marv21

                        @ibbetsion just4fun.jpg

                        could you try this just 4 fun?
                        Thats mine. So everything will be redirectet from LAN to the SYNAPSELAN (any - directed to to that net or not)

                        gnitingG 1 Reply Last reply Reply Quote 0
                        • gnitingG
                          gniting @Marv21
                          last edited by

                          @Marv21 said in Transparently Intercept and Redirect DNS Traffic to an Internal DNS:

                          @ibbetsion just4fun.jpg

                          could you try this just 4 fun?
                          Thats mine. So everything will be redirectet from LAN to the SYNAPSELAN (any - directed to to that net or not)

                          That caused all DNS resolution to stop working. I think the issue is somewhere else. I am also now finding out that I cannot ping (or ssh) from the 8 Net to anywhere on the 7 Net or anywhere else. But I can go from 7->8 Net. Need to solve that first :)

                          M 1 Reply Last reply Reply Quote 0
                          • M
                            Marv21 @gniting
                            last edited by Marv21

                            @ibbetsion
                            Have you a allow Rule on the 8 net?
                            YOu need to allow traffic to 7.

                            gnitingG 1 Reply Last reply Reply Quote 0
                            • gnitingG
                              gniting @Marv21
                              last edited by

                              @Marv21 said in Transparently Intercept and Redirect DNS Traffic to an Internal DNS:

                              @ibbetsion
                              Have you a allow Rule on the 8 net?
                              YOu need to allow traffic to 7.

                              Yes, there is an allow rule on 8.
                              392b5001-169f-44b9-96dc-5bdf4f0e4f57-image.png

                              1 Reply Last reply Reply Quote 0
                              • johnpozJ
                                johnpoz LAYER 8 Global Moderator @gniting
                                last edited by

                                @ibbetsion said in Transparently Intercept and Redirect DNS Traffic to an Internal DNS:

                                the NS is on a different subnet...

                                You can not run multiple layer 3 on the same layer 2 and call it a different network..

                                For what your seeing to happen, the NS you redirected to had direct access to answer the client..

                                . I am also now finding out that I cannot ping (or ssh) from the 8 Net to anywhere on the 7 Net or anywhere else.

                                Seems you have bigger issues in your network than just trying to redirect dns..

                                An intelligent man is sometimes forced to be drunk to spend time with his fools
                                If you get confused: Listen to the Music Play
                                Please don't Chat/PM me for help, unless mod related
                                SG-4860 24.11 | Lab VMs 2.8, 24.11

                                gnitingG 1 Reply Last reply Reply Quote 0
                                • gnitingG
                                  gniting @johnpoz
                                  last edited by

                                  @johnpoz I was able to resolve the other issues. Everything is on track except for the unexpected source issue.

                                  A bit more on the network setup.

                                  • ISP modem connected to pfsense on WAN port
                                  • pfsense's LAN1 port connected to an unmanaged switch which in turn has all other local devices on it
                                  • pfsense's OPT1 port connected directly to host running DNS/pihole

                                  LAN1=192.168.7.x network
                                  OPT1=192.168.8.x network

                                  1 Reply Last reply Reply Quote 0
                                  • johnpozJ
                                    johnpoz LAYER 8 Global Moderator
                                    last edited by johnpoz

                                    Then what your seeing makes zero sense...

                                    So I can for sure duplicate your problem when the NS is on the same network..

                                    root@ntp:/home/pi# dig @8.8.8.8 www.google.com
                                    ;; reply from unexpected source: 192.168.3.10#53, expected 8.8.8.8#53
                                    ;; reply from unexpected source: 192.168.3.10#53, expected 8.8.8.8#53
                                    

                                    But if I put it on a different subnet works fine, or if forward to loopback, or if setup nat reflect auto outbound nat rules so it

                                    natted.jpg

                                    You can see from this sniff, pfsense saw traffic to 8.8.8.8, sent it on from its own interface 3.253 to 3.10, got answer and then sent answer back to 3.32 looking like it came from 8.8.8.8

                                    natreflec.jpg

                                    But yes if client thinks it sending to A, and gets back answer from B - its going to complain.

                                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                                    If you get confused: Listen to the Music Play
                                    Please don't Chat/PM me for help, unless mod related
                                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                                    gnitingG 1 Reply Last reply Reply Quote 0
                                    • gnitingG
                                      gniting @johnpoz
                                      last edited by

                                      @johnpoz makes zero sense to me too, hence the continued head-scratching ☺

                                      I do have the option enabled to Enable automatic outbound NAT for Reflection. On your network, you have the NAT redirect rule and that's it?

                                      M 1 Reply Last reply Reply Quote 0
                                      • M
                                        Marv21 @gniting
                                        last edited by

                                        @ibbetsion
                                        Both are /24 ?

                                        1 Reply Last reply Reply Quote 0
                                        • gnitingG
                                          gniting
                                          last edited by

                                          Yes

                                          M 1 Reply Last reply Reply Quote 0
                                          • M
                                            Marv21 @gniting
                                            last edited by Marv21

                                            @ibbetsion
                                            Hmm.
                                            What you could try (if you have not done any own modifications in the filesystem) - Backup everything, reinstall Pfsense und roll back the Backup.
                                            I had it once a while (4years or greater) that i had done this and suddenly everything was ok.

                                            Is this a Virtualized Maschine or something?

                                            Could you post all NAT Rules, Outbond Page, Lan Rules and DNSNet rules here as Screenshots?

                                            Do you have any Floating Rules?

                                            gnitingG 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.