Transparently Intercept and Redirect DNS Traffic to an Internal DNS

[johnpoz]

Then what your seeing makes zero sense...

So I can for sure duplicate your problem when the NS is on the same network..

root@ntp:/home/pi# dig @8.8.8.8 www.google.com
;; reply from unexpected source: 192.168.3.10#53, expected 8.8.8.8#53
;; reply from unexpected source: 192.168.3.10#53, expected 8.8.8.8#53

But if I put it on a different subnet works fine, or if forward to loopback, or if setup nat reflect auto outbound nat rules so it

login-to-view

You can see from this sniff, pfsense saw traffic to 8.8.8.8, sent it on from its own interface 3.253 to 3.10, got answer and then sent answer back to 3.32 looking like it came from 8.8.8.8

login-to-view

But yes if client thinks it sending to A, and gets back answer from B - its going to complain.

[gniting]

@johnpoz makes zero sense to me too, hence the continued head-scratching

I do have the option enabled to Enable automatic outbound NAT for Reflection. On your network, you have the NAT redirect rule and that's it?

[Marv21]

@ibbetsion
Both are /24 ?

[gniting]

Yes

[Marv21]

@ibbetsion
Hmm.
What you could try (if you have not done any own modifications in the filesystem) - Backup everything, reinstall Pfsense und roll back the Backup.
I had it once a while (4years or greater) that i had done this and suddenly everything was ok.

Is this a Virtualized Maschine or something?

Could you post all NAT Rules, Outbond Page, Lan Rules and DNSNet rules here as Screenshots?

Do you have any Floating Rules?

[johnpoz]

@Marv21 said in Transparently Intercept and Redirect DNS Traffic to an Internal DNS:

s this a Virtualized Maschine or something?

That is a great question...

Why don't you just sniff and see exactly what is happening..

I don't intercept traffic on the same interface and send back in, but yes that outbound nat automatic should do make it look like i comes from the pfsense interface in that network when you do it that way..

If pfsense redirects traffic and doesn't nat it or is not the gateway for the return.. Then yes your client is going to scream at you you - wtf is this I sent to A, why is B sending me a response.

[gniting]

@Marv21 said in Transparently Intercept and Redirect DNS Traffic to an Internal DNS:

@ibbetsion
Hmm.
What you could try (if you have not done any own modifications in the filesystem) - Backup everything, reinstall Pfsense und roll back the Backup.
I had it once a while (4years or greater) that i had done this and suddenly everything was ok.

Is this a Virtualized Maschine or something?

Could you post all NAT Rules, Outbond Page, Lan Rules and DNSNet rules here as Screenshots?

Do you have any Floating Rules?

No floating rules and machine is not virtualized. I will try the reinstall recommendation.

[gniting]

@johnpoz will attempt to diagnose using packet capture.

[Marv21]

@ibbetsion
Something new on this?

[gniting]

Unfortunately not yet. I am attempting to procure a completely separate host to try this out vs having a host that has two NICs (with each NIC on one of two subnets). Just trying to minimize the variables.

[Marv21]

@ibbetsion
At the Moment you have only one NIC with two VLANs?

[gniting]

@Marv21 No, there are no vlans. The host has two physical NICs.