Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Windows Server DNS Server can't forward to pfSense

    Scheduled Pinned Locked Moved DHCP and DNS
    52 Posts 3 Posters 10.1k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • N
      netblues @Hekmil
      last edited by

      @Hekmil You need tcp for nslookup.
      try nslookup from windows.
      server ip.of.pfsense.lan
      cnn.com

      H 1 Reply Last reply Reply Quote 0
      • H
        Hekmil @netblues
        last edited by

        @netblues Yeah everything is allowed at the moment so it's fine

        1f1ddd0a-6270-405a-b6d6-ce5a8e73dc06-image.png

        N 1 Reply Last reply Reply Quote 0
        • N
          netblues @Hekmil
          last edited by

          @Hekmil Is dns resolver service running on pf? is it listening on lan interface?

          H 1 Reply Last reply Reply Quote 0
          • H
            Hekmil @netblues
            last edited by Hekmil

            @netblues yes it's running, I can resolve any domain from the pfSense.

            The configuration is the default one, listening on all interfaces.

            It's like the Windows machine can't forward the DNS request to the pfSense.

            N 1 Reply Last reply Reply Quote 0
            • N
              netblues @Hekmil
              last edited by

              @Hekmil No. You run nslookup
              What is the lan ip of pf sense?
              Try running nslookup from pf cli
              pf sense it self can resolve without a local resolver if configured to use wan connection dns for example.

              H 1 Reply Last reply Reply Quote 0
              • H
                Hekmil @netblues
                last edited by

                @netblues Yes I was talking about running a nslookup from the pfSense CLI, sorry if it wasn't clear. From the CLI it manage to resolve.

                My LAN ip of my pfSense is 172.16.1.2

                Yes the pfSense does use the WAN connection when resolving

                N 1 Reply Last reply Reply Quote 0
                • N
                  netblues @Hekmil
                  last edited by

                  @Hekmil not much left to do.
                  can you ping pfsense lan from windows server?

                  H 1 Reply Last reply Reply Quote 0
                  • H
                    Hekmil @netblues
                    last edited by Hekmil

                    @netblues Yeah that's why i'm asking here, because I'm out of option

                    Yes all my machines can ping together. But only pfSense can ping outside the NAT (for example 8.8.8.8).

                    799e6859-8721-4192-8c02-61dd9471d053-image.png
                    Here is a tracert command to 8.8.8.8 which timeout after reaching pfSense LAN interface. The firewall log : 494a5509-7e94-488f-96de-064c6aee3a2b-image.png

                    N 1 Reply Last reply Reply Quote 0
                    • N
                      netblues @Hekmil
                      last edited by

                      And you cant nslookup from everywhere else with pfsense lan ip but you can from pfsense cli using lan ip.
                      Anything on floating rules?

                      H 1 Reply Last reply Reply Quote 0
                      • H
                        Hekmil @netblues
                        last edited by Hekmil

                        @netblues Wait I was only trying to do nslookup cnn.com on the cli not using lan IP. If I do that it doesn't work of course sorry. It's like the resolving DNS service was not enabled for all interfaces except it is.

                        Floating rules are empty.

                        N 1 Reply Last reply Reply Quote 0
                        • N
                          netblues @Hekmil
                          last edited by

                          @Hekmil please post services resolver settings.
                          Have you tried restarting resolver service?

                          H 1 Reply Last reply Reply Quote 0
                          • H
                            Hekmil @netblues
                            last edited by Hekmil

                            @netblues Here are my setting of my resolver :
                            548011a5-9ff7-441a-a1a6-d7d114e92209-image.png
                            b5f626b7-0800-4cac-a0ee-ecc16ad1d66c-image.png

                            8790a151-06e7-4743-be59-cc5f2e009758-image.png
                            192.168.101.2 = NAT Gateway

                            Yes the service and even the machine has been restarted trying fixing the issue

                            N 1 Reply Last reply Reply Quote 0
                            • N
                              netblues @Hekmil
                              last edited by

                              @Hekmil you dont really need any dns servers if pf can reach the internet..
                              However this is irrelevant.
                              Dns resolver should be listening on lan anyway.
                              Do restart the srrvice and look at status system logs resolver logs for anything strange.

                              H 1 Reply Last reply Reply Quote 0
                              • H
                                Hekmil @netblues
                                last edited by

                                @netblues True that

                                Nothing really usefull from the logs :
                                7c03c5f9-c237-44cb-97c4-e613b2a307cd-image.png

                                N 1 Reply Last reply Reply Quote 0
                                • N
                                  netblues @Hekmil
                                  last edited by

                                  @Hekmil output of sockstat -l please

                                  H 1 Reply Last reply Reply Quote 0
                                  • H
                                    Hekmil @netblues
                                    last edited by

                                    @netblues

                                    USER     COMMAND    PID   FD PROTO  LOCAL ADDRESS         FOREIGN ADDRESS
                                    root     sockstat   96752 13 stream /var/run/php-fpm.socket
                                    unbound  unbound    52451 3  udp6   *:53                  *:*
                                    unbound  unbound    52451 4  tcp6   *:53                  *:*
                                    unbound  unbound    52451 5  udp4   *:53                  *:*
                                    unbound  unbound    52451 6  tcp4   *:53                  *:*
                                    unbound  unbound    52451 7  tcp4   127.0.0.1:953         *:*
                                    unbound  unbound    52451 12 stream /var/run/php-fpm.socket
                                    unbound  unbound    52451 13 stream /var/run/php-fpm.socket
                                    unbound  unbound    52451 14 udp4   *:52518               *:*
                                    root     syslogd    45622 6  dgram  /var/dhcpd/var/run/log
                                    root     syslogd    45622 7  udp6   *:514                 *:*
                                    root     syslogd    45622 8  udp4   *:514                 *:*
                                    root     syslogd    45622 9  dgram  /var/run/log
                                    root     syslogd    45622 10 dgram  /var/run/logpriv
                                    root     syslogd    45622 12 stream /var/run/php-fpm.socket
                                    root     syslogd    45622 13 stream /var/run/php-fpm.socket
                                    root     php-fpm    17426 3  dgram  (not connected)
                                    root     php-fpm    17426 4  udp4   *:*                   *:*
                                    root     php-fpm    17426 5  udp6   *:*                   *:*
                                    root     php-fpm    17426 13 stream /var/run/php-fpm.socket
                                    root     ntpd       37361 20 udp6   fe80::20c:29ff:fe82:c819%em0:123 *:*
                                    root     ntpd       37361 21 udp4   192.168.101.40:123    *:*
                                    root     ntpd       37361 22 udp6   fe80::20c:29ff:fe82:c823%em1:123 *:*
                                    root     ntpd       37361 23 udp4   172.16.1.2:123        *:*
                                    root     ntpd       37361 24 udp6   fe80::20c:29ff:fe82:c82d%em2:123 *:*
                                    root     ntpd       37361 25 udp4   172.16.101.2:123      *:*
                                    root     ntpd       37361 26 udp6   fe80::20c:29ff:fe82:c837%em3:123 *:*
                                    root     ntpd       37361 27 udp4   172.16.4.2:123        *:*
                                    root     ntpd       37361 28 udp6   fe80::20c:29ff:fe82:c841%em4:123 *:*
                                    root     ntpd       37361 29 udp4   172.16.200.2:123      *:*
                                    root     ntpd       37361 30 udp6   ::1:123               *:*
                                    root     ntpd       37361 31 udp4   127.0.0.1:123         *:*
                                    root     login      80435 3  dgram  (not connected)
                                    root     charon     22942 5  dgram  (not connected)
                                    root     charon     22942 8  stream /var/run/charon.wlst
                                    root     charon     22942 11 udp6   *:500                 *:*
                                    root     charon     22942 12 udp6   *:4500                *:*
                                    root     charon     22942 13 udp4   *:500                 *:*
                                    root     charon     22942 14 udp4   *:4500                *:*
                                    root     charon     22942 20 stream /var/run/charon.ctl
                                    root     charon     22942 21 stream /var/run/charon.vici
                                    root     starter    22764 5  dgram  (not connected)
                                    root     nginx      57467 5  tcp4   *:443                 *:*
                                    root     nginx      57467 6  tcp6   *:443                 *:*
                                    root     nginx      57467 7  tcp4   *:80                  *:*
                                    root     nginx      57467 8  tcp6   *:80                  *:*
                                    root     nginx      57350 5  tcp4   *:443                 *:*
                                    root     nginx      57350 6  tcp6   *:443                 *:*
                                    root     nginx      57350 7  tcp4   *:80                  *:*
                                    root     nginx      57350 8  tcp6   *:80                  *:*
                                    root     nginx      57077 5  tcp4   *:443                 *:*
                                    root     nginx      57077 6  tcp6   *:443                 *:*
                                    root     nginx      57077 7  tcp4   *:80                  *:*
                                    root     nginx      57077 8  tcp6   *:80                  *:*
                                    root     dpinger    27696 5  dgram  (not connected)
                                    root     dpinger    27696 6  stream /var/run/dpinger_GW_WAN~192.168.101.40~192.168.101.2.sock
                                    root     devd       415   4  stream /var/run/devd.pipe
                                    root     devd       415   5  seqpac /var/run/devd.seqpacket.pipe
                                    root     check_relo 358   3  stream /var/run/check_reload_status
                                    root     php-fpm    322   3  dgram  (not connected)
                                    root     php-fpm    322   4  udp4   *:*                   *:*
                                    root     php-fpm    322   5  udp6   *:*                   *:*
                                    root     php-fpm    322   13 stream /var/run/php-fpm.socket
                                    root     php-fpm    321   3  dgram  (not connected)
                                    root     php-fpm    321   4  udp4   *:*                   *:*
                                    root     php-fpm    321   5  udp6   *:*                   *:*
                                    root     php-fpm    321   13 stream /var/run/php-fpm.socket
                                    root     php-fpm    321   14 dgram  (not connected)
                                    root     php-fpm    319   3  dgram  (not connected)
                                    root     php-fpm    319   4  udp4   *:*                   *:*
                                    root     php-fpm    319   5  udp6   *:*                   *:*
                                    root     php-fpm    319   15 stream /var/run/php-fpm.socket
                                    
                                    N 1 Reply Last reply Reply Quote 0
                                    • N
                                      netblues @Hekmil
                                      last edited by

                                      @Hekmil as you see, service unbound is listening on all interfaces.
                                      So nslookup shouldn't be complaining.
                                      This is really strange.

                                      Can you telnet 172.16.1.2 (pfsense lan) on port 53 from pf cli?

                                      H 1 Reply Last reply Reply Quote 0
                                      • H
                                        Hekmil @netblues
                                        last edited by

                                        @netblues Yes indeed

                                        Yes it works : 7b97c031-b5f1-4ac5-b196-a64fd1487c00-image.png

                                        N 1 Reply Last reply Reply Quote 0
                                        • N
                                          netblues @Hekmil
                                          last edited by

                                          @Hekmil so unbound works.
                                          dig @172.16.1.2 cnn.com

                                          always from cli.

                                          H 1 Reply Last reply Reply Quote 0
                                          • bmeeksB
                                            bmeeks
                                            last edited by

                                            You need to let the unbound DNS server within pfSense do the name resolution for you. Forget your NAT gateway DNS. And remove those two IP addresses from the General Settings tab in pfSense. Out of the box, unbound is ready to operate in resolver mode, which means it will query the root servers and proceed down the domain tree to find the IP for the FQDN. If you want to put any address on the General Settings page in that DNS box, put 127.0.0.1. And uncheck that "DNS Server Override" box. You don't want that in your setup.

                                            Once you do that, go under DIAGNOSTICS > DNS LOOKUP and see if a domain such as "cnn.com" or "google.com" resolves properly. It should.

                                            Once you get that working, then go back and point your AD DNS Server to forward to pfSense instead of that NAT gateway. DNS lookups should then work properly.

                                            Last tip -- sounds like you may not be fully versed in DNS terminology. Make sure you understand the distinction between a DNS resolver and a DNS forwarder. They are not the same. In your case, I think letting unbound on pfSense operate in its normal resolver mode is what you need. However, if you truly want to use DNS forwarding, then you will need to configure that setup in unbound on pfSense.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.