Windows Server DNS Server can't forward to pfSense
-
@netblues Result of dig :
@bmeeks Hum, if I follow what you have said I can't resolve anymore any domain. Only theses settings works for me to resolve domain from pfSense :
My AD DNS Server was never forwarding to my NAT gateway, only my pfSense LAN ip address
About terminology I want to use the resolver mode, I only used the forwarding term to mention the redirection from my AD DNS to pfSense.
My guess was also a route issue, but I have no clue how and where to configure it as my NAT settings come from the Virtual Network Editor of VMware Workstation
-
@Hekmil said in Windows Server DNS Server can't forward to pfSense:
n its DNS server parameters I have set the forward address to my pfSense IP (LAN or WAN interface does it matter ?) which has set my NAT gateway (192.168.101.2) as DNS Server
The DNS setting in that Window you show in your screen cap only affects lookups done from the firewall console. Stated another way, this tells the local DNS client on the firewall (not server) which DNS server to use for lookups the firewall itself is doing (like from that DIAGNOSTICS menu window).
The only time the IP addresses put on this screen matter to
unbound
(and external clients using pfSense for their DNS lookups) is whenunbound
is configured to use forwarding mode. There is a check box on the DNS Resolver page for turning on forwarding.Since resolving does not work, perhaps someplace upstream firewall rules are restricting DNS lookups to only be allowed when originating from the 192.168.101.2 server. So
unbound
in resolving mode is getting blocked. If that is the case, turn on forwarding mode withunbound
and see if that works. -
@bmeeks I'm not sure which screen cap you are mentionning, the Geneal settings right ? I'm getting a bit confused sorry due to many information here.
So I should keep the same configuration but turning off Resolver and on Forwarder to see if it works (but with a nslookup on the Windows Server)?
-
@Hekmil said in Windows Server DNS Server can't forward to pfSense:
@bmeeks I'm not sure which screen cap you are mentionning, the Geneal settings right ? I'm getting a bit confused sorry due to many information here.
So I should keep the same configuration but turning off Resolver and on Forwarder to see if it works (but with a nslookup on the Windows Server)?
The DNS Settings on the pfSense GENERAL SETTINGS screen (that box where you have put in the 192.168.101.2 server).
pfSense now comes with two different DNS server components. The new one is
unbound
, and this program can be either a resolver or a forwarder. The old DNS component isdnsmasq
, and it can only be a forwarder. The default out-of-the-box configuration of pfSense is withunbound
(the DNS Resolver) enabled and operating in resolver mode. Unless you put something in those DNS boxes on the General Setup page, the firewall will use the localunbound
DNS Resolver for name lookups, and the DNS Resolver will attempt to resolve with the DNS root servers by default.The old
dnsmasq
DNS Forwarder is disabled by default now. You really don't want to use it. It is under SERVICES > DNS FORWARDER. It should be disabled. You can't run it and the Resolver at the same as both will try to use the same port 53 to listen for DNS requests.If you want to use
unbound
in forwarding mode, there is a checkbox on the SERVICES > DNS RESOLVER setup screen to enable forwarding. The help text in that box says that when you enable forwardingunbound
will then forward DNS requests to whatever server you have entered on the SYSTEM > GENERAL SETUP tab down in the DNS Server Settings section.So what I suggested you try is go to SERVICES > DNS RESOLVER. Make sure the checkbox for Enable DNS Resolver is checked. Then scroll down that page to about the middle and check the box for DNS Query Forwarding. The checkbox says "Enable Forwarding Mode".
Since the DNS lookup failed from pfSense when you took out the 192.168.101.2 DNS server, that indicates to me that perhaps something upstream from pfSense is only allowing DNS requests to be handled by that 192.168.101.2 address. So when
unbound
tries to contact the DNS root servers directly, it is blocked from doing so. -
@bmeeks Even though what you say is valid, however no matter what settings are in dns resolver, (forwarded, root servers etc, ) under no circumstances dig would return no servers can be reached
for example, digging for something non existent on a pf that has access to internet disconnected..
dig @192.168.31.25 pf.dontexist.net
; <<>> DiG 9.11.13-RedHat-9.11.13-5.el8_2 <<>> @192.168.31.25 pf.dontexist.net
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 10679
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;pf.dontexist.net. IN A;; Query time: 2 msec
;; SERVER: 192.168.31.25#53(192.168.31.25)
;; WHEN: Jul 22 22:49:13 EEST 2020
;; MSG SIZE rcvd: 45It returns server fail because IT FAILED upstream.
No servers can be reached indicates a local connectivity problem.
and since we have verified that it is the unbound process that listens on port 53, it can't be a dns forwarder issue.No servers can be reached, means it got nothing back after contacting port 53
Since this is a test environment under vm, I would install a fresh copy of pf, on another machine and I would try digging on its resolver, as a next step. -
@netblues:
I think we are both saying the same thing but in a slightly different manner.I understood the OP to say that when he puts his upstream NAT gateway DNS server IP in the General Setup box on pfSense (that 192.168.101.2 address) that a DNS lookup performed directly on the pfSense console works. And when he removes that IP address and puts in nothing in the box, or else 127.0.0.1 to tell pfSense to use the localhost as the DNS server, his lookup fails. So in that first case, with an upstream DNS server listed in the General Setup tab for pfSense,
dig
will use that defined server to make DNS requests to. But if that General Setup tab DNS server IP box is blank (or points to 127.0.0.1), thendig
will attempt to useunbound
(the local resolver) for lookups.So to me that indicates that DNS Resolver on pfSense, when it is used and tries to contact the root servers, is unable to do so. Hence the "server fail" message. One reason this might be true is if some upstream network component (remember he described this as a lab VM setup) is restricting all DNS lookups to just that 192.168.101.2 server. So a rule upstream that says "if the destination for DNS port 53 traffic is not 192.168.101.2, then drop it" will cause DNS Resolver on pfSense to fail in contacting the root servers (and any other servers if you were to enable forwarding unless you forward only to the 192.168.101.2 box).
-
@bmeeks I have lab tested these scenarios. The only way to get a timeout- no servers can be reached, is by digging to an non existent dns server, or putting a firewall rule on dns.
Everything else will be a case when unbound can BE reached.
Yes, there are issues with the resolver setup and how it connects to the greater internet, but, the local timeout issue is something different.
To sum it up.
Unbound is running fine on 53, listening on all interfaces, and it cannot be contacted by dig or nslookup from pf cli using the lan ip of pf.
No floating rules. And certainly this should work irrelevant of internet connectivity etc. This is where I start suspecting the vm/or the installation. Any ideas more than welcome. -
Ok so I fully understood what you both said.
I can try make a fresh install with on a different machine to try out if it comes from the VM.
I'll put nothing in the DNS Server boxes of the General Setup to try only using the
unbound
for lookups and set the pfSense to use DNS Resolver -
So I did a fresh install.
I can't check the box "Enable Forwarding Mode" in DNS Resolving tab if I don't specify one DNS Server in General Setup. On both install i get that
Are you really sure I musn't had my NAT Gateway as a DNS server ? Because that's the only way I could resolve something, at least on the WAN interface. If I do that, i get the same error using the LAN ip address when using nslookup SERVFAIL
Old and fresh install appear to have the same issueAlso what's the difference between the DNS Resolving mode + "Enable Forwading Mode" enabled, and the DNS Forwarding mode ?
Edit : With the DNS Resolver + Enable Forwarding Mode checked, I get this from the dig command (both install) :
; <<>> DiG 9.14.12 <<>> @172.16.1.2 cnn.com ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 3781 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 512 ;; QUESTION SECTION: ;cnn.com. IN A ;; Query time: 84 msec ;; SERVER: 172.16.1.2#53(172.16.1.2) ;; WHEN: Thu Jul 23 13:35:05 CEST 2020 ;; MSG SIZE rcvd: 36
I'm strill not getting why I can't resolve from a LAN interface
-
@Hekmil Now that we have unbound (the pfsense dns resolver) talking to the world, we can move forward.
The best is letting pfsense contact root servers and work the hierarchy until name resolution.
This requires internet access to port 53 servers.
If thats not the case, then you need to specify a forwarder.
(as the webinterface dictates).The difference between resolver with forwarder and plain forwarder is local caching, negative caching, local names, dhcp integration, to name a few.
dns forwarder is a rather old, solution to the same problem.Obviously your nat gateway is filtering dns requests, so using it is the only way to get dns to resolve.
-
@Hekmil said in Windows Server DNS Server can't forward to pfSense:
I'm strill not getting why I can't resolve from a LAN interface
What do you mean ? dig says you can.
-
@netblues yes dig says I can, but if I nslookup again from my lan IP I can't. Still getting the SERVFAIL.
-
@Hekmil server fail means can't get response from upstream.
This is expectedEnable dns resolver forwading to your dns gateway and it will also work
-
@netblues DNS Resolver Forwarding mode is enabled
-
@Hekmil and what do you have in system\general\dns ?
-
@netblues My NAT Gateway as DNS Server
The 2 boxes are checked. I've try to uncheck them to randomly test something but as expected nothing different
-
@Hekmil dig @yournasip cnn.com
what happens? -
@netblues With NAT ip address everything is fine, just switching to LAN ip won't make it
; <<>> DiG 9.14.12 <<>> @192.168.101.2 cnn.com ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 63875 ;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 4, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; MBZ: 0x0005, udp: 4096 ;; QUESTION SECTION: ;cnn.com. IN A ;; ANSWER SECTION: cnn.com. 5 IN A 151.101.129.67 cnn.com. 5 IN A 151.101.65.67 cnn.com. 5 IN A 151.101.193.67 cnn.com. 5 IN A 151.101.1.67 ;; AUTHORITY SECTION: cnn.com. 5 IN NS ns-1086.awsdns-07.org. cnn.com. 5 IN NS ns-1630.awsdns-11.co.uk. cnn.com. 5 IN NS ns-47.awsdns-05.com. cnn.com. 5 IN NS ns-576.awsdns-08.net. ;; Query time: 11 msec ;; SERVER: 192.168.101.2#53(192.168.101.2) ;; WHEN: Thu Jul 23 14:42:25 CEST 2020 ;; MSG SIZE rcvd: 236
-
@Hekmil But you get server failed, not no servers can be reached, right?
ping -S 172.16.1.2 192.168.101.2 works?
-
@netblues Yes I get
Server can't find cnn.com : SERVFAIL
No it doesn't ping, that might be a route issue no ?