Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Windows Server DNS Server can't forward to pfSense

    Scheduled Pinned Locked Moved DHCP and DNS
    52 Posts 3 Posters 10.1k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • H
      Hekmil
      last edited by

      Ok so I fully understood what you both said.

      I can try make a fresh install with on a different machine to try out if it comes from the VM.

      I'll put nothing in the DNS Server boxes of the General Setup to try only using the unbound for lookups and set the pfSense to use DNS Resolver

      1 Reply Last reply Reply Quote 0
      • H
        Hekmil
        last edited by Hekmil

        So I did a fresh install.

        I can't check the box "Enable Forwarding Mode" in DNS Resolving tab if I don't specify one DNS Server in General Setup. On both install i get that

        Are you really sure I musn't had my NAT Gateway as a DNS server ? Because that's the only way I could resolve something, at least on the WAN interface. If I do that, i get the same error using the LAN ip address when using nslookup SERVFAIL
        Old and fresh install appear to have the same issue

        Also what's the difference between the DNS Resolving mode + "Enable Forwading Mode" enabled, and the DNS Forwarding mode ?

        Edit : With the DNS Resolver + Enable Forwarding Mode checked, I get this from the dig command (both install) :

        ; <<>> DiG 9.14.12 <<>> @172.16.1.2 cnn.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 3781
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;cnn.com.			IN	A

;; Query time: 84 msec
;; SERVER: 172.16.1.2#53(172.16.1.2)
;; WHEN: Thu Jul 23 13:35:05 CEST 2020
;; MSG SIZE  rcvd: 36

        I'm strill not getting why I can't resolve from a LAN interface

        N 2 Replies Last reply Reply Quote 0
        • N
          netblues @Hekmil
          last edited by

          @Hekmil Now that we have unbound (the pfsense dns resolver) talking to the world, we can move forward.

          The best is letting pfsense contact root servers and work the hierarchy until name resolution.
          This requires internet access to port 53 servers.
          If thats not the case, then you need to specify a forwarder.
          (as the webinterface dictates).

          The difference between resolver with forwarder and plain forwarder is local caching, negative caching, local names, dhcp integration, to name a few.
          dns forwarder is a rather old, solution to the same problem.

          Obviously your nat gateway is filtering dns requests, so using it is the only way to get dns to resolve.

          1 Reply Last reply Reply Quote 0
          • N
            netblues @Hekmil
            last edited by

            @Hekmil said in Windows Server DNS Server can't forward to pfSense:

            I'm strill not getting why I can't resolve from a LAN interface

            What do you mean ? dig says you can.

            H 1 Reply Last reply Reply Quote 0
            • H
              Hekmil @netblues
              last edited by Hekmil

              @netblues yes dig says I can, but if I nslookup again from my lan IP I can't. Still getting the SERVFAIL.

              N 1 Reply Last reply Reply Quote 0
              • N
                netblues @Hekmil
                last edited by

                @Hekmil server fail means can't get response from upstream.
                This is expected

                Enable dns resolver forwading to your dns gateway and it will also work

                1 Reply Last reply Reply Quote 0
                • H
                  Hekmil
                  last edited by

                  @netblues DNS Resolver Forwarding mode is enabled

                  N 1 Reply Last reply Reply Quote 0
                  • N
                    netblues @Hekmil
                    last edited by netblues

                    @Hekmil and what do you have in system\general\dns ?

                    H 1 Reply Last reply Reply Quote 0
                    • H
                      Hekmil @netblues
                      last edited by Hekmil

                      @netblues My NAT Gateway as DNS Server

                      The 2 boxes are checked. I've try to uncheck them to randomly test something but as expected nothing different

                      N 1 Reply Last reply Reply Quote 0
                      • N
                        netblues @Hekmil
                        last edited by

                        @Hekmil dig @yournasip cnn.com
                        what happens?

                        H 1 Reply Last reply Reply Quote 0
                        • H
                          Hekmil @netblues
                          last edited by

                          @netblues With NAT ip address everything is fine, just switching to LAN ip won't make it

                          ; <<>> DiG 9.14.12 <<>> @192.168.101.2 cnn.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 63875
;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 4, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; MBZ: 0x0005, udp: 4096
;; QUESTION SECTION:
;cnn.com.			IN	A

;; ANSWER SECTION:
cnn.com.		5	IN	A	151.101.129.67
cnn.com.		5	IN	A	151.101.65.67
cnn.com.		5	IN	A	151.101.193.67
cnn.com.		5	IN	A	151.101.1.67

;; AUTHORITY SECTION:
cnn.com.		5	IN	NS	ns-1086.awsdns-07.org.
cnn.com.		5	IN	NS	ns-1630.awsdns-11.co.uk.
cnn.com.		5	IN	NS	ns-47.awsdns-05.com.
cnn.com.		5	IN	NS	ns-576.awsdns-08.net.

;; Query time: 11 msec
;; SERVER: 192.168.101.2#53(192.168.101.2)
;; WHEN: Thu Jul 23 14:42:25 CEST 2020
;; MSG SIZE  rcvd: 236
                          N 1 Reply Last reply Reply Quote 0
                          • N
                            netblues @Hekmil
                            last edited by

                            @Hekmil But you get server failed, not no servers can be reached, right?

                            ping -S 172.16.1.2 192.168.101.2 works?

                            H 1 Reply Last reply Reply Quote 0
                            • H
                              Hekmil @netblues
                              last edited by Hekmil

                              @netblues Yes I get Server can't find cnn.com : SERVFAIL

                              No it doesn't ping, that might be a route issue no ?

                              N 1 Reply Last reply Reply Quote 0
                              • N
                                netblues @Hekmil
                                last edited by

                                @Hekmil Do you have outbound nat enabled on your wan interface?

                                H 1 Reply Last reply Reply Quote 0
                                • H
                                  Hekmil @netblues
                                  last edited by

                                  @netblues Oh my god...

                                  The Outbound NAT configuration was set to automatic (which should have been enought right ?). So I tried to switch to manual and create a map ANY/ANY on WAN and everything works !

                                  N 1 Reply Last reply Reply Quote 0
                                  • N
                                    netblues @Hekmil
                                    last edited by

                                    @Hekmil Your configuration is not exactly typical and "automatic" things sometimes fail.
                                    From a technical point of view, pf being a router, you shouldn't need nat to reach an rfc1918 address.
                                    I suspect that packets reach your nas gateway, but never return.

                                    Most probably your nas gateway needs a route back for 172.16.1.0/24 pointing to your pfwan interface ip.
                                    Natting, (double) just makes the call originate from the wan interface.
                                    And connected networks don't need routes.

                                    H 1 Reply Last reply Reply Quote 0
                                    • H
                                      Hekmil @netblues
                                      last edited by

                                      @netblues Yes I also think it reachs the nat gateway considering the logs but never returning.

                                      I don't know how and where to set a route for my nat gateway though

                                      N 1 Reply Last reply Reply Quote 0
                                      • N
                                        netblues @Hekmil
                                        last edited by

                                        @Hekmil Maybe you can't. You have to figure this out
                                        In the mean time, stay with double nat.
                                        For simple internet connectivity and dns resolution it won't make any difference.

                                        H 1 Reply Last reply Reply Quote 0
                                        • H
                                          Hekmil @netblues
                                          last edited by

                                          @netblues I'm pretty I can't yes, so far the only thing I could change about the NAT configuration was the network IP and Gateway.

                                          Yeah it'll do juste fine. Thanks anyway !

                                          1 Reply Last reply Reply Quote 0
                                          • First post
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.