Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Windows Server DNS Server can't forward to pfSense

    Scheduled Pinned Locked Moved DHCP and DNS
    52 Posts 3 Posters 10.1k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • H
      Hekmil
      last edited by

      @netblues DNS Resolver Forwarding mode is enabled

      N 1 Reply Last reply Reply Quote 0
      • N
        netblues @Hekmil
        last edited by netblues

        @Hekmil and what do you have in system\general\dns ?

        H 1 Reply Last reply Reply Quote 0
        • H
          Hekmil @netblues
          last edited by Hekmil

          @netblues My NAT Gateway as DNS Server

          The 2 boxes are checked. I've try to uncheck them to randomly test something but as expected nothing different

          N 1 Reply Last reply Reply Quote 0
          • N
            netblues @Hekmil
            last edited by

            @Hekmil dig @yournasip cnn.com
            what happens?

            H 1 Reply Last reply Reply Quote 0
            • H
              Hekmil @netblues
              last edited by

              @netblues With NAT ip address everything is fine, just switching to LAN ip won't make it

              ; <<>> DiG 9.14.12 <<>> @192.168.101.2 cnn.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 63875
;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 4, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; MBZ: 0x0005, udp: 4096
;; QUESTION SECTION:
;cnn.com.			IN	A

;; ANSWER SECTION:
cnn.com.		5	IN	A	151.101.129.67
cnn.com.		5	IN	A	151.101.65.67
cnn.com.		5	IN	A	151.101.193.67
cnn.com.		5	IN	A	151.101.1.67

;; AUTHORITY SECTION:
cnn.com.		5	IN	NS	ns-1086.awsdns-07.org.
cnn.com.		5	IN	NS	ns-1630.awsdns-11.co.uk.
cnn.com.		5	IN	NS	ns-47.awsdns-05.com.
cnn.com.		5	IN	NS	ns-576.awsdns-08.net.

;; Query time: 11 msec
;; SERVER: 192.168.101.2#53(192.168.101.2)
;; WHEN: Thu Jul 23 14:42:25 CEST 2020
;; MSG SIZE  rcvd: 236
              N 1 Reply Last reply Reply Quote 0
              • N
                netblues @Hekmil
                last edited by

                @Hekmil But you get server failed, not no servers can be reached, right?

                ping -S 172.16.1.2 192.168.101.2 works?

                H 1 Reply Last reply Reply Quote 0
                • H
                  Hekmil @netblues
                  last edited by Hekmil

                  @netblues Yes I get Server can't find cnn.com : SERVFAIL

                  No it doesn't ping, that might be a route issue no ?

                  N 1 Reply Last reply Reply Quote 0
                  • N
                    netblues @Hekmil
                    last edited by

                    @Hekmil Do you have outbound nat enabled on your wan interface?

                    H 1 Reply Last reply Reply Quote 0
                    • H
                      Hekmil @netblues
                      last edited by

                      @netblues Oh my god...

                      The Outbound NAT configuration was set to automatic (which should have been enought right ?). So I tried to switch to manual and create a map ANY/ANY on WAN and everything works !

                      N 1 Reply Last reply Reply Quote 0
                      • N
                        netblues @Hekmil
                        last edited by

                        @Hekmil Your configuration is not exactly typical and "automatic" things sometimes fail.
                        From a technical point of view, pf being a router, you shouldn't need nat to reach an rfc1918 address.
                        I suspect that packets reach your nas gateway, but never return.

                        Most probably your nas gateway needs a route back for 172.16.1.0/24 pointing to your pfwan interface ip.
                        Natting, (double) just makes the call originate from the wan interface.
                        And connected networks don't need routes.

                        H 1 Reply Last reply Reply Quote 0
                        • H
                          Hekmil @netblues
                          last edited by

                          @netblues Yes I also think it reachs the nat gateway considering the logs but never returning.

                          I don't know how and where to set a route for my nat gateway though

                          N 1 Reply Last reply Reply Quote 0
                          • N
                            netblues @Hekmil
                            last edited by

                            @Hekmil Maybe you can't. You have to figure this out
                            In the mean time, stay with double nat.
                            For simple internet connectivity and dns resolution it won't make any difference.

                            H 1 Reply Last reply Reply Quote 0
                            • H
                              Hekmil @netblues
                              last edited by

                              @netblues I'm pretty I can't yes, so far the only thing I could change about the NAT configuration was the network IP and Gateway.

                              Yeah it'll do juste fine. Thanks anyway !

                              1 Reply Last reply Reply Quote 0
                              • First post
                                Last post
                              Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.