simple local DNS entries (unbound "vs" dnsmasq)
-
Default is unbound, resolving with dnssec - why would you think you need to change that?
No there would be no reason to run both in a common setup.
Unless there is something specific that unbound is not doing? Or something that is not working in resolve mode with dnssec.. Why would you change it?
-
OK, one more question: Right now I have the PFSense device NOT as the router. But independent of that, how do I add an alias (CNAME) for the PFSense box itself, e.g. as "ns.mydomain.com", to the unbound configuration?
-
To add other record types you would do that in the custom option box in the unbound section of the gui.
But a cname in anything but an authoritative ns normally doesn't make any sense.. You have something that would be doing a cname query?
cnames are records you use on an authoritative ns.. What exactly do you want to resolve, if you want ns.mydomain.com to resolve that would just be a A record.
If you want to point to some other NS to resolve something that would be a domain override
-
So, a "local-data" A record without the "local-data-ptr" entry?
(I'm starting with what I had in my previous OS X Server DNS 'mdns'? configuration)
-
Huh? What dns server were you running on your OS X server?
unbound or dnsmasq are not meant to be authoritative NS, if your goal is to run an authoritative ns on pfsense, then install the bind package.
but you don't actually need a authoritative ns to resolve some local names. If you want ns.domain.tld to resolve that would be a simple host override
-
@johnpoz Exactly! On the OS X Server setup, that did provide an authoritative name service. (And the rest of OS X Server depended on getting the DNS configured EXACTLY CORRECTLY, which I found out The Hard Way when I first started using OS X Server...)
But for most SOHO (small office/home office) setups, local names are all that is really needed. It's certainly all I need.
(In defense of OS X Server, its original target was not SOHO setups, but rather full up enterprises, particularly schools, where an authoritative name server made more sense.)
When I get the local DNS set up, I can 'decommission' my OS X Server instance for internal use (I have another instance hosting public websites, but that's a whole 'nuther issue not relevant to PFSense.)
-
mdns is quite different than just normal dns.. And normally would have zero use in any sort of enteprise or school, etc.
You could have hundreds or even 1000's of fqdn that resolve just using unbound or dnsmasq.. There is little need of actual authoritative ns.. Even in an enterprise you could get by without one.. All comes down to what exactly your doing.. None of which would be related to mdns to be honest.
If you have a list of stuff to resolve - you can for sure input that into unbound so they resolve.. But if what you want is to run actual authoritative NS, then just install the bind package.
-
OK. But I didn't see an answer to my question about exactly how to add the alias. Is "local-data: ns2.mydomain.com A 192.168.10.88" sufficient (where 192.168.10.88 is PFSense on my mydomain.com network's LAN port)?
-
In particular, when I put this line in the "Custom Options" box, I got an error message:
local-data: "ns2.mydomain.com. A 192.168.10.88"
What am I doing wrong?
-
The following works for me, try removing the trailing .
local-data: "ping.ui.com A 127.0.0.1"
local-data: "ping.ui.com AAAA ::1" -
Did you put a server: in the custom option box before you made any entries?
No reason to put that in the custom box though, unless you have lots them and you just want to paste them in.. such a record you can just put in the host override via the gui entry.
-
@johnpoz That fixed it, thanks!
-
If all you have is A records, and there isn't all that many of them to put in at the same time.. Might be easier to just use the gui to put them in.. I leave the custom option box for stuff that can not put in the gui.
example
private-domain: "plex.direct" local-zone: "use-application-dns.net" always_nxdomain local-zone: "local." always_nxdomainOr if you want to alter the TTL of a record to be something other than default.
But if you do have a lot of them, then yeah a simple paste of them would be faster ;)
-
@johnpoz I don't -think- I could use the Host Overrides to add the A record to add an alias for the PFSense box itself. For that, I just want an alias, I don't want to define the reverse look-up to the alias.
-
Sure you can.. host override is host override..
So you don't want the ptr to resolve? Doesn't make a lot of sense..
-
@deemery said in simple local DNS entries (unbound "vs" dnsmasq):
If all I need is DNS name resolution for names inside my local network
When you set up pfSense like this :
You will find in the /etc/hosts file this :
127.0.0.1 localhost localhost.my-local-domain.tld ::1 localhost localhost.my-local-domain.tld 192.168.1.1 myrouter.my-local-domain.tld myrouter 2001:470:dead:beef:2::1 myrouter.my-local-domain.tld myrouter .....Every other known host will also be present in that file.
Any modern OS has a /etc/hosts file (yep, even windows, it's in the system root, in /etc/hosts)
DHCP lease info (IP and host name) will be recorded.
Static hosts will be recorded there also.And this file is used by the local 'DNS' ...
So, with you doing nothing, it already works just fine.
-
Also at a loss why your firewall would need an alias in the first place to be honest.. Its 1 device, why would you not just access via its actual name and record? you normally don't host other services on it, like websites or something that you would want/need to use another name.
-
@johnpoz said in simple local DNS entries (unbound "vs" dnsmasq):
Also at a loss why your firewall would need an alias in the first place to be honest.. Its 1 device, why would you not just access via its actual name and record? you normally don't host other services on it, like websites or something that you would want/need to use another name.
That's a fair question. 3 partial answers :-) :-)
-
naming convention I'm used to. "ns.mydomain.com" is the name for the domain server. Considering I don't do this kind of work all the time, there is substantial value to following naming conventions so when I come back in a year or two, it's easier to figure out what I did previously.
-
Generally, I want to "change it once and leave it alone" when it comes to network settings across devices. That's particularly true for the ~10 devices on my home network (including iPhone/iPad)
-
right now, the PFSense is NOT my router/firewall device. But come to think of it, if I do change that, I'll have to touch all the device network settings anyway.
In the short run, I want to get DNS on PFSense working first. Then I can decommission the OS X Server instance that now provides DNS, knowing that (after I change the network settings across my network devices :-) ) name resolution will work. Then I can slowly experiment with other PFSense services. (Starting with VPN, then moving to DHCP and firewall.)
And @Gertjan , no /etc/hosts access on iDevices like iPhone or iPad. There's not much dependency in these devices for local names in mydomain.com, but I still want things to be consistent across the set of devices. (I'm not quite sure how "Files" works on iPad, probably .local/bonjour networking....)
-
-
@deemery said in simple local DNS entries (unbound "vs" dnsmasq):
@Gertjan , no /etc/hosts access on iDevices like iPhone or iPad.
I have those in my /etc/hosts file. All of them. 4 iPhones, and an iPad.
Because all these devices, from Samsung, Apple, Dell, etc do the same thing : they have and use a DHCP client. So the DHCP server answering them (pfSEnse) - and some code magic, and ... they wind up in /etc/.hosts
And, again, this file is used by the unbound (resolver) or dnsmasq, the forwarder.
The /etc/hosts file is the local (for pfSense) "database" with known local LAN based devices. -
The only issue with registering of dhcp clients in unbound, is it restarts unbound.. So depending on how many clients you have, and how short your lease time is.. There can be some issues with unbound restarting all the time.
I don't register dhcp clients for this reason.. All clients I want to be able to resolve have reservations - which I do register..
Most people will not have problem with unbound restarting... Not great for your cache ;) But normally people will not see any issues with it doing that.
But yeah sure, out of the box you have some dhcp client - called billy, you would be able to resolve billy.yourdomain.tld because of the dhcp lease being registered in unbound, via addition of it in the host file.
