simple local DNS entries (unbound "vs" dnsmasq)

johnpoz

Huh? What dns server were you running on your OS X server?

unbound or dnsmasq are not meant to be authoritative NS, if your goal is to run an authoritative ns on pfsense, then install the bind package.

but you don't actually need a authoritative ns to resolve some local names. If you want ns.domain.tld to resolve that would be a simple host override

deemery

@johnpoz Exactly! On the OS X Server setup, that did provide an authoritative name service. (And the rest of OS X Server depended on getting the DNS configured EXACTLY CORRECTLY, which I found out The Hard Way when I first started using OS X Server...)

But for most SOHO (small office/home office) setups, local names are all that is really needed. It's certainly all I need.

(In defense of OS X Server, its original target was not SOHO setups, but rather full up enterprises, particularly schools, where an authoritative name server made more sense.)

When I get the local DNS set up, I can 'decommission' my OS X Server instance for internal use (I have another instance hosting public websites, but that's a whole 'nuther issue not relevant to PFSense.)

johnpoz

mdns is quite different than just normal dns.. And normally would have zero use in any sort of enteprise or school, etc.

You could have hundreds or even 1000's of fqdn that resolve just using unbound or dnsmasq.. There is little need of actual authoritative ns.. Even in an enterprise you could get by without one.. All comes down to what exactly your doing.. None of which would be related to mdns to be honest.

If you have a list of stuff to resolve - you can for sure input that into unbound so they resolve.. But if what you want is to run actual authoritative NS, then just install the bind package.

deemery

OK. But I didn't see an answer to my question about exactly how to add the alias. Is "local-data: ns2.mydomain.com A 192.168.10.88" sufficient (where 192.168.10.88 is PFSense on my mydomain.com network's LAN port)?

deemery

In particular, when I put this line in the "Custom Options" box, I got an error message:

local-data: "ns2.mydomain.com. A 192.168.10.88"

What am I doing wrong?

NogBadTheBad

The following works for me, try removing the trailing .

local-data: "ping.ui.com A 127.0.0.1"
local-data: "ping.ui.com AAAA ::1"

johnpoz

Did you put a server: in the custom option box before you made any entries?

No reason to put that in the custom box though, unless you have lots them and you just want to paste them in.. such a record you can just put in the host override via the gui entry.

deemery

@johnpoz That fixed it, thanks!

johnpoz

If all you have is A records, and there isn't all that many of them to put in at the same time.. Might be easier to just use the gui to put them in.. I leave the custom option box for stuff that can not put in the gui.

example

private-domain: "plex.direct"
local-zone: "use-application-dns.net"  always_nxdomain
local-zone: "local."  always_nxdomain

Or if you want to alter the TTL of a record to be something other than default.

But if you do have a lot of them, then yeah a simple paste of them would be faster ;)

deemery

@johnpoz I don't -think- I could use the Host Overrides to add the A record to add an alias for the PFSense box itself. For that, I just want an alias, I don't want to define the reverse look-up to the alias.

johnpoz

Sure you can.. host override is host override..

So you don't want the ptr to resolve? Doesn't make a lot of sense..

Gertjan

@deemery said in simple local DNS entries (unbound "vs" dnsmasq):

If all I need is DNS name resolution for names inside my local network

When you set up pfSense like this :

You will find in the /etc/hosts file this :

127.0.0.1	localhost localhost.my-local-domain.tld
::1	localhost localhost.my-local-domain.tld
192.168.1.1	myrouter.my-local-domain.tld myrouter
2001:470:dead:beef:2::1	myrouter.my-local-domain.tld myrouter
.....

Every other known host will also be present in that file.
Any modern OS has a /etc/hosts file (yep, even windows, it's in the system root, in /etc/hosts)
DHCP lease info (IP and host name) will be recorded.
Static hosts will be recorded there also.

And this file is used by the local 'DNS' ...

So, with you doing nothing, it already works just fine.

johnpoz

Also at a loss why your firewall would need an alias in the first place to be honest.. Its 1 device, why would you not just access via its actual name and record? you normally don't host other services on it, like websites or something that you would want/need to use another name.

deemery

@johnpoz said in simple local DNS entries (unbound "vs" dnsmasq):

Also at a loss why your firewall would need an alias in the first place to be honest.. Its 1 device, why would you not just access via its actual name and record? you normally don't host other services on it, like websites or something that you would want/need to use another name.

That's a fair question. 3 partial answers :-) :-)

naming convention I'm used to. "ns.mydomain.com" is the name for the domain server. Considering I don't do this kind of work all the time, there is substantial value to following naming conventions so when I come back in a year or two, it's easier to figure out what I did previously.
Generally, I want to "change it once and leave it alone" when it comes to network settings across devices. That's particularly true for the ~10 devices on my home network (including iPhone/iPad)
right now, the PFSense is NOT my router/firewall device. But come to think of it, if I do change that, I'll have to touch all the device network settings anyway.

In the short run, I want to get DNS on PFSense working first. Then I can decommission the OS X Server instance that now provides DNS, knowing that (after I change the network settings across my network devices :-) ) name resolution will work. Then I can slowly experiment with other PFSense services. (Starting with VPN, then moving to DHCP and firewall.)

And @Gertjan , no /etc/hosts access on iDevices like iPhone or iPad. There's not much dependency in these devices for local names in mydomain.com, but I still want things to be consistent across the set of devices. (I'm not quite sure how "Files" works on iPad, probably .local/bonjour networking....)

Gertjan

@deemery said in simple local DNS entries (unbound "vs" dnsmasq):

@Gertjan , no /etc/hosts access on iDevices like iPhone or iPad.

I have those in my /etc/hosts file. All of them. 4 iPhones, and an iPad.

Because all these devices, from Samsung, Apple, Dell, etc do the same thing : they have and use a DHCP client. So the DHCP server answering them (pfSEnse) - and some code magic, and ... they wind up in /etc/.hosts
And, again, this file is used by the unbound (resolver) or dnsmasq, the forwarder.
The /etc/hosts file is the local (for pfSense) "database" with known local LAN based devices.

johnpoz

The only issue with registering of dhcp clients in unbound, is it restarts unbound.. So depending on how many clients you have, and how short your lease time is.. There can be some issues with unbound restarting all the time.

I don't register dhcp clients for this reason.. All clients I want to be able to resolve have reservations - which I do register..

Most people will not have problem with unbound restarting... Not great for your cache ;) But normally people will not see any issues with it doing that.

But yeah sure, out of the box you have some dhcp client - called billy, you would be able to resolve billy.yourdomain.tld because of the dhcp lease being registered in unbound, via addition of it in the host file.

deemery

@johnpoz Most of my Macs are both wired and wireless (some Apple services complain if they can't talk to WiFi). For those, I assign a fixed IP and DNS entry for the wired, and let the wireless pick up the DHCP.

But I do have one laptop I carry around the house that is WiFi only. I suppose I should configure that as "DHCP with fixed IP Address" and the associated DNS A record entry.

@Gertjan So your /etc/hosts is only on the PFSense box? That would meet my "define things in only 1 place" objective :-)

johnpoz

@deemery said in simple local DNS entries (unbound "vs" dnsmasq):

(some Apple services complain if they can't talk to WiFi).

Huh? Just out of curiosity.. Your saying some box running some service, while it has a wired connection it puts up some error or info that wireless is not connected? So set these devices up multihomed? Both wired and wireless? That seems counterproductive to me..

deemery

@johnpoz Not an error, but a complaint. Example the Maps application complains "better location accuracy if WiFi is enabled." (Understandable, because I believe they use 'what WiFi can I see near me' to determine location. Google does the same thing, I believe.)

deemery

Well darn! I thought I had this figured out.

I cabled a machine directly to the LAN port, and set the DNS server to the PFSense box using its LAN IP address. That worked, nslookup returned values.

So then I unplugged the LAN cable, and set the DNS server to the PFSense box on the IP address of the WAN port. That did NOT work. And I'm not sure why.... nslookup times out.