simple local DNS entries (unbound "vs" dnsmasq)

[deemery]

@johnpoz said in simple local DNS entries (unbound "vs" dnsmasq):

Also at a loss why your firewall would need an alias in the first place to be honest.. Its 1 device, why would you not just access via its actual name and record? you normally don't host other services on it, like websites or something that you would want/need to use another name.

That's a fair question. 3 partial answers :-) :-)

1. naming convention I'm used to. "ns.mydomain.com" is the name for the domain server. Considering I don't do this kind of work all the time, there is substantial value to following naming conventions so when I come back in a year or two, it's easier to figure out what I did previously.

2. Generally, I want to "change it once and leave it alone" when it comes to network settings across devices. That's particularly true for the ~10 devices on my home network (including iPhone/iPad)

3. right now, the PFSense is NOT my router/firewall device. But come to think of it, if I do change that, I'll have to touch all the device network settings anyway.

In the short run, I want to get DNS on PFSense working first. Then I can decommission the OS X Server instance that now provides DNS, knowing that (after I change the network settings across my network devices :-) ) name resolution will work. Then I can slowly experiment with other PFSense services. (Starting with VPN, then moving to DHCP and firewall.)

And @Gertjan , no /etc/hosts access on iDevices like iPhone or iPad. There's not much dependency in these devices for local names in mydomain.com, but I still want things to be consistent across the set of devices. (I'm not quite sure how "Files" works on iPad, probably .local/bonjour networking....)

[Gertjan]

@deemery said in simple local DNS entries (unbound "vs" dnsmasq):

@Gertjan , no /etc/hosts access on iDevices like iPhone or iPad.

I have those in my /etc/hosts file. All of them. 4 iPhones, and an iPad.

Because all these devices, from Samsung, Apple, Dell, etc do the same thing : they have and use a DHCP client. So the DHCP server answering them (pfSEnse) - and some code magic, and ... they wind up in /etc/.hosts
And, again, this file is used by the unbound (resolver) or dnsmasq, the forwarder.
The /etc/hosts file is the local (for pfSense) "database" with known local LAN based devices.

[johnpoz]

The only issue with registering of dhcp clients in unbound, is it restarts unbound.. So depending on how many clients you have, and how short your lease time is.. There can be some issues with unbound restarting all the time.

I don't register dhcp clients for this reason.. All clients I want to be able to resolve have reservations - which I do register..

Most people will not have problem with unbound restarting... Not great for your cache ;) But normally people will not see any issues with it doing that.

But yeah sure, out of the box you have some dhcp client - called billy, you would be able to resolve billy.yourdomain.tld because of the dhcp lease being registered in unbound, via addition of it in the host file.

[deemery]

@johnpoz Most of my Macs are both wired and wireless (some Apple services complain if they can't talk to WiFi). For those, I assign a fixed IP and DNS entry for the wired, and let the wireless pick up the DHCP.

But I do have one laptop I carry around the house that is WiFi only. I suppose I should configure that as "DHCP with fixed IP Address" and the associated DNS A record entry.

@Gertjan So your /etc/hosts is only on the PFSense box? That would meet my "define things in only 1 place" objective :-)

[johnpoz]

@deemery said in simple local DNS entries (unbound "vs" dnsmasq):

(some Apple services complain if they can't talk to WiFi).

Huh? Just out of curiosity.. Your saying some box running some service, while it has a wired connection it puts up some error or info that wireless is not connected? So set these devices up multihomed? Both wired and wireless? That seems counterproductive to me..

[deemery]

@johnpoz Not an error, but a complaint. Example the Maps application complains "better location accuracy if WiFi is enabled." (Understandable, because I believe they use 'what WiFi can I see near me' to determine location. Google does the same thing, I believe.)

[deemery]

Well darn! I thought I had this figured out.

I cabled a machine directly to the LAN port, and set the DNS server to the PFSense box using its LAN IP address. That worked, nslookup returned values.

So then I unplugged the LAN cable, and set the DNS server to the PFSense box on the IP address of the WAN port. That did NOT work. And I'm not sure why.... nslookup times out.

[johnpoz]

Well I don't have any apple devices with wired interfaces to test this with, but wouldn't just disable of the wifi interface remove such nonsense popups, etc..

My iphone pops up such info, when using just cell data.. But don't recall ever seeing my PC doing anything like that.. It has a wifi adapter - its just disabled, guess I can turn it on and not connect it and see if get such popups asking to enable wifi..

edit: ok just tested this on my windows PC going to google maps and clicking my location. While the browser asks if ok to hand out info (i have it set not to let sites use location info).. Sure mentions nothing about wifi, I have my wifi adapter enabled, just not connected to anything.

Normally that is just disabled.

Wouldn't it be easier to just disable the hardware of your wifi, if the device is hardwired? Shoot many a laptop device will auto disable wifi when ethernet is connected.. I sure wouldn't multihome a device to remove some info about some stupid app asking me to enable wifi ;) heheh.. If I couldn't turn that off - I wouldn't use such a shitty app to be honest..

[NogBadTheBad]

@johnpoz

Wouldn't it be easier to just disable the hardware of your wifi, if the device is hardwired? Shoot many a laptop device will auto disable wifi when ethernet is connected.. I sure wouldn't multihome a device to remove some info about some stupid app asking me to enable wifi ;) heheh.. If I couldn't turn that off - I wouldn't use such a shitty app to be honest..

You need to switch on Wi-Fi & Bluetooth if you want to unlock your Mac from an Apple Watch if you have one.

It's a right pain, I have a wired Mac that I have to enable Wi-Fi & Bluetooth on.

If I connect to another SSID at home, lets say my GUEST network from my phone and I haven't connected to it before, the SSID is then known on the Mac and it connects automatically, you then have to untick Automatically join this network.

Apples logic on this seems a little braindead.

[johnpoz]

@NogBadTheBad said in simple local DNS entries (unbound "vs" dnsmasq):

Apples logic on this seems a little braindead.

Yeah that is prob an understatement...

If you want to do some proximity unlock thing - wouldn't bluetooth be the better option here? And really the only thing required to be on..

[NogBadTheBad]

@johnpoz said in simple local DNS entries (unbound "vs" dnsmasq):

@NogBadTheBad said in simple local DNS entries (unbound "vs" dnsmasq):

Apples logic on this seems a little braindead.

Yeah that is prob an understatement...

If you want to do some proximity unlock thing - wouldn't bluetooth be the better option here? And really the only thing required to be on..

I'd have thought so :)

[NogBadTheBad]

@johnpoz

edit: ok just tested this on my windows PC going to google maps and clicking my location. While the browser asks if ok to hand out info (i have it set not to let sites use location info).. Sure mentions nothing about wifi, I have my wifi adapter enabled, just not connected to anything.

Normally that is just disabled.

I wonder if Apple also have a database of known SSIDs to GPS location, Apple Maps without Wi-Fi enabled and with from my desktop Mac:-

[deemery]

As a quick update: I now have unbound running as expected, with the PFSense sitting (via the LAN port) on my local network.

Thanks again for all the help. Now I need to decide whether I tackle VPN configuration, or work on PFSense as firewall. :-)