host over ride does not work on chrome

scorpoin

@teamits

I guess you are right but thing is those names are not for pfsense itself , those are suppose to be local web server on LAN.

Regards

scorpoin

@johnpoz

You are right I'm doing DNS forwarder here is Setting-->General Setup

System General Setup.png

And DNS Resolver Config Screen

Services DNS Resolver General Settings.png

I've a static IP from ISP . When I remove the check of DNS Server Override in General Setup . Internet on client side stop working and unable to resolve any thing : / . Although on DHCP Server DNS list I've added my Pfsense IP as primary and seconday google-DNS .
Regards

Regards

johnpoz

Fix your dns.. Problem solved.

Although on DHCP Server DNS list I've added my Pfsense IP as primary and seconday google-DNS .

That setup is borked out of the gate.. You don't control what dns a client uses if you give them more than 1. If they don't both resolve the same thing, then you have no idea what a client might be able to resolve or not..

If you want to forward to google, then do that.. But your clients should only get pfsense for their dns, if you ever expect a client to resolve local resources.

Also if your going to forward, dnssec is pointless to have checked.

Why are you forcing pfsense dns out some gateway?

scorpoin

That was an optional and I've removed it as well . Now issue is when I remove the check from DNS Overide in General Setup or from DNS Resolver configuration all of sudden clients are unable to access internet :/ which I could not figure it out yet . where am I doing wrong in configuration .

Regards

Gertjan

@scorpoin said in host over ride does not work on chrome:

Now issue is when I remove the check from DNS Overide in General Setup

This one :

?

That was a practice in the past, somewhere in the last century I guess, when users had to use the DNS of their ISP.
The ISP boxes forward to the DNS of the ISP - and the box handles all it's clients DNS requests, who forwarding it upstream with some caching facilities.

I guess this option still exist for historical reasons.
pfSense, when you unpack it, is set up for perfect DNS handling. If there are DNS issues, the issue is upstream. => Ditch your ISP.

@scorpoin said in host over ride does not work on chrome:

Now issue is when I remove the check ..... from DNS Resolver configuration all of sudden clients are unable to access internet

What check where on that page ?

These settings :

are default and perfect.

( Note that I also use pfBlockerNG 3.0.0.3, so two options are set accordingly.

scorpoin

@gertjan

Thanks I've tried selecting python mode but I'm unable to find any thing in drop down list.

Python Module Script :

there was not any thing like pf-unbound or such .

Regards

Gertjan

@scorpoin said in host over ride does not work on chrome:

I've tried selecting python mode but I'm unable to find any thing in drop down list.

Because :

@gertjan said in host over ride does not work on chrome:

Note that I also use pfBlockerNG 3.0.0.3, so two options are set accordingly.

AND

I activated unbound + python mode in pfBlockerNG 3.0.0.3 - and after this you'll see

because unbound uses this python module to do "pfBlockerNG " stuff.

johnpoz

Lets forget pfblocker until you actually have dns working and working for your host overrides.

Where do you want to forward too?

202.143.112.206

206.112.143.202.in-addr.arpa. 86400 IN  PTR     ftth-112-206.satcomm.pk

Is that your ISP dns? Do they support dns over TLS? I doubt it to be honest..

If your going to use dns over tls, you have to set the host name for the dns to be used.. So the cert will work.. While it still might work - you can run into issues where it wont even work.. If your going to use dot, you really should have hat that set correctly for the dot server your going to use.

https://docs.netgate.com/pfsense/en/latest/recipes/dns-over-tls.html

The hostname is technically optional but dangerous to omit. The DNS Resolver must have the hostname to validate that the correct server is providing a given response. The response is still encrypted without the hostname, but the DNS Resolver has no way to validate the response to determine if the query was intercepted and answered by a third party server (Man-in-the-Middle attack).

I would suggest you get basic forwarding working.. Before you try and move to dns over tls.

So either go back to default setup, where unbound just resolves. Or start with basic forwarding, then move to over tls.

Be it your forwarding or resolving works or doesn't work has nothing to do with a host override, because that is just a local resource.. if unbound is running, it would return any host overrides it has setup.

So do a simple query to an IP that pfsense is listening for dns on, by default this is all.. And do a query for your host override.. If that works.. Then ANYTHING that does not return that be it chrome or firefox or some pc, laptop or phone, etc.. is NOT USING pfsense as its dns.. If it was - then it would return the IP you setup in your host override..

I showed an example of this.. So use your fav dns tool, nslookup, dig, host, etc. and do the query.. What do you get?

scorpoin

@johnpoz

well when doing dig my-domain.com or subdomain.com it does return local ip address which I set in DNS Host override .

Regards

johnpoz

Well then as I was saying your override is working, and your browser or device is not using pfsense as your dns..

Most likely doh, you know the browser makers looking out for your security by sending all your dns queries to them, vs where you actually want to send them.