(solved) 2.5 connecting via hostname not working across interfaces
-
@johnpoz Always used the most recent version and my client is Windows without a domain. And I changed the domain in 2.4.5p1 to home.arpa already and that hostname only thing still has worked for my. So the only thing changed was a fresh install of pfSense version 2.5!
If I remember correct you had to do a reboot on pfSense to get this working, after adding the static mappings in the DHCP server. -
cat /etc/hosts
Is the devices to which you RDP-connect listed ?
I can (pfSense 2.5.0) use host names :
No need to use the hostname.network.tld format, although that works to.
Btw : the device I RDP to have static DJCP MAC leases.
-
@gertjan Hey gertjan, they are listed with IP, domain name and hostname only and it is still not possible for me to connect via hostname only, if the target is on another interface/subnet. And that has worked before. Maybe it shouldn't work, then I am ok with it, I am open to change, but found it noteworthy.
-
The /etc/hosts file is used to populate the local unbound resolve cache.
So, unbound knows about them.Check for yourself, on the console :
dig @127.0.0.1 device
It should give you the correct answer.
Now, dig (or nslookup) on the device from where you RDP from. Is DNS working ? If yes, it should resolve the hostname you are using to connect to.
-
@gertjan It is not working like that in a fresh pfSense 2.5 I guess:
[2.5.0-RELEASE][admin@pfSense.home.arpa]/root: dig @127.0.0.1 mail ; <<>> DiG 9.16.11 <<>> @127.0.0.1 mail ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 57206 ;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 512 ;; QUESTION SECTION: ;mail. IN A ;; AUTHORITY SECTION: . 3600 IN SOA a.root-servers.net.nstld.verisign-grs.com. 2021030100 1800 900 604800 86400 ;; Query time: 7 msec ;; SERVER: 127.0.0.1#53(127.0.0.1) ;; WHEN: Mon Mar 01 09:33:29 CET 2021 ;; MSG SIZE rcvd: 108 [2.5.0-RELEASE][admin@pfSense.home.arpa]/root: dig @127.0.0.1 mail.home.arpa ; <<>> DiG 9.16.11 <<>> @127.0.0.1 mail.home.arpa ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 29863 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 512 ;; QUESTION SECTION: ;mail.home.arpa. IN A ;; ANSWER SECTION: mail.home.arpa. 3600 IN A 192.168.92.10 ;; Query time: 0 msec ;; SERVER: 127.0.0.1#53(127.0.0.1) ;; WHEN: Mon Mar 01 09:36:17 CET 2021 ;; MSG SIZE rcvd: 59 [2.5.0-RELEASE][admin@pfSense.home.arpa]/root:
-
@bob-dig
See the image of mu RDP connect above, it lists my LAn device I 'RDP' to .The full (local) domain name was needed :
[2.5.0-RELEASE][admin@pfsense.me.net]/boot/kernel: dig Bureau2 +short [2.5.0-RELEASE][admin@pfsense.me.net]/boot/kernel: dig Bureau2.me.net +short 192.168.1.2
From a windows device,it worked with the host name only :
C:\Users\Gauche>nslookup Bureau2 Serveur : pfsense.me.net Address: 2001:470:1f13:5c0:2::1 Nom : Bureau2.me.net Addresses: 2001:470:1f13:5c0:2::88 192.168.1.2
Probably because my Windows prefixes (appended ?) the local domain name.
-
@gertjan It is not working here and my windows is not new. Host file is empty on it, just checked. And it had worked on the last days of the old pfSense, where I already changed the domain to home.arpa...
PS C:\WINDOWS\system32> nslookup mail Server: pfSense.home.arpa Address: 192.168.1.1 *** pfSense.home.arpa can't find mail: Non-existent domain PS C:\WINDOWS\system32> nslookup mail.home.arpa Server: pfSense.home.arpa Address: 192.168.1.1 Name: mail.home.arpa Address: 192.168.92.10 PS C:\WINDOWS\system32>
-
@bob-dig said in 2.5 connecting via hostname not working across interfaces:
and my windows is not new. Host file is empty on it,
The host file on windows == don't care.
I was talking about the hosts file of pfSense.Make your Windows IPv4 DHCP "domain name aware" :
-
@gertjan Thanks for the solution.
Although it was not the point of my posting. -
@bob-dig said in 2.5 connecting via hostname not working across interfaces:
@gertjan Thanks for the solution.
Although it was not the point of my posting.Ah, yes, the issue :
@bob-dig said in 2.5 connecting via hostname not working across interfaces:
I used to connect RDP via hostname, this has always worked for me with 2.4.5.
Now with a fresh 2.5 it works only on the same interface.Check :
Can you actually connect from 'a network' to 'another network' : check your firewall wall rules on the 'a network' interface.
Also : the system you RDP to accepts connection form the 'a network' ? and not only from its own network ?I didn't detect any changes. I can still RDP into my 'local' systems using aremote VPN access etc.
-
@gertjan RDP just works fine via FQDN, so it is the pfSense DNS-Resolver which now behaves differently, thanks to all our testing, I would say.
-
@bob-dig said in 2.5 connecting via hostname not working across interfaces:
DNS-Resolver which now behaves differently
Again what version of pfsense were you on?? 2.3.3 fixed the problem of resolving just hostnames.
https://docs.netgate.com/pfsense/en/latest/releases/2-3-3.html#dns-resolver-forwarder
Changed behavior of DNS Resolver overrides to only add FQDN entries, not short hostnames #6064That was Feb of 2017
-
@johnpoz 2.4.5.p1, as I said, always the latest. So you say, it is not a bug, it is feature? I can't quite see it, but good to know.
I think I started with pfSense with 2.4.4., but not sure exactly.
The other change is I now use a gen2 VM instead of a gen1 VM and another NIC (Hyper-V). -
It resolving just hostname was a bug yes.
dns - to resolve it must be fqdn.
-
Or another thing that could be the culprit would be the DHCP Domain added to your client. If that changed in your new install of 2.5 or you added VLANs and used different Domain parts in DHCP for those (vlan1.home.arpa, vlan2.home.arpa, lan.home.arpa etc) and/or your windows client didn't get the domain search path (or a new one), a lookup of "nslookup <name>" won't get resolved anymore. With domain search path set to "home.arpa" that should be extended to "<name>.home.arpa" and if that won't exist or is unknown to unbound, that won't get you far. I think there was some bug/problem with DHCP and different default domains or search paths per VLAN but I'm not entirely sure ;)
But setting the domain search path in DHCP (or manually adding the suffix as Gertjan pointed out on the client itself) should let Windows resolve hostnames only
-
@jegr Definitely did none of those things before and now.
But RDP-Client is very sticky with targets anyway so there will be no discomfort once I have all of them in there and I deleted all hostnames.
-
Meanwhile it is working like in the past, hostname only connecting without a problem, although ubound still couldn't answer. Maybe a windows "feature".
Probably not related to pfSense in the first place.
-
@bob-dig said in [solved] 2.5 connecting via hostname not working across interfaces:
hostname only connecting without a problem
Your either doing discovery - which would be same L2, or your windows clients are adding suffix like they are suppose to..
Sorry but it is not possible to do discovery, be it broadcast, multicast, LLDP, WSD, etc. across vlans.. For dns to respond the query has to be fully qualified.
You running an old school WINS ;)
example... Here I only ask for sg4860, but you see the actual query sent via nslookup is sg4860.local.lan.. Because windows has that as its search suffix.
C:\>nslookup Default Server: pi-hole.local.lan Address: 192.168.3.10 > set querytype=A > set debug > sg4860 Server: pi-hole.local.lan Address: 192.168.3.10 ------------ Got answer: HEADER: opcode = QUERY, id = 2, rcode = NOERROR header flags: response, want recursion, recursion avail. questions = 1, answers = 1, authority records = 0, additional = 0 QUESTIONS: sg4860.local.lan, type = A, class = IN ANSWERS: -> sg4860.local.lan internet address = 192.168.9.253 ttl = 3547 (59 mins 7 secs) ------------ Non-authoritative answer: Name: sg4860.local.lan Address: 192.168.9.253 >
C:\>ipconfig /all Windows IP Configuration Host Name . . . . . . . . . . . . : I5-Win Primary Dns Suffix . . . . . . . : local.lan Node Type . . . . . . . . . . . . : Broadcast IP Routing Enabled. . . . . . . . : No WINS Proxy Enabled. . . . . . . . : No DNS Suffix Search List. . . . . . : local.lan
-
@johnpoz It is still looking different here:
PS C:\WINDOWS\system32> nslookup Default Server: pfSense.home.arpa Address: 192.168.1.1 > set querytype=A > set debug > mail Server: pfSense.home.arpa Address: 192.168.1.1 ------------ Got answer: HEADER: opcode = QUERY, id = 2, rcode = NXDOMAIN header flags: response, want recursion, recursion avail. questions = 1, answers = 0, authority records = 1, additional = 0 QUESTIONS: mail, type = A, class = IN AUTHORITY RECORDS: -> (root) ttl = 612 (10 mins 12 secs) primary name server = a.root-servers.net responsible mail addr = nstld.verisign-grs.com serial = 2021031001 refresh = 1800 (30 mins) retry = 900 (15 mins) expire = 604800 (7 days) default TTL = 86400 (1 day) ------------ *** pfSense.home.arpa can't find mail: Non-existent domain
PS C:\WINDOWS\system32> ipconfig -all Windows IP Configuration Host Name . . . . . . . . . . . . : U5 Primary Dns Suffix . . . . . . . : Node Type . . . . . . . . . . . . : Hybrid IP Routing Enabled. . . . . . . . : No WINS Proxy Enabled. . . . . . . . : No DNS Suffix Search List. . . . . . : home.arpa
Really have no clue why it is working again and not before.
-
My turn :
I don't have a local host name called 'mail', but I have one called 'diskstation2' :C:\Users\Gauche>nslookup Serveur par dÚfaut : pfsense.my-domain.net Address: 2001:470:1f13:5c0:2::1 > set querytype=A > set debug > diskstation2 Serveur : pfsense.my-domain.net Address: 2001:470:1f13:5c0:2::1 ------------ Got answer: HEADER: opcode = QUERY, id = 2, rcode = NOERROR header flags: response, auth. answer, want recursion, recursion avail. questions = 1, answers = 1, authority records = 0, additional = 0 QUESTIONS: diskstation2.my-domain, type = A, class = IN ANSWERS: -> diskstation2.my-domain.net internet address = 192.168.1.33 ttl = 3600 (1 hour) ------------ Nom : diskstation2.my-domain.net Address: 192.168.1.33 >
C:\Users\Gauche>ipconfig -all Configuration IP de Windows Nom de l’hôte . . . . . . . . . . : Gauche2 ...... Liste de recherche du suffixe DNS.: my-domain.net Carte Ethernet Ethernet : Suffixe DNS propre à la connexion. . . : my-domain.net Description. . . . . . . . . . . . . . : Intel(R) Ethernet Connection (11) I219-LM Adresse physique . . . . . . . . . . . : A4-BB-AC-BA-16-A1 DHCP activé. . . . . . . . . . . . . . : Oui Configuration automatique activée. . . : Oui Adresse IPv6. . . . . . . . . . . . . .: 2001:470:beef:5c0:2::c7(prefered) Bail obtenu. . . . . . . . . . . . . . : mercredi 10 mars 2021 06:51:57 Bail expirant. . . . . . . . . . . . . : jeudi 11 mars 2021 10:04:47 Adresse IPv6 de liaison locale. . . . .: fe80::410c:5e0d:e1a1:6075%10(prefered) Adresse IPv4. . . . . . . . . . . . . .: 192.168.1.6(prefered) Masque de sous-réseau. . . . . . . . . : 255.255.255.0 Bail obtenu. . . . . . . . . . . . . . : mercredi 10 mars 2021 08:18:04 Bail expirant. . . . . . . . . . . . . : vendredi 12 mars 2021 00:38:52 Passerelle par défaut. . . . . . . . . : fe80::215:17ff:fe77:d118%10 192.168.1.1 Serveur DHCP . . . . . . . . . . . . . : 192.168.1.1 IAID DHCPv6 . . . . . . . . . . . : 111459181 DUID de client DHCPv6. . . . . . . . : 00-01-00-01-26-AC-DF-8D-BB-BB-6D-BA-16-A1 Serveurs DNS. . . . . . . . . . . . . : 2001:470:1f13:5c0:2::1 192.168.1.1
Your 'unbound' doesn't know it lives in "home.arpa" so it should (should it ?) try also
mail.home.arpa
which should be in the /etc/hosts file on pfSense, thus known to unbound, as it reads /etc/hosts at start-up.
IF not, give that host called 'mail' a static DHCP MAC lease **, or host override it on the unbound settings page.** and keep this checked :
edit : I'm not using a domain like "home.arpa". As I need known 'cert' on my LAN, I use a 'real' (rented) domain name for internal uses and acme. I don't think that difference matters.
My unbound knows that :diskstaion2 is local, as it is definced in /etc/hosts/
..... 192.168.1.33 DiskStation2.my-domain.net DiskStation2 ....
Strange to see that unbound even bothers a main root server with a non valid host name like 'mail'.