(solved) 2.5 connecting via hostname not working across interfaces
-
It resolving just hostname was a bug yes.
dns - to resolve it must be fqdn.
-
Or another thing that could be the culprit would be the DHCP Domain added to your client. If that changed in your new install of 2.5 or you added VLANs and used different Domain parts in DHCP for those (vlan1.home.arpa, vlan2.home.arpa, lan.home.arpa etc) and/or your windows client didn't get the domain search path (or a new one), a lookup of "nslookup <name>" won't get resolved anymore. With domain search path set to "home.arpa" that should be extended to "<name>.home.arpa" and if that won't exist or is unknown to unbound, that won't get you far. I think there was some bug/problem with DHCP and different default domains or search paths per VLAN but I'm not entirely sure ;)
But setting the domain search path in DHCP (or manually adding the suffix as Gertjan pointed out on the client itself) should let Windows resolve hostnames only
-
@jegr Definitely did none of those things before and now.
But RDP-Client is very sticky with targets anyway so there will be no discomfort once I have all of them in there and I deleted all hostnames.
-
Meanwhile it is working like in the past, hostname only connecting without a problem, although ubound still couldn't answer. Maybe a windows "feature".
Probably not related to pfSense in the first place.
-
@bob-dig said in [solved] 2.5 connecting via hostname not working across interfaces:
hostname only connecting without a problem
Your either doing discovery - which would be same L2, or your windows clients are adding suffix like they are suppose to..
Sorry but it is not possible to do discovery, be it broadcast, multicast, LLDP, WSD, etc. across vlans.. For dns to respond the query has to be fully qualified.
You running an old school WINS ;)
example... Here I only ask for sg4860, but you see the actual query sent via nslookup is sg4860.local.lan.. Because windows has that as its search suffix.
C:\>nslookup Default Server: pi-hole.local.lan Address: 192.168.3.10 > set querytype=A > set debug > sg4860 Server: pi-hole.local.lan Address: 192.168.3.10 ------------ Got answer: HEADER: opcode = QUERY, id = 2, rcode = NOERROR header flags: response, want recursion, recursion avail. questions = 1, answers = 1, authority records = 0, additional = 0 QUESTIONS: sg4860.local.lan, type = A, class = IN ANSWERS: -> sg4860.local.lan internet address = 192.168.9.253 ttl = 3547 (59 mins 7 secs) ------------ Non-authoritative answer: Name: sg4860.local.lan Address: 192.168.9.253 >
C:\>ipconfig /all Windows IP Configuration Host Name . . . . . . . . . . . . : I5-Win Primary Dns Suffix . . . . . . . : local.lan Node Type . . . . . . . . . . . . : Broadcast IP Routing Enabled. . . . . . . . : No WINS Proxy Enabled. . . . . . . . : No DNS Suffix Search List. . . . . . : local.lan
-
@johnpoz It is still looking different here:
PS C:\WINDOWS\system32> nslookup Default Server: pfSense.home.arpa Address: 192.168.1.1 > set querytype=A > set debug > mail Server: pfSense.home.arpa Address: 192.168.1.1 ------------ Got answer: HEADER: opcode = QUERY, id = 2, rcode = NXDOMAIN header flags: response, want recursion, recursion avail. questions = 1, answers = 0, authority records = 1, additional = 0 QUESTIONS: mail, type = A, class = IN AUTHORITY RECORDS: -> (root) ttl = 612 (10 mins 12 secs) primary name server = a.root-servers.net responsible mail addr = nstld.verisign-grs.com serial = 2021031001 refresh = 1800 (30 mins) retry = 900 (15 mins) expire = 604800 (7 days) default TTL = 86400 (1 day) ------------ *** pfSense.home.arpa can't find mail: Non-existent domain
PS C:\WINDOWS\system32> ipconfig -all Windows IP Configuration Host Name . . . . . . . . . . . . : U5 Primary Dns Suffix . . . . . . . : Node Type . . . . . . . . . . . . : Hybrid IP Routing Enabled. . . . . . . . : No WINS Proxy Enabled. . . . . . . . : No DNS Suffix Search List. . . . . . : home.arpa
Really have no clue why it is working again and not before.
-
My turn :
I don't have a local host name called 'mail', but I have one called 'diskstation2' :C:\Users\Gauche>nslookup Serveur par dĂfaut : pfsense.my-domain.net Address: 2001:470:1f13:5c0:2::1 > set querytype=A > set debug > diskstation2 Serveur : pfsense.my-domain.net Address: 2001:470:1f13:5c0:2::1 ------------ Got answer: HEADER: opcode = QUERY, id = 2, rcode = NOERROR header flags: response, auth. answer, want recursion, recursion avail. questions = 1, answers = 1, authority records = 0, additional = 0 QUESTIONS: diskstation2.my-domain, type = A, class = IN ANSWERS: -> diskstation2.my-domain.net internet address = 192.168.1.33 ttl = 3600 (1 hour) ------------ Nom : diskstation2.my-domain.net Address: 192.168.1.33 >
C:\Users\Gauche>ipconfig -all Configuration IP de Windows Nom de lâhĂŽte . . . . . . . . . . : Gauche2 ...... Liste de recherche du suffixe DNS.: my-domain.net Carte Ethernet Ethernet : Suffixe DNS propre Ă la connexion. . . : my-domain.net Description. . . . . . . . . . . . . . : Intel(R) Ethernet Connection (11) I219-LM Adresse physique . . . . . . . . . . . : A4-BB-AC-BA-16-A1 DHCP activĂ©. . . . . . . . . . . . . . : Oui Configuration automatique activĂ©e. . . : Oui Adresse IPv6. . . . . . . . . . . . . .: 2001:470:beef:5c0:2::c7(prefered) Bail obtenu. . . . . . . . . . . . . . : mercredi 10 mars 2021 06:51:57 Bail expirant. . . . . . . . . . . . . : jeudi 11 mars 2021 10:04:47 Adresse IPv6 de liaison locale. . . . .: fe80::410c:5e0d:e1a1:6075%10(prefered) Adresse IPv4. . . . . . . . . . . . . .: 192.168.1.6(prefered) Masque de sous-rĂ©seau. . . . . . . . . : 255.255.255.0 Bail obtenu. . . . . . . . . . . . . . : mercredi 10 mars 2021 08:18:04 Bail expirant. . . . . . . . . . . . . : vendredi 12 mars 2021 00:38:52 Passerelle par dĂ©faut. . . . . . . . . : fe80::215:17ff:fe77:d118%10 192.168.1.1 Serveur DHCP . . . . . . . . . . . . . : 192.168.1.1 IAID DHCPv6 . . . . . . . . . . . : 111459181 DUID de client DHCPv6. . . . . . . . : 00-01-00-01-26-AC-DF-8D-BB-BB-6D-BA-16-A1 Serveurs DNS. . . . . . . . . . . . . : 2001:470:1f13:5c0:2::1 192.168.1.1
Your 'unbound' doesn't know it lives in "home.arpa" so it should (should it ?) try also
mail.home.arpa
which should be in the /etc/hosts file on pfSense, thus known to unbound, as it reads /etc/hosts at start-up.
IF not, give that host called 'mail' a static DHCP MAC lease **, or host override it on the unbound settings page.** and keep this checked :
edit : I'm not using a domain like "home.arpa". As I need known 'cert' on my LAN, I use a 'real' (rented) domain name for internal uses and acme. I don't think that difference matters.
My unbound knows that :diskstaion2 is local, as it is definced in /etc/hosts/
..... 192.168.1.33 DiskStation2.my-domain.net DiskStation2 ....
Strange to see that unbound even bothers a main root server with a non valid host name like 'mail'.
-
@gertjan Bonjour.
They all got a static mapping and this box is checked all the time.
So still no clue why this behavior changed and now has changed again.
Câest la vie... -
@bob-dig said in [solved] 2.5 connecting via hostname not working across interfaces:
Câest la vie...
Coté fichier /etc/hosts : toutes tes hÎtes y figurent ?
-
-
I knew it. The question sounded familiar
-
I have to bring that up because it is an ongoing problem. Sometimes it works over other interfaces, sometimes it doesn't.
-
I enabled Register DHCP leases in the DNS Resolver in addition to the already enabled Register DHCP static mappings in the DNS Resolver and now it is working again, before even FQDN wasn't working. It is a mess.
-
I noticed that sometimes my windows can't connect even if via ip it is possible and even the dns resolution is working according to nslookup. It is making no sense to me.
-
Are you IPs changing? This isn't freaking rocket science ;) But it does require some basic understanding of dns and networking..
-
@johnpoz They don't change but the windows smb shares don't work anymore, unreachable, although via IP it is working.
But I don't know what the reason is, an ARP problem maybe? It is two Windows PCs across different interfaces.But I just noticed that the problem was different when I started this thread. It somehow looks related to me but it might not be.
-
Well troubleshoot the problem - if its not working via IP, it has zero to do with name resolution.
Sniff - what happens.. Does pfsense send on the syn.. Then its not pfsense..
-
@johnpoz It always does work with IP, names some of the time.
But to my later problem, I had ACL one machine to use the resolver only for local stuff. Maybe windows will not use it anymore and will favor the other... hard to tell. I switched to ip and will stay there, at least in that vm.
The original problem, RDP just over the hostname seems gone, it always works so, even across interfaces. -
@bob-dig said in 2.5 connecting via hostname not working across interfaces:
I had ACL one machine to use the resolver only for local stuff.
Huh? How exactly do you think that could work? While sure you can set the ACL to only be able to resolve local stuff. How would that client then resolve public stuff? You can't just point a client to 2 different NS that resolve different things and not have problems.
-
@johnpoz It worked for some time... but it is probably the reason for the latest problems.