DNS Resolver Split outgoing interface
-
Sorry, should have clarified, this pfsense box sits behind a firewall. Pfsense is not doing NAT, acting as a router/firewall for local traffic.
Initially on the edge firewall I wasn't allowing any traffic from the gateway IPs for pfsense's lan subnets, just that pfsense boxes' WAN IP. Which is how I noticed that setting two outgoing interfaces, pfsense just hops between them for sending queries to upstream DNS servers.
I am just wondering if there is any way to make the dns resolver only use an outgoing interface for certain domains?
-
@erasedhammer said in DNS Resolver Split outgoing interface:
I am just wondering if there is any way to make the dns resolver only use an outgoing interface for certain domains?
It would only use an interface that it either attached to network its trying to send the query too. Or to a gateway it thinks could talk to that network via your routing, via specific routes or default routes.
How would it send traffic out an interface to an IP that does not reside on that interface, or to a gateway IP it talks to via that network.
If it want to talk to say 1.2.3.4 for domain.tld via your override. It can and will only send traffic out an interface that is on the network 1.2.3.4 sits on, and it can arp for. Or to a gateway it is setup with a route to the network 1.2.3.4 sits on, or a default gateway.. Where hey I don't have a route to 1.2.3.4 network - just send it to my default gateway..
-
@johnpoz
I am not sure how its doing, all I know is it IS doing it.From pfsense:
From upstream router:
As you can see, its sending queries from both.
-
@erasedhammer said in DNS Resolver Split outgoing interface:
Recently I setup up a domain controller which also acts as a DNS server, but I did not want clients using it as the primary dns server,
Why would one invest in a domain controller but not have their clients use it as the source of information for the domain?
Genuinely curious.
-
@derelict
The domain override exists for clients to ask the domain controller domain related DNS queries. What I didn't want is the domain controller handling internet DNS queries.But to directly answer your question, the domain controller is virtualized on a less than reliable server right now. It isn't that critical right now, nothing important relies on it at this point, just a couple of VDIs.
-
Lets see your gateway and routing table.. The only way pfsense would talk to some gateway from its lan IP, if the gateway is attached to the lan network.
This is how any router would work. Its not something special to pfsense.
-
@johnpoz
Heres the gateway list:
I don't have any internet static routes though, so everything gets sent to that default gateway.
-
But lets see the routing table.. Pfsense shouldn't use the lan IP when it wants to talk to 172.20.0.1
It shouldn't be able to.. Makes no sense to use that IP when trying to talk to something that is not on that network.
-
-
Maybe @Derelict has some idea.. I am drawing a blank to how/why it could/would do that..
-
Have you set the gateway for your server interface? I think you will need to create static routes and set these dns policies in DNS resolver. You will also need to allow this traffic in the rules and put the SERVERS gateway in advanced configuration of these rules for users to use this weird configuration.
What a tricky scenario.
-
What do you mean by gateway for the server interface? It is a gateway in itself.
And by static routes, do you mean static routes inside the dns resolver itself? I am unfamiliar with how to do that.Is it a weird configuration? Domain overrides can be used for more than my weird domain controller setup.
I think if the domain override could work without selecting additional outgoing interfaces, I wouldn't be seeing this behavior. -
@erasedhammer What have you selected as the outgoing interfaces in DNS Resolver/unbound?
No, you cannot source a connection for a specific domain from a specific source address. This is something dnsmasq (DNS Forwarder) could do but unbound cannot, unfortunately.
-
-
@erasedhammer So it is doing exactly what you told it to do? Source queries from both addresses?
-
Correct, but the domain override and telling it to use an internal DNS server does not work without selecting the servers interface as outgoing.
I guess that is the root of my question, why can't the domain override work without the interface being selected in the outgoing interfaces list. -
@erasedhammer Because unbound doesn't have that functionality.
-
@erasedhammer If you set the outgoing interface to All, what happens?
That should move the source address selection back to FreeBSD which should select the "closest" interface to the destination address.
-
Seems to be working. Domain override is working and Im not seeing any other interfaces going to the internet.
I guess I overthought the implementation, thanks!
