DNS Resolver Split outgoing interface
-
@erasedhammer said in DNS Resolver Split outgoing interface:
Recently I setup up a domain controller which also acts as a DNS server, but I did not want clients using it as the primary dns server,
Why would one invest in a domain controller but not have their clients use it as the source of information for the domain?
Genuinely curious.
-
@derelict
The domain override exists for clients to ask the domain controller domain related DNS queries. What I didn't want is the domain controller handling internet DNS queries.But to directly answer your question, the domain controller is virtualized on a less than reliable server right now. It isn't that critical right now, nothing important relies on it at this point, just a couple of VDIs.
-
Lets see your gateway and routing table.. The only way pfsense would talk to some gateway from its lan IP, if the gateway is attached to the lan network.
This is how any router would work. Its not something special to pfsense.
-
@johnpoz
Heres the gateway list:
I don't have any internet static routes though, so everything gets sent to that default gateway.
-
But lets see the routing table.. Pfsense shouldn't use the lan IP when it wants to talk to 172.20.0.1
It shouldn't be able to.. Makes no sense to use that IP when trying to talk to something that is not on that network.
-
-
Maybe @Derelict has some idea.. I am drawing a blank to how/why it could/would do that..
-
Have you set the gateway for your server interface? I think you will need to create static routes and set these dns policies in DNS resolver. You will also need to allow this traffic in the rules and put the SERVERS gateway in advanced configuration of these rules for users to use this weird configuration.
What a tricky scenario.
-
What do you mean by gateway for the server interface? It is a gateway in itself.
And by static routes, do you mean static routes inside the dns resolver itself? I am unfamiliar with how to do that.Is it a weird configuration? Domain overrides can be used for more than my weird domain controller setup.
I think if the domain override could work without selecting additional outgoing interfaces, I wouldn't be seeing this behavior. -
@erasedhammer What have you selected as the outgoing interfaces in DNS Resolver/unbound?
No, you cannot source a connection for a specific domain from a specific source address. This is something dnsmasq (DNS Forwarder) could do but unbound cannot, unfortunately.
-
-
@erasedhammer So it is doing exactly what you told it to do? Source queries from both addresses?
-
Correct, but the domain override and telling it to use an internal DNS server does not work without selecting the servers interface as outgoing.
I guess that is the root of my question, why can't the domain override work without the interface being selected in the outgoing interfaces list. -
@erasedhammer Because unbound doesn't have that functionality.
-
@erasedhammer If you set the outgoing interface to All, what happens?
That should move the source address selection back to FreeBSD which should select the "closest" interface to the destination address.
-
Seems to be working. Domain override is working and Im not seeing any other interfaces going to the internet.
I guess I overthought the implementation, thanks!
