DNS Resolver Split outgoing interface
-
But lets see the routing table.. Pfsense shouldn't use the lan IP when it wants to talk to 172.20.0.1
It shouldn't be able to.. Makes no sense to use that IP when trying to talk to something that is not on that network.
-
-
Maybe @Derelict has some idea.. I am drawing a blank to how/why it could/would do that..
-
Have you set the gateway for your server interface? I think you will need to create static routes and set these dns policies in DNS resolver. You will also need to allow this traffic in the rules and put the SERVERS gateway in advanced configuration of these rules for users to use this weird configuration.
What a tricky scenario.
-
What do you mean by gateway for the server interface? It is a gateway in itself.
And by static routes, do you mean static routes inside the dns resolver itself? I am unfamiliar with how to do that.Is it a weird configuration? Domain overrides can be used for more than my weird domain controller setup.
I think if the domain override could work without selecting additional outgoing interfaces, I wouldn't be seeing this behavior. -
@erasedhammer What have you selected as the outgoing interfaces in DNS Resolver/unbound?
No, you cannot source a connection for a specific domain from a specific source address. This is something dnsmasq (DNS Forwarder) could do but unbound cannot, unfortunately.
-
-
@erasedhammer So it is doing exactly what you told it to do? Source queries from both addresses?
-
Correct, but the domain override and telling it to use an internal DNS server does not work without selecting the servers interface as outgoing.
I guess that is the root of my question, why can't the domain override work without the interface being selected in the outgoing interfaces list. -
@erasedhammer Because unbound doesn't have that functionality.
-
@erasedhammer If you set the outgoing interface to All, what happens?
That should move the source address selection back to FreeBSD which should select the "closest" interface to the destination address.
-
Seems to be working. Domain override is working and Im not seeing any other interfaces going to the internet.
I guess I overthought the implementation, thanks!
