No DNS Resolution

muswellhillbilly

Have you tried testing whether adding your DNS forwarder information in your general settings solves the issue?

johnpoz

Out of the box unbound RESOLVES… if that not working then you have something upstream blocking?? Under diag, do a query for say google.com or pfsense.org - what do you get back? If anything?

muswellhillbilly

My thought was that the DHCP server on the WAN side might not be providing the correct/full information for the PFS to be able to resolve. Hence my thought on whether entering static details might solve the matter - then it would obviously point to the DHCP config on the WAN side.

johnpoz

out of the box unbound is in resolve mode.. There is zero use for any sort of dns server setting from anywhere..

In resolver mode what your ISP hands you or doesn't hand you for dns is completely a non sequitur.

It's quite possible his isp is doing something funky with dns, and preventing him from using anything other them dns? A simple query would tell us this.

muswellhillbilly

@johnpoz:

out of the box unbound is in resolve mode.. There is zero use for any sort of dns server setting from anywhere..

In resolver mode what your ISP hands you or doesn't hand you for dns is completely a non sequitur.

Out of interest, what does PFS use as a default forwarder in those cases? I've never had to run any firewall in DHCP mode on the WAN side.

johnpoz

Huh? There is NO forwarder when your in resolve mode..

Not sure why your having a hard time getting this.. Do you not know the difference between a forwarder and a resolver??

Out of the box unbound is in resolver mode, ie it talks to roots and walks down the tree to the authoritative server for whatever domain your looking up. There is no forwarding of anything..

Your looking for www.pfsense.org

unbound, knowing the roots servers ask them.. Hey what is the NS for .org, it then asks one of them - hey what is the NS for pfsense.org - thanks, hey NS for pfsense.org what is the A record for www.pfsense.org

Nothing is forwarded anywhere.. If your isp hands you dns or doesn't hand you dns has zero to do with anything..

This is resolving - I snipped out some of it to make it shorter..


> dig www.pfsense.org +trace

; <<>> DiG 9.11.0-P1 <<>> www.pfsense.org +trace
;; global options: +cmd
.                       506544  IN      NS      c.root-servers.net.
.                       506544  IN      NS      e.root-servers.net.
.                       506544  IN      NS      j.root-servers.net.
.                       506544  IN      NS      l.root-servers.net.
.                       506544  IN      NS      g.root-servers.net.
.                       506544  IN      NS      m.root-servers.net.

;; Received 525 bytes from 192.168.9.253#53(192.168.9.253) in 2 ms

org.                    172800  IN      NS      a2.org.afilias-nst.info.
org.                    172800  IN      NS      b0.org.afilias-nst.org.
org.                    172800  IN      NS      b2.org.afilias-nst.org.
org.                    172800  IN      NS      d0.org.afilias-nst.org.
org.                    172800  IN      NS      a0.org.afilias-nst.info.
org.                    172800  IN      NS      c0.org.afilias-nst.info.

;; Received 817 bytes from 199.7.91.13#53(d.root-servers.net) in 11 ms

pfsense.org.            86400   IN      NS      ns1.netgate.com.
pfsense.org.            86400   IN      NS      ns2.netgate.com.

;; Received 584 bytes from 199.249.112.1#53(a2.org.afilias-nst.info) in 13 ms

www.pfsense.org.        300     IN      A       208.123.73.69
pfsense.org.            300     IN      NS      ns2.netgate.com.
pfsense.org.            300     IN      NS      ns1.netgate.com.

;; Received 139 bytes from 162.208.119.38#53(ns2.netgate.com) in 34 ms

This is forwarding..


> dig @8.8.8.8 www.pfsense.org

; <<>> DiG 9.11.0-P1 <<>> @8.8.8.8 www.pfsense.org
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 27204
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;www.pfsense.org.               IN      A

;; ANSWER SECTION:
www.pfsense.org.        54      IN      A       208.123.73.69

;; Query time: 22 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Fri Nov 18 07:12:28 Central Standard Time 2016
;; MSG SIZE  rcvd: 60

Now if 8.8.8.8 did not have that cached it would have to resolve what I asked for, or it too might forward it to somewhere. But somewhere in the chain there is a resolver.. When you forward you just push the resolving to someone else to do. Pfsense out of the box just resolves for you so you don't have to trust someone else answers to what your looking for.

muswellhillbilly

@johnpoz:

Not sure why your having a hard time getting this..

You've taken my query out of context, JP. And being condescending helps nobody.

And it's "You're", not "your". "You're" is a contraction of "You are", whereas "your" is a possessive pronoun. ;)

johnpoz

How so.. You keep bringing up forwarder when it has zero meaning when using unbound as a resolver. I don't understand why unless you just don't get what resolver means?

So you are having a hard time getting this?? Is that better ;)

muswellhillbilly

Yes, JP, I know what 'resolver' means. Do you know what 'courteousness' means? ;)

johnpoz

What?? Is it that time of the month for you? From your avatar picture I didn't think you were a 13 year old girl on her period??

I don't have time for 13 year old girls who's BFF just called them fat sorry!!! ;)

Do you want to discuss the problem, or should we all sing Kumbaya, and tell each other your hair looks nice?

doktornotor

@johnpoz:

and tell each other your hair looks nice?

That's not nice of you, that's actually been a nasty accident… ;D ;D ;D

muswellhillbilly

Ok, JP. Be that way if you like. Though I suggest you move out of your mother's basement some time in the future and find out how people actually work with other people constructively in the real world. There is no 'problem' here beyond your apparent inability to reply to a civil comment and/or question without calling out anyone who has the temerity to do so by trying to make out they're complete nonces for asking in the first place. I have no time or patience for point-scoring with you or anyone else on this forum - it's not what I chose to do when I started posting here. If I can be of assistance to someone I post a reply - if I can't then I don't. Whatever the circumstances, I don't see how it helps anyone on this forum, nor the maintainers of PFS, if the so-called 'ambassadors' for pfSense can't be arsed to show professional courtesy when posting responses. Screw Kumbaya - why not just try to act like a professional instead? I've had to deal with enquiries concerning all manner of IT issues in my career and quite frankly if I spoke to my colleagues at work the way you sometimes address posters on this forum I'd be out of a job in less time than it takes to say 'supercilious '.

Call me a 13-year-old girl if you like. But it beats acting like a 15-year-old spotty-faced geek with no girlfriend and a fetish for pizza and coke. ;)

TomT

@johnpoz:

Out of the box unbound RESOLVES… if that not working then you have something upstream blocking?? Under diag, do a query for say google.com or pfsense.org - what do you get back? If anything?

Hi.
Sorry for the delay in replying.

Doing a look up of google returns :

Host "google.com" could not be resolved.

As this is a test system, I'll backup the config and role it back.
See if it works then..

MoonKnight

hmm, I got this. My resolver doesn't look like yours. Any idea why?

[2.3.2-RELEASE][root@pfsense.local]/root: dig www.pfsense.org +trace

; <<>> DiG 9.10.4-P2 <<>> www.pfsense.org +trace
;; global options: +cmd
;; Received 12 bytes from 127.0.0.1#53(127.0.0.1) in 0 ms

[2.3.2-RELEASE][root@pfsense.local]/root:

@johnpoz:

Huh? There is NO forwarder when your in resolve mode..

Not sure why your having a hard time getting this.. Do you not know the difference between a forwarder and a resolver??

Out of the box unbound is in resolver mode, ie it talks to roots and walks down the tree to the authoritative server for whatever domain your looking up. There is no forwarding of anything..

Your looking for www.pfsense.org

unbound, knowing the roots servers ask them.. Hey what is the NS for .org, it then asks one of them - hey what is the NS for pfsense.org - thanks, hey NS for pfsense.org what is the A record for www.pfsense.org

Nothing is forwarded anywhere.. If your isp hands you dns or doesn't hand you dns has zero to do with anything..

This is resolving - I snipped out some of it to make it shorter..
> dig www.pfsense.org +trace

; <<>> DiG 9.11.0-P1 <<>> www.pfsense.org +trace
;; global options: +cmd
.                       506544  IN      NS      c.root-servers.net.
.                       506544  IN      NS      e.root-servers.net.
.                       506544  IN      NS      j.root-servers.net.
.                       506544  IN      NS      l.root-servers.net.
.                       506544  IN      NS      g.root-servers.net.
.                       506544  IN      NS      m.root-servers.net.

;; Received 525 bytes from 192.168.9.253#53(192.168.9.253) in 2 ms

org.                    172800  IN      NS      a2.org.afilias-nst.info.
org.                    172800  IN      NS      b0.org.afilias-nst.org.
org.                    172800  IN      NS      b2.org.afilias-nst.org.
org.                    172800  IN      NS      d0.org.afilias-nst.org.
org.                    172800  IN      NS      a0.org.afilias-nst.info.
org.                    172800  IN      NS      c0.org.afilias-nst.info.

;; Received 817 bytes from 199.7.91.13#53(d.root-servers.net) in 11 ms

pfsense.org.            86400   IN      NS      ns1.netgate.com.
pfsense.org.            86400   IN      NS      ns2.netgate.com.

;; Received 584 bytes from 199.249.112.1#53(a2.org.afilias-nst.info) in 13 ms

www.pfsense.org.        300     IN      A       208.123.73.69
pfsense.org.            300     IN      NS      ns2.netgate.com.
pfsense.org.            300     IN      NS      ns1.netgate.com.

;; Received 139 bytes from 162.208.119.38#53(ns2.netgate.com) in 34 ms
This is forwarding..
> dig @8.8.8.8 www.pfsense.org

; <<>> DiG 9.11.0-P1 <<>> @8.8.8.8 www.pfsense.org
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 27204
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;www.pfsense.org.               IN      A

;; ANSWER SECTION:
www.pfsense.org.        54      IN      A       208.123.73.69

;; Query time: 22 msec
;; SERVER: 8.8.8.8#53(8.8.8.
;; WHEN: Fri Nov 18 07:12:28 Central Standard Time 2016
;; MSG SIZE  rcvd: 60
Now if 8.8.8.8 did not have that cached it would have to resolve what I asked for, or it too might forward it to somewhere. But somewhere in the chain there is a resolver.. When you forward you just push the resolving to someone else to do. Pfsense out of the box just resolves for you so you don't have to trust someone else answers to what your looking for.

johnpoz

And there you go again dude.. .Get over yourself already.. WTF.. Nobody gives 2 shits..

"Do you not know the difference between a forwarder and a resolver??"

After multiple statements that out of the box pfsense resolves and doesn't forward, you kept bring up forwarding.. I ask a simple question and point out the difference.. And somehow this offends you…. WTF dude really?? Move on, your not helping at all and just proving my point..

Doing a look up where Tom? On you diag, dns lookup page? Please post the output.. Are you pointing pfsense to self for dns? I a typical out of the box setup pfsense would point to itself and resolve. So a host lookup would look something like this.

@CiscoX.. I didn't do it from pfsense.. Do it from a client on your network. Just to show how resolving works vs forwarding.

dnslookup.png_thumb

TomT

Hi.

I've rolled my Virtual Machine back to the fresh install of pfSense and DNS resolution is now working.

That is running on 2.3.2-RELEASE (i386)

As soon as I upgrade it to 2.3.2_1 DNS stops resolving.
Unbound is still running and I've not made any other changes.

Any ideas ?
Thanks

johnpoz

Rolled it back to what version? 2.3.2? Or something previous. So your running 32bit version? You should really move to 64 bit.. To be honest not sure if they plan on support and providing 32bit moving forward? If they do not sure for how long - I do remember reading somewhere that it was going away. Atleast pretty sure it is..

There really is no reason to be running 32.. I was doing the same thing a couple years back - figured have less trouble with 32, but to be honest prob the opposite..

In your OP you stated it was a new install, now your saying it was a upgrade? Upgrade fro what to what? And still have zero info on exactly what is not working.. Is unbound able to query the roots or not, or just not answering your clients.

TomT

Sorry I'll try to clarify this.

I'm running a fresh install of 2.3.2 in Virtual Box Virtual Machine. It is running 32bit, but this is only for my local testing until my hardware arrives.

The WAN Interface has an IP Address in my local LAN 192.168.8.99
The LAN interface has 192.168.1.1

I've setup another virtual machine as 192.168.1.100 to connect to the pfSense server.

When running pfSense 2.3.2, from a console on the pfSense machine I can ping google.com etc and that works fine. Using the diagnostic tools DNS resolves fine.

If I upgrade to pfSense 2.3.2_1, then DNS fails to resolve any addresses. Again I've tested this via the command line, used nslookup and the GUI diagnostic tools. They all return 'unable to resolve google.com'

I've stopped and restarted unbound and it shows as running, but its still not working.
Any other ideas ?

Thanks

johnpoz

So do you allow dns outbound from your real network? Out of the box unbound tries to resolve. Sniff on your pfsense vm wan.. You can see it query the roots, and walk down the tree. Do you see these go out? Do they not get a response or do they not go out? Your pfsense is behind a NAT. Are you intercepting dns on your real network.

Why don't you sniff on your pfsense wan, and then query for something you have never done a query for before what do you get as response.. Again do you see the queries go out?

So look I did a query for something bs, I queried the nameservers for .com and it sent me back NX with the SOA for .com…

If your saying you can not look up something, you need to validate that it went out. If your not seeing a response, then trouble shoot that - if not going out then you need to trouble shoot that.

bsdnsquery.png_thumb

TomT

Thanks for a reply.

I've done some testing this morning and found everything resolves using unbound fine when I'm running pfSense 2.3.2
All traces, dig, nslookup and diagnostic tests show my virtual pfSense machine providing the DNS resolution.

As soon as I upgrade to 2.3.2_1 then it stops responding. I get no resolution at all.

So I've wiped the Virtual machine and installed pfSense 64bit version of 2.3.2
Again, all traces, dig, nslookup and diagnostic tests show my virtual pfSense machine providing the DNS resolution.

Upgraded to 2.3.2_1 and it's continued to work. :D
So the only thing I can assume is in my setup the 32Bit version doesn't work as well !

Thanks for the help and advise.