No DNS Resolution

johnpoz

Huh? There is NO forwarder when your in resolve mode..

Not sure why your having a hard time getting this.. Do you not know the difference between a forwarder and a resolver??

Out of the box unbound is in resolver mode, ie it talks to roots and walks down the tree to the authoritative server for whatever domain your looking up. There is no forwarding of anything..

Your looking for www.pfsense.org

unbound, knowing the roots servers ask them.. Hey what is the NS for .org, it then asks one of them - hey what is the NS for pfsense.org - thanks, hey NS for pfsense.org what is the A record for www.pfsense.org

Nothing is forwarded anywhere.. If your isp hands you dns or doesn't hand you dns has zero to do with anything..

This is resolving - I snipped out some of it to make it shorter..


> dig www.pfsense.org +trace

; <<>> DiG 9.11.0-P1 <<>> www.pfsense.org +trace
;; global options: +cmd
.                       506544  IN      NS      c.root-servers.net.
.                       506544  IN      NS      e.root-servers.net.
.                       506544  IN      NS      j.root-servers.net.
.                       506544  IN      NS      l.root-servers.net.
.                       506544  IN      NS      g.root-servers.net.
.                       506544  IN      NS      m.root-servers.net.

;; Received 525 bytes from 192.168.9.253#53(192.168.9.253) in 2 ms

org.                    172800  IN      NS      a2.org.afilias-nst.info.
org.                    172800  IN      NS      b0.org.afilias-nst.org.
org.                    172800  IN      NS      b2.org.afilias-nst.org.
org.                    172800  IN      NS      d0.org.afilias-nst.org.
org.                    172800  IN      NS      a0.org.afilias-nst.info.
org.                    172800  IN      NS      c0.org.afilias-nst.info.

;; Received 817 bytes from 199.7.91.13#53(d.root-servers.net) in 11 ms

pfsense.org.            86400   IN      NS      ns1.netgate.com.
pfsense.org.            86400   IN      NS      ns2.netgate.com.

;; Received 584 bytes from 199.249.112.1#53(a2.org.afilias-nst.info) in 13 ms

www.pfsense.org.        300     IN      A       208.123.73.69
pfsense.org.            300     IN      NS      ns2.netgate.com.
pfsense.org.            300     IN      NS      ns1.netgate.com.

;; Received 139 bytes from 162.208.119.38#53(ns2.netgate.com) in 34 ms

This is forwarding..


> dig @8.8.8.8 www.pfsense.org

; <<>> DiG 9.11.0-P1 <<>> @8.8.8.8 www.pfsense.org
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 27204
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;www.pfsense.org.               IN      A

;; ANSWER SECTION:
www.pfsense.org.        54      IN      A       208.123.73.69

;; Query time: 22 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Fri Nov 18 07:12:28 Central Standard Time 2016
;; MSG SIZE  rcvd: 60

Now if 8.8.8.8 did not have that cached it would have to resolve what I asked for, or it too might forward it to somewhere. But somewhere in the chain there is a resolver.. When you forward you just push the resolving to someone else to do. Pfsense out of the box just resolves for you so you don't have to trust someone else answers to what your looking for.

muswellhillbilly

@johnpoz:

Not sure why your having a hard time getting this..

You've taken my query out of context, JP. And being condescending helps nobody.

And it's "You're", not "your". "You're" is a contraction of "You are", whereas "your" is a possessive pronoun. ;)

johnpoz

How so.. You keep bringing up forwarder when it has zero meaning when using unbound as a resolver. I don't understand why unless you just don't get what resolver means?

So you are having a hard time getting this?? Is that better ;)

muswellhillbilly

Yes, JP, I know what 'resolver' means. Do you know what 'courteousness' means? ;)

johnpoz

What?? Is it that time of the month for you? From your avatar picture I didn't think you were a 13 year old girl on her period??

I don't have time for 13 year old girls who's BFF just called them fat sorry!!! ;)

Do you want to discuss the problem, or should we all sing Kumbaya, and tell each other your hair looks nice?

doktornotor

@johnpoz:

and tell each other your hair looks nice?

That's not nice of you, that's actually been a nasty accident… ;D ;D ;D

muswellhillbilly

Ok, JP. Be that way if you like. Though I suggest you move out of your mother's basement some time in the future and find out how people actually work with other people constructively in the real world. There is no 'problem' here beyond your apparent inability to reply to a civil comment and/or question without calling out anyone who has the temerity to do so by trying to make out they're complete nonces for asking in the first place. I have no time or patience for point-scoring with you or anyone else on this forum - it's not what I chose to do when I started posting here. If I can be of assistance to someone I post a reply - if I can't then I don't. Whatever the circumstances, I don't see how it helps anyone on this forum, nor the maintainers of PFS, if the so-called 'ambassadors' for pfSense can't be arsed to show professional courtesy when posting responses. Screw Kumbaya - why not just try to act like a professional instead? I've had to deal with enquiries concerning all manner of IT issues in my career and quite frankly if I spoke to my colleagues at work the way you sometimes address posters on this forum I'd be out of a job in less time than it takes to say 'supercilious '.

Call me a 13-year-old girl if you like. But it beats acting like a 15-year-old spotty-faced geek with no girlfriend and a fetish for pizza and coke. ;)

TomT

@johnpoz:

Out of the box unbound RESOLVES… if that not working then you have something upstream blocking?? Under diag, do a query for say google.com or pfsense.org - what do you get back? If anything?

Hi.
Sorry for the delay in replying.

Doing a look up of google returns :

Host "google.com" could not be resolved.

As this is a test system, I'll backup the config and role it back.
See if it works then..

MoonKnight

hmm, I got this. My resolver doesn't look like yours. Any idea why?

[2.3.2-RELEASE][root@pfsense.local]/root: dig www.pfsense.org +trace

; <<>> DiG 9.10.4-P2 <<>> www.pfsense.org +trace
;; global options: +cmd
;; Received 12 bytes from 127.0.0.1#53(127.0.0.1) in 0 ms

[2.3.2-RELEASE][root@pfsense.local]/root:

@johnpoz:

Huh? There is NO forwarder when your in resolve mode..

Not sure why your having a hard time getting this.. Do you not know the difference between a forwarder and a resolver??

Out of the box unbound is in resolver mode, ie it talks to roots and walks down the tree to the authoritative server for whatever domain your looking up. There is no forwarding of anything..

Your looking for www.pfsense.org

unbound, knowing the roots servers ask them.. Hey what is the NS for .org, it then asks one of them - hey what is the NS for pfsense.org - thanks, hey NS for pfsense.org what is the A record for www.pfsense.org

Nothing is forwarded anywhere.. If your isp hands you dns or doesn't hand you dns has zero to do with anything..

This is resolving - I snipped out some of it to make it shorter..
> dig www.pfsense.org +trace

; <<>> DiG 9.11.0-P1 <<>> www.pfsense.org +trace
;; global options: +cmd
.                       506544  IN      NS      c.root-servers.net.
.                       506544  IN      NS      e.root-servers.net.
.                       506544  IN      NS      j.root-servers.net.
.                       506544  IN      NS      l.root-servers.net.
.                       506544  IN      NS      g.root-servers.net.
.                       506544  IN      NS      m.root-servers.net.

;; Received 525 bytes from 192.168.9.253#53(192.168.9.253) in 2 ms

org.                    172800  IN      NS      a2.org.afilias-nst.info.
org.                    172800  IN      NS      b0.org.afilias-nst.org.
org.                    172800  IN      NS      b2.org.afilias-nst.org.
org.                    172800  IN      NS      d0.org.afilias-nst.org.
org.                    172800  IN      NS      a0.org.afilias-nst.info.
org.                    172800  IN      NS      c0.org.afilias-nst.info.

;; Received 817 bytes from 199.7.91.13#53(d.root-servers.net) in 11 ms

pfsense.org.            86400   IN      NS      ns1.netgate.com.
pfsense.org.            86400   IN      NS      ns2.netgate.com.

;; Received 584 bytes from 199.249.112.1#53(a2.org.afilias-nst.info) in 13 ms

www.pfsense.org.        300     IN      A       208.123.73.69
pfsense.org.            300     IN      NS      ns2.netgate.com.
pfsense.org.            300     IN      NS      ns1.netgate.com.

;; Received 139 bytes from 162.208.119.38#53(ns2.netgate.com) in 34 ms
This is forwarding..
> dig @8.8.8.8 www.pfsense.org

; <<>> DiG 9.11.0-P1 <<>> @8.8.8.8 www.pfsense.org
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 27204
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;www.pfsense.org.               IN      A

;; ANSWER SECTION:
www.pfsense.org.        54      IN      A       208.123.73.69

;; Query time: 22 msec
;; SERVER: 8.8.8.8#53(8.8.8.
;; WHEN: Fri Nov 18 07:12:28 Central Standard Time 2016
;; MSG SIZE  rcvd: 60
Now if 8.8.8.8 did not have that cached it would have to resolve what I asked for, or it too might forward it to somewhere. But somewhere in the chain there is a resolver.. When you forward you just push the resolving to someone else to do. Pfsense out of the box just resolves for you so you don't have to trust someone else answers to what your looking for.

johnpoz

And there you go again dude.. .Get over yourself already.. WTF.. Nobody gives 2 shits..

"Do you not know the difference between a forwarder and a resolver??"

After multiple statements that out of the box pfsense resolves and doesn't forward, you kept bring up forwarding.. I ask a simple question and point out the difference.. And somehow this offends you…. WTF dude really?? Move on, your not helping at all and just proving my point..

Doing a look up where Tom? On you diag, dns lookup page? Please post the output.. Are you pointing pfsense to self for dns? I a typical out of the box setup pfsense would point to itself and resolve. So a host lookup would look something like this.

@CiscoX.. I didn't do it from pfsense.. Do it from a client on your network. Just to show how resolving works vs forwarding.

dnslookup.png_thumb

TomT

Hi.

I've rolled my Virtual Machine back to the fresh install of pfSense and DNS resolution is now working.

That is running on 2.3.2-RELEASE (i386)

As soon as I upgrade it to 2.3.2_1 DNS stops resolving.
Unbound is still running and I've not made any other changes.

Any ideas ?
Thanks

johnpoz

Rolled it back to what version? 2.3.2? Or something previous. So your running 32bit version? You should really move to 64 bit.. To be honest not sure if they plan on support and providing 32bit moving forward? If they do not sure for how long - I do remember reading somewhere that it was going away. Atleast pretty sure it is..

There really is no reason to be running 32.. I was doing the same thing a couple years back - figured have less trouble with 32, but to be honest prob the opposite..

In your OP you stated it was a new install, now your saying it was a upgrade? Upgrade fro what to what? And still have zero info on exactly what is not working.. Is unbound able to query the roots or not, or just not answering your clients.

TomT

Sorry I'll try to clarify this.

I'm running a fresh install of 2.3.2 in Virtual Box Virtual Machine. It is running 32bit, but this is only for my local testing until my hardware arrives.

The WAN Interface has an IP Address in my local LAN 192.168.8.99
The LAN interface has 192.168.1.1

I've setup another virtual machine as 192.168.1.100 to connect to the pfSense server.

When running pfSense 2.3.2, from a console on the pfSense machine I can ping google.com etc and that works fine. Using the diagnostic tools DNS resolves fine.

If I upgrade to pfSense 2.3.2_1, then DNS fails to resolve any addresses. Again I've tested this via the command line, used nslookup and the GUI diagnostic tools. They all return 'unable to resolve google.com'

I've stopped and restarted unbound and it shows as running, but its still not working.
Any other ideas ?

Thanks

johnpoz

So do you allow dns outbound from your real network? Out of the box unbound tries to resolve. Sniff on your pfsense vm wan.. You can see it query the roots, and walk down the tree. Do you see these go out? Do they not get a response or do they not go out? Your pfsense is behind a NAT. Are you intercepting dns on your real network.

Why don't you sniff on your pfsense wan, and then query for something you have never done a query for before what do you get as response.. Again do you see the queries go out?

So look I did a query for something bs, I queried the nameservers for .com and it sent me back NX with the SOA for .com…

If your saying you can not look up something, you need to validate that it went out. If your not seeing a response, then trouble shoot that - if not going out then you need to trouble shoot that.

bsdnsquery.png_thumb

TomT

Thanks for a reply.

I've done some testing this morning and found everything resolves using unbound fine when I'm running pfSense 2.3.2
All traces, dig, nslookup and diagnostic tests show my virtual pfSense machine providing the DNS resolution.

As soon as I upgrade to 2.3.2_1 then it stops responding. I get no resolution at all.

So I've wiped the Virtual machine and installed pfSense 64bit version of 2.3.2
Again, all traces, dig, nslookup and diagnostic tests show my virtual pfSense machine providing the DNS resolution.

Upgraded to 2.3.2_1 and it's continued to work. :D
So the only thing I can assume is in my setup the 32Bit version doesn't work as well !

Thanks for the help and advise.

johnpoz

If I get a chance I will grab the 32bit version and give it a try… Glad you got it all sorted.

littlebi

Now I have a partial DNS resolution. My problem lies with the resolution of hostnames within the domain of pfsense. For the sake of simplicity I'll call it example.com .
Pfsense acts as a dhcp-server and dns-resolver, as you can see from the pictures I'm running servers in my home with the static ips 10.0.1.5 (host1.example.com) and 10.0.1.6 (host1.example.com)
Pinging ANY host via IP is not a problem, pfsense is even able to resolve google.com etc, but not my hosts in my lan via domain name.
I have made sure that I use the same domain name as the one that is being set at General Setup.

What am I missing?

![Services-DHCP Server 1.PNG](/public/imported_attachments/1/Services-DHCP Server 1.PNG)
![Services-DHCP Server 1.PNG_thumb](/public/imported_attachments/1/Services-DHCP Server 1.PNG_thumb)
![Services-DHCP Server 2.PNG](/public/imported_attachments/1/Services-DHCP Server 2.PNG)
![Services-DHCP Server 2.PNG_thumb](/public/imported_attachments/1/Services-DHCP Server 2.PNG_thumb)
![System-General Setup.PNG](/public/imported_attachments/1/System-General Setup.PNG)
![System-General Setup.PNG_thumb](/public/imported_attachments/1/System-General Setup.PNG_thumb)
![Services-DNS Resolver 1.PNG](/public/imported_attachments/1/Services-DNS Resolver 1.PNG)
![Services-DNS Resolver 1.PNG_thumb](/public/imported_attachments/1/Services-DNS Resolver 1.PNG_thumb)
![Services-DNS Resolver 2.PNG](/public/imported_attachments/1/Services-DNS Resolver 2.PNG)
![Services-DNS Resolver 2.PNG_thumb](/public/imported_attachments/1/Services-DNS Resolver 2.PNG_thumb)

johnpoz

So is this some FBI document.. With all the redacted black lines..

Dude if your handing your clients a dns of 8.8.8.8 how would taht resolve your local stuff?

If your clients should only ask pfsense for dns, if your wanting to resolve stuff you put in pfsense.

littlebi

Isn't that pfsense is first checking the first given ip and then going down to the next one?

johnpoz

No that is not how dns settings work..

If you want to have more than one dns entry they both need to be able to resolve the same stuff because your never sure what ns your windows machine is going to use when there is more than one listed. While it might start out using the 1st one on the list, there is nothing saying it doesn't switch over because it couldn't look up something or took longer than it thought it should, etc. There is a whole algorithm used..

The one thing that is 100% sure is if you have multiple entries you can not be sure which one it will check or if will check both.

So if you want failover dns the ns you list all have to be able to resolve the same stuff with the same answers. So if all you are worried about is public then sure you opendns and googledns and 4.2.2.2 they all return all the public domains.

But if what you want to do is look up local stuff and public stuff - you have to ONLY List your local stuff as your NS.. If you want more than 1 local then run multiple locals that share the same local info. But its kind of pointless to run more than 1 if your only running 1 internet connection with 1 pfsense box, etc.

This is just why users running AD have issues, they think oh I can setup my AD member machine to ask google dns.. Like it is going to know about your AD records, etc. ;)