No DNS Resolution

[johnpoz]

So do you allow dns outbound from your real network?  Out of the box unbound tries to resolve.  Sniff on your pfsense vm wan.. You can see it query the roots, and walk down the tree.  Do you see these go out?  Do they not get a response or do they not go out?  Your pfsense is behind a NAT.  Are you intercepting dns on your real network.

Why don't you sniff on your pfsense wan, and then query for something you have never done a query for before what do you get as response.. Again do you see the queries go out?

So look I did a query for something bs, I queried the nameservers for .com and it sent me back NX with the SOA for .com…

If your saying you can not look up something, you need to validate that it went out. If your not seeing a response, then trouble shoot that - if not going out then you need to trouble shoot that.

[TomT]

Thanks for a reply.

I've done some testing this morning and found everything resolves using unbound fine when I'm running pfSense 2.3.2
All traces, dig, nslookup and diagnostic tests show my virtual pfSense machine providing the DNS resolution.

As soon as I upgrade to 2.3.2_1 then it stops responding. I get no resolution at all.

So I've wiped the Virtual machine and installed pfSense 64bit version of 2.3.2
Again, all traces, dig, nslookup and diagnostic tests show my virtual pfSense machine providing the DNS resolution.

Upgraded to 2.3.2_1 and it's continued to work.  :D
So the only thing I can assume is in my setup the 32Bit version doesn't work as well !

Thanks for the help and advise.

[johnpoz]

If I get a chance I will grab the 32bit version and give it a try… Glad you got it all sorted.

[littlebi]

Now I have a partial DNS resolution. My problem lies with the resolution of hostnames within the domain of pfsense. For the sake of simplicity I'll call it example.com .
Pfsense acts as a dhcp-server and dns-resolver, as you can see from the pictures I'm running servers in my home with the static ips 10.0.1.5 (host1.example.com) and 10.0.1.6 (host1.example.com)
Pinging ANY host via IP is not a problem, pfsense is even able to resolve google.com etc, but not my hosts in my lan via domain name.
I have made sure that I use the same domain name as the one that is being set at General Setup.

What am I missing?


[johnpoz]

So is this some FBI document.. With all the redacted black lines..

Dude if your handing your clients a dns of 8.8.8.8 how would taht resolve your local stuff?

If your clients should only ask pfsense for dns, if your wanting to resolve stuff you put in pfsense.

[littlebi]

Isn't that pfsense is first checking the first given ip and then going down to the next one?

[johnpoz]

No that is not how dns settings work..

If you want to have more than one dns entry they both need to be able to resolve the same stuff because your never sure what ns your windows machine is going to use when there is more than one listed.  While it might start out using the 1st one on the list, there is nothing saying it doesn't switch over because it couldn't look up something or took longer than it thought it should, etc.  There is a whole algorithm used..

The one thing that is 100% sure is if you have multiple entries you can not be sure which one it will check or if will check both.

So if you want failover dns the ns you list all have to be able to resolve the same stuff with the same answers.  So if all you are worried about is public then sure you opendns and googledns and 4.2.2.2 they all return all the public domains.

But if what you want to do is look up local stuff and public stuff - you have to ONLY List your local stuff as your NS.. If you want more than 1 local then run multiple locals that share the same local info.  But its kind of pointless to run more than 1 if your only running 1 internet connection with 1 pfsense box, etc.

This is just why users running AD have issues, they think oh I can setup my AD member machine to ask google dns.. Like it is going to know about your AD records, etc. ;)

[littlebi]

Thank you for the help. It worked…