Can not resolve a DNS



  • Hi I have a problem with resolving 1 site that is https://www.melita.com/ I get page error when using pfsense on other routers it works fine.  Any ideas on this please? btw I used the old forwarder it gets resolved fine so it is something in resolver


  • Banned

    
    drill www.melita.com
    ;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 50998
    ;; flags: qr rd ra ; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 0
    ;; QUESTION SECTION:
    ;; www.melita.com.      IN      A
    
    ;; ANSWER SECTION:
    www.melita.com. 86371   IN      A       212.56.128.204
    
    ;; AUTHORITY SECTION:
    melita.com.     86371   IN      NS      ns1.melitacable.com.
    melita.com.     86371   IN      NS      ns.melitacable.com.
    
    ;; ADDITIONAL SECTION:
    
    ;; Query time: 0 msec
    ;; SERVER: 127.0.0.1
    ;; WHEN: Sat Nov 26 23:21:29 2016
    ;; MSG SIZE  rcvd: 95
    
    

    Works just fine.


  • Rebel Alliance Global Moderator

    yup working just fine here as well..

    
    > dig www.melita.com                                                     
    
    ; <<>> DiG 9.11.0-P1 <<>> www.melita.com                                 
    ;; global options: +cmd                                                  
    ;; Got answer:                                                           
    ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 62636                
    ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 1     
    
    ;; OPT PSEUDOSECTION:                                                    
    ; EDNS: version: 0, flags:; udp: 4096                                    
    ;; QUESTION SECTION:                                                     
    ;www.melita.com.                        IN      A                        
    
    ;; ANSWER SECTION:                                                       
    www.melita.com.         86400   IN      A       212.56.128.204           
    
    ;; AUTHORITY SECTION:                                                    
    melita.com.             86400   IN      NS      ns1.melitacable.com.     
    melita.com.             86400   IN      NS      ns.melitacable.com.      
    
    ;; Query time: 197 msec                                                  
    ;; SERVER: 192.168.9.253#53(192.168.9.253)                               
    ;; WHEN: Sat Nov 26 16:24:16 Central Standard Time 2016                  
    ;; MSG SIZE  rcvd: 106                                                   
    
    

    What do you get back?  Servfail, nx, timeout?  Its quite possible with how resolving works that your having issues with connectivity to their NS.. Can you query them directly?



  • Hi thanks for your reply and testing it out MM that is strange cos I always had this problem on different installs and different hardware, I wish  I can resolve this as melita is our ISP here and we need it.



  • A My friend johnpoz  love to hear from you :)  I get a page error This site can’t be reached


  • Rebel Alliance Global Moderator

    no with an actual tool that does a query.. page can not be reached doesn't mean your dns didn't work..

    Use drill like dok did, or dig or host or nslookup.. A tools that actually does a query that you can see the results in.. For all you know your browser is looking in its cache that it got back a nx before.. and has to wait for the neg cache to expire..

    Your browser has a dns cache, your OS dns client has a cache, pfsense has a cache.  You need to understand what is exactly happening.. And if you can not query or just some browser error, or maybe the site failed..



  • when I do dns lookup melita.com it results the ip fine. when I ping melita.com from a windows cms I get >ping melita.com
    Ping request could not find host melita.com. Please check the name and try again. when I ping the ip it pings fine


  • Rebel Alliance Global Moderator

    windows "cms" ?? what is that? content management system?  did you mean command prompt?

    what are you using for dns lookup - what tool?  And what are you doing the query too?  Maybe your machine is infected with something and hijacking connections??

    Please post your ping command and your "dns" command output.

    ping melita.com

    Pinging melita.com [212.56.128.204] with 32 bytes of data:
    Reply from 212.56.128.204: bytes=32 time=157ms TTL=53
    Reply from 212.56.128.204: bytes=32 time=157ms TTL=53
    Reply from 212.56.128.204: bytes=32 time=157ms TTL=53
    Reply from 212.56.128.204: bytes=32 time=157ms TTL=53

    Ping statistics for 212.56.128.204:
        Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
    Approximate round trip times in milli-seconds:
        Minimum = 157ms, Maximum = 157ms, Average = 157ms

    And again going to mention your dns tools will do a direct query, doing a ping could be getting answer from you OS dns client cache of neg response.  If your saying yoru dns query works..  The flush your windows local cache and try your ping by name again

    ipconfig /flushdns



  • Hi  I hit the s  by mistake I meant CMD. There is nothing wrong with the machines I tried the same on a fresh install laptop with same results, now when I change my dns settings manually in windows to google it opens the site fine and this is happening across all my machines phones and I also have a linux Manjaro pc same problem. I  used dns lookup in pfsense and it resolves it fine but on clients no

    C:\Users\Chris>ping melita.com
    Ping request could not find host melita.com. Please check the name and try again.


  • Rebel Alliance Global Moderator

    but if you do a dns query via nslookup or dig or drill or host from that same machine your saying it resolves??

    If so then flush the machines local cache and try your ping again!!

    from your cmd, ipconfig /flushdns

    dns query for it - does it work?

    then ping it..

    If ping says can not resolve then you got something wrong on the machines built in dns client.



  • I flushed it but same problem I did nslookup in cmd

    C:\Users\Chris>nslookup 212.56.128.204
    Server:  pfSense.localdomain
    Address:  192.168.0.1

    DNS request timed out.
        timeout was 2 seconds.
    *** Request to pfSense.localdomain timed-out

    C:\Users\Chris>nslookup melita.com
    Server:  pfSense.localdomain
    Address:  192.168.0.1

    *** pfSense.localdomain can't find melita.com: Server failed

    I am sure it is not my machines/devices as  using google dns on the machines or replacing pfsense with a different router  solves it



  • Ping from the pfsense box works  Diagnostics/ping

    PING melita.com (212.56.128.204): 56 data bytes
    64 bytes from 212.56.128.204: icmp_seq=0 ttl=60 time=9.888 ms
    64 bytes from 212.56.128.204: icmp_seq=1 ttl=60 time=11.754 ms
    64 bytes from 212.56.128.204: icmp_seq=2 ttl=60 time=16.079 ms

    –- melita.com ping statistics ---
    3 packets transmitted, 3 packets received, 0.0% packet loss
    round-trip min/avg/max/stddev = 9.888/12.574/16.079/2.593 ms

    The problems looks between the pfsense and devices communication


  • Rebel Alliance Global Moderator

    C:\Users\Chris>nslookup melita.com
    Server:  pfSense.localdomain
    Address:  192.168.0.1

    *** pfSense.localdomain can't find melita.com: Server failed

    Yeah sure looks like your having a issue resolving it.. Do you have pfsense using itself for dns??  Or do you have it using something else??  Thought you said your dns query for it worked??  From that you first got a timeout, pfsense was trying to resolve??  Then you get back serv failed..  Which normally means could not talk to the NS it..  So is psfense using itself, ie this will use resolver out of the box in resolver mode and pfsense asking the resolver for stuff it wants to resolve.

    nslookup is not as good at helping debug dns issues as dig is.  What I would suggest you do is install dig on your windows box, or use linux with dig or drill and do a trace..  This will talk to the roots and walk down the tree just like unbound does in resolver mode.  This should tell you where there is an issue.

    so example..

    
    > dig +trace +nodnssec melita.com
    
    ; <<>> DiG 9.11.0-P1 <<>> +trace +nodnssec melita.com
    ;; global options: +cmd
    .                       494382  IN      NS      j.root-servers.net.
    .                       494382  IN      NS      m.root-servers.net.
    .                       494382  IN      NS      a.root-servers.net.
    .                       494382  IN      NS      c.root-servers.net.
    .                       494382  IN      NS      e.root-servers.net.
    .                       494382  IN      NS      d.root-servers.net.
    .                       494382  IN      NS      k.root-servers.net.
    .                       494382  IN      NS      h.root-servers.net.
    .                       494382  IN      NS      f.root-servers.net.
    .                       494382  IN      NS      i.root-servers.net.
    .                       494382  IN      NS      b.root-servers.net.
    .                       494382  IN      NS      l.root-servers.net.
    .                       494382  IN      NS      g.root-servers.net.
    ;; Received 239 bytes from 192.168.9.253#53(192.168.9.253) in 0 ms
    
    com.                    172800  IN      NS      a.gtld-servers.net.
    com.                    172800  IN      NS      b.gtld-servers.net.
    com.                    172800  IN      NS      c.gtld-servers.net.
    com.                    172800  IN      NS      d.gtld-servers.net.
    com.                    172800  IN      NS      e.gtld-servers.net.
    com.                    172800  IN      NS      f.gtld-servers.net.
    com.                    172800  IN      NS      g.gtld-servers.net.
    com.                    172800  IN      NS      h.gtld-servers.net.
    com.                    172800  IN      NS      i.gtld-servers.net.
    com.                    172800  IN      NS      j.gtld-servers.net.
    com.                    172800  IN      NS      k.gtld-servers.net.
    com.                    172800  IN      NS      l.gtld-servers.net.
    com.                    172800  IN      NS      m.gtld-servers.net.
    ;; Received 527 bytes from 192.203.230.10#53(e.root-servers.net) in 15 ms
    
    melita.com.             172800  IN      NS      ns.melitacable.com.
    melita.com.             172800  IN      NS      ns1.melitacable.com.
    ;; Received 118 bytes from 192.55.83.30#53(m.gtld-servers.net) in 124 ms
    
    melita.com.             86400   IN      A       212.56.128.204
    melita.com.             86400   IN      NS      ns1.melitacable.com.
    melita.com.             86400   IN      NS      ns.melitacable.com.
    ;; Received 134 bytes from 212.56.128.132#53(ns.melitacable.com) in 156 ms
    
    

    You see it get roots, ask them for NS for .com, then ask .com NS who is NS for melita.com, then ask one of those NS for for the A record..

    You can just download dig for free as part of bind, then just install the "tools" 
    https://www.isc.org/downloads/

    Or just do it direct from pfsense with drill

    
    [2.3.2-RELEASE][root@pfsense.local.lan]/root: drill -T melita.com
    com.    172800  IN      NS      h.gtld-servers.net.
    com.    172800  IN      NS      l.gtld-servers.net.
    com.    172800  IN      NS      a.gtld-servers.net.
    com.    172800  IN      NS      e.gtld-servers.net.
    com.    172800  IN      NS      f.gtld-servers.net.
    com.    172800  IN      NS      d.gtld-servers.net.
    com.    172800  IN      NS      g.gtld-servers.net.
    com.    172800  IN      NS      j.gtld-servers.net.
    com.    172800  IN      NS      b.gtld-servers.net.
    com.    172800  IN      NS      m.gtld-servers.net.
    com.    172800  IN      NS      k.gtld-servers.net.
    com.    172800  IN      NS      i.gtld-servers.net.
    com.    172800  IN      NS      c.gtld-servers.net.
    melita.com.     172800  IN      NS      ns.melitacable.com.
    melita.com.     172800  IN      NS      ns1.melitacable.com.
    melita.com.     86400   IN      A       212.56.128.204
    melita.com.     86400   IN      NS      ns1.melitacable.com.
    melita.com.     86400   IN      NS      ns.melitacable.com.
    
    

    If it fails - you can u the verbosity with

    drill -T -V 5 melita.com




  • Hi here is the dig

    C:\Users\Chris>dig melita.com

    ; <<>> DiG 9.11.0-P1 <<>> melita.com
    ;; global options: +cmd
    ;; Got answer:
    ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 661
    ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

    ;; OPT PSEUDOSECTION:
    ; EDNS: version: 0, flags:; udp: 4096
    ; COOKIE: 95b8d2028f289628 (echoed)
    ;; QUESTION SECTION:
    ;melita.com.                    IN      A

    ;; Query time: 0 msec
    ;; SERVER: 192.168.0.1#53(192.168.0.1)
    ;; WHEN: Sun Nov 27 16:04:07 W. Europe Standard Time 2016
    ;; MSG SIZE  rcvd: 51


  • Rebel Alliance Global Moderator

    No this not the dig I showed you.. Do a full trace.. and forget any dnssec stuff.. Maybe that is what is failing for you, which is why lets do it without the dnssec, etc.

    dig +trace +nodnssec melita.com



  • :) sorry is this it

    C:\Users\Chris>dig trace nodnssec melita.com

    ; <<>> DiG 9.11.0-P1 <<>> trace nodnssec melita.com
    ;; global options: +cmd
    ;; Got answer:
    ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 539
    ;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

    ;; OPT PSEUDOSECTION:
    ; EDNS: version: 0, flags:; udp: 4096
    ;; QUESTION SECTION:
    ;trace.                        IN      A

    ;; AUTHORITY SECTION:
    .                      2594    IN      SOA    a.root-servers.net. nstld.verisign-grs.com. 2016112700 1800 900 604800 86400

    ;; Query time: 63 msec
    ;; SERVER: 192.168.0.1#53(192.168.0.1)
    ;; WHEN: Sun Nov 27 16:35:12 W. Europe Standard Time 2016
    ;; MSG SIZE  rcvd: 109

    ;; Got answer:
    ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 44812
    ;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

    ;; OPT PSEUDOSECTION:
    ; EDNS: version: 0, flags:; udp: 4096
    ;; QUESTION SECTION:
    ;nodnssec.                      IN      A

    ;; AUTHORITY SECTION:
    .                      2594    IN      SOA    a.root-servers.net. nstld.verisign-grs.com. 2016112700 1800 900 604800 86400

    ;; Query time: 62 msec
    ;; SERVER: 192.168.0.1#53(192.168.0.1)
    ;; WHEN: Sun Nov 27 16:35:12 W. Europe Standard Time 2016
    ;; MSG SIZE  rcvd: 112

    ;; connection timed out; no servers could be reached


  • Rebel Alliance Global Moderator

    Dude copy and paste!!  you need the + signs…

    do you not even read what it outputs

    ;; QUESTION SECTION:
    ;trace.                        IN      A

    Are you hungover or something?  Need a cup of coffee or 3?

    edit:  Oh your EU time.. Maybe your already started hitting the hooch? ;)



  • C:\Users\Chris>dig +trace +nodnssec melita.com

    ; <<>> DiG 9.11.0-P1 <<>> +trace +nodnssec melita.com
    ;; global options: +cmd
    ;; Received 12 bytes from 192.168.0.1#53(192.168.0.1) in 0 ms

    :) sorry


  • Rebel Alliance Global Moderator

    that is your full output??

    Is 192.168.0.1 pfsense?  And you have it resolver mode?  It should of atleast given you the root servers..  You got something wrong..

    Try it with just the +trace option

    dig +trace melita.com

    Also dig NS what does that give you back?

    
    C:\>dig NS
    
    ; <<>> DiG 9.11.0-P1 <<>> NS
    ;; global options: +cmd
    ;; Got answer:
    ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 33584
    ;; flags: qr rd ra ad; QUERY: 1, ANSWER: 13, AUTHORITY: 0, ADDITIONAL: 1
    
    ;; OPT PSEUDOSECTION:
    ; EDNS: version: 0, flags:; udp: 4096
    ;; QUESTION SECTION:
    ;.                              IN      NS
    
    ;; ANSWER SECTION:
    .                       487240  IN      NS      j.root-servers.net.
    .                       487240  IN      NS      m.root-servers.net.
    .                       487240  IN      NS      a.root-servers.net.
    .                       487240  IN      NS      c.root-servers.net.
    .                       487240  IN      NS      e.root-servers.net.
    .                       487240  IN      NS      d.root-servers.net.
    .                       487240  IN      NS      k.root-servers.net.
    .                       487240  IN      NS      h.root-servers.net.
    .                       487240  IN      NS      f.root-servers.net.
    .                       487240  IN      NS      i.root-servers.net.
    .                       487240  IN      NS      b.root-servers.net.
    .                       487240  IN      NS      l.root-servers.net.
    .                       487240  IN      NS      g.root-servers.net.
    
    ;; Query time: 0 msec
    ;; SERVER: 192.168.9.253#53(192.168.9.253)
    ;; WHEN: Sun Nov 27 09:49:40 Central Standard Time 2016
    ;; MSG SIZE  rcvd: 239
    
    


  • yes 192.168.0.1 is my pfsense and left everything default

    C:\Users\Chris>dig +trace melita.com

    ; <<>> DiG 9.11.0-P1 <<>> +trace melita.com
    ;; global options: +cmd
    ;; Received 12 bytes from 192.168.0.1#53(192.168.0.1) in 0 ms



  • C:\Users\Chris>dig NS

    ; <<>> DiG 9.11.0-P1 <<>> NS
    ;; global options: +cmd
    ;; Got answer:
    ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 65221
    ;; flags: qr rd ra ad; QUERY: 1, ANSWER: 13, AUTHORITY: 0, ADDITIONAL: 1

    ;; OPT PSEUDOSECTION:
    ; EDNS: version: 0, flags:; udp: 4096
    ;; QUESTION SECTION:
    ;.                              IN      NS

    ;; ANSWER SECTION:
    .                      512472  IN      NS      l.root-servers.net.
    .                      512472  IN      NS      h.root-servers.net.
    .                      512472  IN      NS      d.root-servers.net.
    .                      512472  IN      NS      f.root-servers.net.
    .                      512472  IN      NS      m.root-servers.net.
    .                      512472  IN      NS      a.root-servers.net.
    .                      512472  IN      NS      b.root-servers.net.
    .                      512472  IN      NS      j.root-servers.net.
    .                      512472  IN      NS      k.root-servers.net.
    .                      512472  IN      NS      i.root-servers.net.
    .                      512472  IN      NS      c.root-servers.net.
    .                      512472  IN      NS      e.root-servers.net.
    .                      512472  IN      NS      g.root-servers.net.

    ;; Query time: 0 msec
    ;; SERVER: 192.168.0.1#53(192.168.0.1)
    ;; WHEN: Sun Nov 27 16:57:10 W. Europe Standard Time 2016
    ;; MSG SIZE  rcvd: 239


  • Rebel Alliance Global Moderator

    WTF???

    So try the +trace +nodnssec command on some other domain that works..

    say pfsense.org

    
    C:\>dig +trace +nodnssec pfsense.org
    
    ; <<>> DiG 9.11.0-P1 <<>> +trace +nodnssec pfsense.org
    ;; global options: +cmd
    .                       485772  IN      NS      j.root-servers.net.
    .                       485772  IN      NS      m.root-servers.net.
    .                       485772  IN      NS      a.root-servers.net.
    .                       485772  IN      NS      c.root-servers.net.
    .                       485772  IN      NS      e.root-servers.net.
    .                       485772  IN      NS      d.root-servers.net.
    .                       485772  IN      NS      k.root-servers.net.
    .                       485772  IN      NS      h.root-servers.net.
    .                       485772  IN      NS      f.root-servers.net.
    .                       485772  IN      NS      i.root-servers.net.
    .                       485772  IN      NS      b.root-servers.net.
    .                       485772  IN      NS      l.root-servers.net.
    .                       485772  IN      NS      g.root-servers.net.
    ;; Received 239 bytes from 192.168.9.253#53(192.168.9.253) in 0 ms
    
    org.                    172800  IN      NS      b0.org.afilias-nst.org.
    org.                    172800  IN      NS      a2.org.afilias-nst.info.
    org.                    172800  IN      NS      c0.org.afilias-nst.info.
    org.                    172800  IN      NS      a0.org.afilias-nst.info.
    org.                    172800  IN      NS      d0.org.afilias-nst.org.
    org.                    172800  IN      NS      b2.org.afilias-nst.org.
    ;; Received 442 bytes from 192.33.4.12#53(c.root-servers.net) in 13 ms
    
    pfsense.org.            86400   IN      NS      ns1.netgate.com.
    pfsense.org.            86400   IN      NS      ns2.netgate.com.
    ;; Received 87 bytes from 199.249.112.1#53(a2.org.afilias-nst.info) in 12 ms
    
    pfsense.org.            300     IN      A       208.123.73.69
    pfsense.org.            300     IN      NS      ns2.netgate.com.
    pfsense.org.            300     IN      NS      ns1.netgate.com.
    ;; Received 135 bytes from 192.207.126.6#53(ns1.netgate.com) in 54 ms
    
    

    you didn't put in some domain overrides or anything for this melita.com did you???

    Ok I was able to duplicate what you saw.. Your ACL is only set to allow vs allow snoop..

    
    > dig +trace +nodnssec melita.com
    
    ; <<>> DiG 9.11.0-P1 <<>> +trace +nodnssec melita.com
    ;; global options: +cmd
    ;; Received 12 bytes from 192.168.9.253#53(192.168.9.253) in 1 ms
    
    

    Go into your unbound acl and change to allow snoop vs allow.. Then try the +trace dig again.




  • sorry dude did the acl but same

    C:\Users\Chris>dig +trace +nodnssec pfsense.org

    ; <<>> DiG 9.11.0-P1 <<>> +trace +nodnssec pfsense.org
    ;; global options: +cmd
    ;; Received 12 bytes from 192.168.0.1#53(192.168.0.1) in 0 ms



  • I really really thank you for all your time and help. But if it is  getting a headache for you please do not feel obligated in anyway to resolve this for me. Thanks again friend



  • I disabled resolver and enabled the forwarder, in forwarder  the site resolves and works fine.


  • Rebel Alliance Global Moderator

    Are you using the ACL??

    Did you turn off the auto ones?
    Disable Auto-added Access Control

    In the advanced section of unbound?

    Try the drill command from pfsense directly.. what we are looking for is where it fails in the resolve process for that domain.. Is it talking to their authoritative servers??

    You could try that.. do say

    
    > dig @212.56.128.196 melita.com.
    
    ; <<>> DiG 9.11.0-P1 <<>> @212.56.128.196 melita.com.
    ; (1 server found)
    ;; global options: +cmd
    ;; Got answer:
    ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 33157
    ;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 3
    ;; WARNING: recursion requested but not available
    
    ;; OPT PSEUDOSECTION:
    ; EDNS: version: 0, flags:; udp: 4096
    ;; QUESTION SECTION:
    ;melita.com.                    IN      A
    
    ;; ANSWER SECTION:
    melita.com.             86400   IN      A       212.56.128.204
    
    ;; AUTHORITY SECTION:
    melita.com.             86400   IN      NS      ns1.melitacable.com.
    melita.com.             86400   IN      NS      ns.melitacable.com.
    
    ;; ADDITIONAL SECTION:
    ns.melitacable.com.     86400   IN      A       212.56.128.132
    ns1.melitacable.com.    86400   IN      A       212.56.128.196
    
    ;; Query time: 158 msec
    ;; SERVER: 212.56.128.196#53(212.56.128.196)
    ;; WHEN: Sun Nov 27 11:30:00 Central Standard Time 2016
    ;; MSG SIZE  rcvd: 134
    
    

    Try the other NS if that one fails 212.56.128.196



  • Hi John sorry  for the delay I will do drill command in pfsense and get back to you  btw yes I disabled the auto ACL in advanced settings


  • Rebel Alliance Global Moderator

    if you have a ACL setup correctly then you for sure should be able to get the roots from pfsense and then your dig +trace command should work, or atleast return with the roots, it might fail after that but its shouldn't come back blank like you were seeing.



  • Is this it

    ;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 8444
    ;; flags: qr rd ra ; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
    ;; QUESTION SECTION:
    ;; melita.com. IN A

    ;; ANSWER SECTION:
    melita.com. 79580 IN A 212.56.128.204

    ;; AUTHORITY SECTION:

    ;; ADDITIONAL SECTION:

    ;; Query time: 12 msec
    ;; SERVER: 212.56.129.228
    ;; WHEN: Mon Nov 28 18:44:37 2016
    ;; MSG SIZE  rcvd: 44



  • when I Disable Auto-added Access Control nothing gets resolved I had to uncheck  it


  • Rebel Alliance Global Moderator

    this is because if you don't use the auto, you have to create your own!!!  Which you said you did, I posted a screen of mine as example..


  • Rebel Alliance Global Moderator

    you don't need the ipv6.. Shoot I should of hid thouse..  Could you please delete that pic, I will delete mine and repost with thos hidden.

    You need to put in the network your using.. What network are you using - if for example 172.16/12 then my acl would not work for you..

    Your using 192.168.0/24 right.. So if that is the only network you query pfsense from then that would be in your allow list.  So if you put in 192.168/16 like I have then it should work.. So your still not getting the root servers when you do a +trace from your client on 192.168 network??

    Do the drill command on pfsense then.. Lets see where its failing.



  • Sorry John for posting the pic I removed it from my pc and post. My network is 192.168.0.1/24


  • Rebel Alliance Global Moderator

    Oh not on you at all!!! It was my bad for not seeing I posted a global IPv6 address… Thanks for removing it.. I reposted with the ipv6 obfuscated.  In the big picture prob not a issue at all..  Normally I wouldn't care.. but as you can see from my neg karma number.  Some people don't always like my posts ;)  And vs doing the -1 which would be their right.. They hit it an hit it and hit it.. I know for sure about 60 of those came from 2 guys..

    So with the ability to rent the very large botnets, I wouldn't put it past some people to think its funny to run a ddos against..  Yes I have my tinfoil hat on while typing this..

    192.168.0.1/24 is not a network btw, that is a host address the 192.168.0.0/24 ;)  So if your putting in ACL you can put in 192.168.0.0/24 or 192.168.0.0/16 is the full 192.168 rfc1918 space.



  • DW John remember the guys that try to help in this world get the slapped back instead of thank you, I read a post with a guy admitting was longing to pick one out with you and accused you that you dont know what you are talking about llooolll Some should learn from you. Now sorry for asking but should I go to Command Prompt in pfsense and type drill melita.com?



  • ;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 59963
    ;; flags: qr rd ra ; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
    ;; QUESTION SECTION:
    ;; melita.com. IN A

    ;; ANSWER SECTION:
    melita.com. 36082 IN A 212.56.128.204

    ;; AUTHORITY SECTION:

    ;; ADDITIONAL SECTION:

    ;; Query time: 9 msec
    ;; SERVER: 212.56.132.20
    ;; WHEN: Mon Nov 28 20:00:06 2016
    ;; MSG SIZE  rcvd: 44


  • Rebel Alliance Global Moderator

    yeah you need to -T with the drill command

    drill -T melita.com

    This should give you the full trace like dig would do..

    So for example running it on my pfsense just now.

    
    [2.3.2-RELEASE][root@pfsense.local.lan]/root: drill -T  melita.com
    com.    172800  IN      NS      e.gtld-servers.net.
    com.    172800  IN      NS      b.gtld-servers.net.
    com.    172800  IN      NS      j.gtld-servers.net.
    com.    172800  IN      NS      m.gtld-servers.net.
    com.    172800  IN      NS      i.gtld-servers.net.
    com.    172800  IN      NS      f.gtld-servers.net.
    com.    172800  IN      NS      a.gtld-servers.net.
    com.    172800  IN      NS      g.gtld-servers.net.
    com.    172800  IN      NS      h.gtld-servers.net.
    com.    172800  IN      NS      l.gtld-servers.net.
    com.    172800  IN      NS      k.gtld-servers.net.
    com.    172800  IN      NS      c.gtld-servers.net.
    com.    172800  IN      NS      d.gtld-servers.net.
    melita.com.     172800  IN      NS      ns.melitacable.com.
    melita.com.     172800  IN      NS      ns1.melitacable.com.
    melita.com.     86400   IN      A       212.56.128.204
    melita.com.     86400   IN      NS      ns1.melitacable.com.
    melita.com.     86400   IN      NS      ns.melitacable.com.
    [2.3.2-RELEASE][root@pfsense.local.lan]/root:
    
    

    If fails try adding the -V 5 command so we get full details

    drill -T -V 5 melita.com



  • ;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 0
    ;; flags: ; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
    ;; QUESTION SECTION:
    ;; . IN NS

    ;; ANSWER SECTION:

    ;; AUTHORITY SECTION:

    ;; ADDITIONAL SECTION:

    ;; Query time: 0 msec
    ;; WHEN: Mon Nov 28 21:12:10 2016
    ;; MSG SIZE  rcvd: 0
    ;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 0
    ;; flags: rd ; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
    ;; QUESTION SECTION:
    ;; 201.79.228.192.in-addr.arpa. IN PTR

    ;; ANSWER SECTION:

    ;; AUTHORITY SECTION:

    ;; ADDITIONAL SECTION:

    ;; Query time: 0 msec
    ;; WHEN: Mon Nov 28 21:12:10 2016
    ;; MSG SIZE  rcvd: 0
    . 518400 IN NS i.root-servers.net.
    . 518400 IN NS f.root-servers.net.
    . 518400 IN NS k.root-servers.net.
    . 518400 IN NS l.root-servers.net.
    . 518400 IN NS d.root-servers.net.
    . 518400 IN NS h.root-servers.net.
    . 518400 IN NS m.root-servers.net.
    . 518400 IN NS j.root-servers.net.
    . 518400 IN NS g.root-servers.net.
    . 518400 IN NS e.root-servers.net.
    . 518400 IN NS c.root-servers.net.
    . 518400 IN NS b.root-servers.net.
    . 518400 IN NS a.root-servers.net.
    ;; Received 492 bytes from 192.228.79.201#53(b.root-servers.net.) in 205 ms

    ;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 0
    ;; flags: ; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
    ;; QUESTION SECTION:
    ;; melita.com. IN A

    ;; ANSWER SECTION:

    ;; AUTHORITY SECTION:

    ;; ADDITIONAL SECTION:

    ;; Query time: 0 msec
    ;; WHEN: Mon Nov 28 21:12:10 2016
    ;; MSG SIZE  rcvd: 0
    com. 172800 IN NS a.gtld-servers.net.
    com. 172800 IN NS b.gtld-servers.net.
    com. 172800 IN NS c.gtld-servers.net.
    com. 172800 IN NS d.gtld-servers.net.
    com. 172800 IN NS e.gtld-servers.net.
    com. 172800 IN NS f.gtld-servers.net.
    com. 172800 IN NS g.gtld-servers.net.
    com. 172800 IN NS h.gtld-servers.net.
    com. 172800 IN NS i.gtld-servers.net.
    com. 172800 IN NS j.gtld-servers.net.
    com. 172800 IN NS k.gtld-servers.net.
    com. 172800 IN NS l.gtld-servers.net.
    com. 172800 IN NS m.gtld-servers.net.
    ;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 0
    ;; flags: rd ; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
    ;; QUESTION SECTION:
    ;; 53.2.63.128.in-addr.arpa. IN PTR

    ;; ANSWER SECTION:

    ;; AUTHORITY SECTION:

    ;; ADDITIONAL SECTION:

    ;; Query time: 0 msec
    ;; WHEN: Mon Nov 28 21:12:15 2016
    ;; MSG SIZE  rcvd: 0
    ;; Received 488 bytes from 128.63.2.53#53(h.root-servers.net.) in 5154 ms

    ;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 0
    ;; flags: ; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
    ;; QUESTION SECTION:
    ;; melita.com. IN A

    ;; ANSWER SECTION:

    ;; AUTHORITY SECTION:

    ;; ADDITIONAL SECTION:

    ;; Query time: 0 msec
    ;; WHEN: Mon Nov 28 21:12:16 2016
    ;; MSG SIZE  rcvd: 0
    melita.com. 172800 IN NS ns.melitacable.com.
    melita.com. 172800 IN NS ns1.melitacable.com.
    ;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 0
    ;; flags: rd ; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
    ;; QUESTION SECTION:
    ;; 30.14.33.192.in-addr.arpa. IN PTR

    ;; ANSWER SECTION:

    ;; AUTHORITY SECTION:

    ;; ADDITIONAL SECTION:

    ;; Query time: 0 msec
    ;; WHEN: Mon Nov 28 21:12:16 2016
    ;; MSG SIZE  rcvd: 0
    ;; Received 107 bytes from 192.33.14.30#53(b.gtld-servers.net.) in 44 ms

    ;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 0
    ;; flags: ; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
    ;; QUESTION SECTION:
    ;; melita.com. IN A

    ;; ANSWER SECTION:

    ;; AUTHORITY SECTION:

    ;; ADDITIONAL SECTION:

    ;; Query time: 0 msec
    ;; WHEN: Mon Nov 28 21:12:16 2016
    ;; MSG SIZE  rcvd: 0
    ;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 0
    ;; flags: ; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
    ;; QUESTION SECTION:
    ;; melita.com. IN A

    ;; ANSWER SECTION:

    ;; AUTHORITY SECTION:

    ;; ADDITIONAL SECTION:

    ;; Query time: 0 msec
    ;; WHEN: Mon Nov 28 21:12:46 2016
    ;; MSG SIZE  rcvd: 0


  • Rebel Alliance Global Moderator

    So doesn't look like your getting any answer from the NS for that domain.

    melita.com.  172800  IN  NS  ns.melitacable.com.
    melita.com.  172800  IN  NS  ns1.melitacable.com.

    Query them directly!!

    Their IPs I gave ealier, but here they are again.
    ns1.melitacable.com.    86088  IN      A      212.56.128.196
    ns.melitacable.com.    86088  IN      A      212.56.128.132

    so from pfsense

    drill @212.56.128.196 melita.com

    
    [2.3.2-RELEASE][root@pfsense.local.lan]/root: drill @212.56.128.196 melita.com
    ;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 58179
    ;; flags: qr aa rd ; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 2
    ;; QUESTION SECTION:
    ;; melita.com.  IN      A
    
    ;; ANSWER SECTION:
    melita.com.     86400   IN      A       212.56.128.204
    
    ;; AUTHORITY SECTION:
    melita.com.     86400   IN      NS      ns1.melitacable.com.
    melita.com.     86400   IN      NS      ns.melitacable.com.
    
    ;; ADDITIONAL SECTION:
    ns.melitacable.com.     86400   IN      A       212.56.128.132
    ns1.melitacable.com.    86400   IN      A       212.56.128.196
    
    ;; Query time: 157 msec
    ;; SERVER: 212.56.128.196
    ;; WHEN: Mon Nov 28 15:17:58 2016
    ;; MSG SIZE  rcvd: 123
    
    
    
    [2.3.2-RELEASE][root@pfsense.local.lan]/root: drill @212.56.128.132 melita.com
    ;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 30011
    ;; flags: qr aa rd ; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 2
    ;; QUESTION SECTION:
    ;; melita.com.  IN      A
    
    ;; ANSWER SECTION:
    melita.com.     86400   IN      A       212.56.128.204
    
    ;; AUTHORITY SECTION:
    melita.com.     86400   IN      NS      ns1.melitacable.com.
    melita.com.     86400   IN      NS      ns.melitacable.com.
    
    ;; ADDITIONAL SECTION:
    ns.melitacable.com.     86400   IN      A       212.56.128.132
    ns1.melitacable.com.    86400   IN      A       212.56.128.196
    
    ;; Query time: 158 msec
    ;; SERVER: 212.56.128.132
    ;; WHEN: Mon Nov 28 15:18:55 2016
    ;; MSG SIZE  rcvd: 123
    [2.3.2-RELEASE][root@pfsense.local.lan]/root:
    
    


  • ;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 0
    ;; flags: ; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
    ;; QUESTION SECTION:
    ;; . IN NS

    ;; ANSWER SECTION:

    ;; AUTHORITY SECTION:

    ;; ADDITIONAL SECTION:

    ;; Query time: 0 msec
    ;; WHEN: Mon Nov 28 22:28:30 2016
    ;; MSG SIZE  rcvd: 0
    ;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 0
    ;; flags: rd ; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
    ;; QUESTION SECTION:
    ;; 4.36.112.192.in-addr.arpa. IN PTR

    ;; ANSWER SECTION:

    ;; AUTHORITY SECTION:

    ;; ADDITIONAL SECTION:

    ;; Query time: 0 msec
    ;; WHEN: Mon Nov 28 22:28:30 2016
    ;; MSG SIZE  rcvd: 0
    . 518400 IN NS d.root-servers.net.
    . 518400 IN NS f.root-servers.net.
    . 518400 IN NS j.root-servers.net.
    . 518400 IN NS k.root-servers.net.
    . 518400 IN NS e.root-servers.net.
    . 518400 IN NS c.root-servers.net.
    . 518400 IN NS g.root-servers.net.
    . 518400 IN NS a.root-servers.net.
    . 518400 IN NS h.root-servers.net.
    . 518400 IN NS b.root-servers.net.
    . 518400 IN NS m.root-servers.net.
    . 518400 IN NS l.root-servers.net.
    . 518400 IN NS i.root-servers.net.
    ;; Received 492 bytes from 192.112.36.4#53(G.ROOT-SERVERS.NET.) in 63 ms

    ;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 0
    ;; flags: ; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
    ;; QUESTION SECTION:
    ;; 212.56.128.196. IN A

    ;; ANSWER SECTION:

    ;; AUTHORITY SECTION:

    ;; ADDITIONAL SECTION:

    ;; Query time: 0 msec
    ;; WHEN: Mon Nov 28 22:28:33 2016
    ;; MSG SIZE  rcvd: 0
    ;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 0
    ;; flags: ; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
    ;; QUESTION SECTION:
    ;; 212.56.128.196. IN A

    ;; ANSWER SECTION:

    ;; AUTHORITY SECTION:

    ;; ADDITIONAL SECTION:

    ;; Query time: 0 msec
    ;; WHEN: Mon Nov 28 22:28:48 2016
    ;; MSG SIZE  rcvd: 0
    . 86400 IN SOA a.root-servers.net. nstld.verisign-grs.com. 2016112801 1800 900 604800 86400
    ;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 0
    ;; flags: rd ; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
    ;; QUESTION SECTION:
    ;; 12.4.33.192.in-addr.arpa. IN PTR

    ;; ANSWER SECTION:

    ;; AUTHORITY SECTION:

    ;; ADDITIONAL SECTION:

    ;; Query time: 0 msec
    ;; WHEN: Mon Nov 28 22:28:48 2016
    ;; MSG SIZE  rcvd: 0
    ;; Received 107 bytes from 192.33.4.12#53(c.root-servers.net.) in 58 ms