DNS resolver not resolving itself (pfsense FW host)

ted · Dec 15, 2016, 8:01 PM

Problem: DNS resolver is not resolving the hostname for itself, the pfsense host. Any suggestion on why or where to look in the config?

Background:

I'm running a very basic setup with pfsense as my router, default gw / fw, and DHCP server with a single WAN connection and two LAN connections with a couple VLANs. I have the hostname, domain information, and upstream DNS info filled out in the basic pfsense config pages.

DNS resolver is running on the all the LAN interfaces and localhost. DNS resolver has no problem resolving all the local hosts on my LAN that have static DHCP mappings, hosts that register their hostname via DHCP, and all internet hosts. The only host that doesn't resolve is the actual pfsense fw host running DNS resolver. Any thoughts?

johnpoz · Dec 15, 2016, 8:37 PM

"upstream DNS info filled out in the basic pfsense config pages."

Well if you told pfsense to use 8.8.8.8 for example how would it resolve its own name, etc. Just let it point to the local resolver at loopback 127.0.0.1..

ted · Dec 16, 2016, 2:17 AM

Sorry, little confused. If I remove the public DNS servers from the General Setup page, the DNS resolver can't resolve any public addresses. The General setup page indicates that "By default localhost (127.0.0.1) will be used as the first DNS server where the DNS Forwarder or DNS Resolver is enabled and set to listen on Localhost, so system can use the local DNS service to perform lookups."

Here's my setup.

Under System - > General Setup ->

DNS Server 1 8.8.8.8 WAN_DHCP
DNS Server 2 8.8.4.4 WAN_DHCP

Do not use the DNS Forwarder as a DNS server for the firewall - unchecked

Under Services -> DNS Resolver -> General Settings

Outgoing Network Interfaces - ALL

DNS Query Forwarding - Enable Forwarding Mode - checked

johnpoz · Dec 16, 2016, 2:29 AM

Not when you uncheck to use it..

You know they setup the resolver to be default, since it works without having the user do anything.. It resolves and firewall asks it, ie itself so it can resolve local stuff, and public stuff.

And yet users still mess it up..

A resolver works by walking down the tree from the roots to find the authoritative server for the domain your looking for.. You do not need to point to any forwarder.. ie googledns for dns to work..

If you want to use a forwarder, then ok do that - but you still need to have pfsense ask its self first, and then the forwarder/resolver in forwarder mode or resolver mode will either forward or resolve if your looking for something else.

Unless your not running the forwarder or the resolver on pfsense there is is no need to have anything in the general settings other than loopback, ie itself.

ted · Dec 16, 2016, 2:45 AM

Greatly appreciate the help.

So if leave all my settings as above but remove the two public DNS servers (8.8.8.8, 8.8.4.4) and add 127.0.0.1 under general settings I am unable to resolve any public hosts.

johnpoz · Dec 16, 2016, 3:23 AM

So are you using the forwarder or the resolver or the resolver in forwarder mode?? Go to diag and lookup.. what happens?

ted · Dec 16, 2016, 4:25 AM

DNS resolver - enabled
DNS Query Forwarding Enable Forwarding Mode - unchecked

DNS forwarder - disabled

If I use Diagnostics / DNS Lookup I am able to resolve all the hosts on my local network except the name of the pfsense fw itself. Internet hosts also resolve fine. 127.0.0.1 is listed as the first nameserver.

johnpoz · Dec 16, 2016, 4:54 AM

Ok so everything is working.. What is the name of your pfsense box?

Mine is pfsense.local.lan

What is yours?

So what happens when you look for your pfsense name?

ted · Dec 16, 2016, 2:05 PM

That's exactly my problem. All hosts on the local lan and internet resolve fine EXCEPT the pfsense gw box itself.

My pfsense gw/router is named "gw.local.lan". If I use the Diagnostics -> DNS lookup page and put in gw.local.lan I am unable to resolve the ip 192.168.0.1. Yes. Local host (127.0.0.1) does respond in ~2ms but does not have an answer for gw.local.lan. Local host 127.0.0.1 is able to resolve all my other host such as tv.local.lan, NAS.local.lan, laptop.local.lan etc.

Any thoughts? Can I manually edit the unbound.conf file and add a entry for gw.local.lan?

johnpoz · Dec 16, 2016, 2:15 PM

You shouldn't have too.. You sure thats its name.. And you have the host name and the local.lan in the domain section. Can you post up your screenshot like I showed of mine.

But if need be you can create a host override for any name. But you shouldn't have too.. clearly pfsense should know its own name, so gets me to think something not as you think.

You can always look in etc/hosts what do you see there?

[2.3.2-RELEASE][root@pfsense.local.lan]/root: cat /etc/hosts
127.0.0.1 localhost localhost.local.lan
::1 localhost localhost.local.lan
192.168.9.253 pfsense.local.lan pfsense
2001:snipped::1 pfsense.local.lan pfsense

You should see all your hosts there, and right near the top should be your pfsense name

kpa · Dec 16, 2016, 2:31 PM

Also verify that you have the 127.0.0.1 entry in /etc/resolv.conf as the first line, I'm not sure based on your posts if you already checked that.

ted · Dec 17, 2016, 12:00 AM

So yeah, my /etc/hosts file did NOT have an entry for the pfsense gw. I manually added "192.168.0.1 gw.local.lan gw" and of course things worked fine. However my changes don't persist a reboot. For now I've added a manual host override entry under DNS resolver for gw.local.lan. This ensures that "192.168.0.1 gw.local.lan gw" persists a reboot in /etc/hosts.

Something odd is going on here though. As you mentioned the pfsense gw should be automatically added to the /etc/hosts file. I've double checked my System -> General Setup page, my host and domain are entered correctly. This is further confirmed by the fact that when I ssh to a shell my login prompt shows:

[2.3.2-RELEASE][admin@gw.local.lan]/root:

Any thoughts?

Nullity · Dec 18, 2016, 8:29 PM

Do you get anything when you reverse resolve 192.168.0.1?

jahonix · Dec 19, 2016, 12:31 AM

What do you have at System: General Setup for hostname and domain?

ted · Dec 19, 2016, 8:00 PM

W/o the static host override entry a nslookup or ping for gw.local.lan fails, "cannot resolve gw.local.lan: Unknown host"

With the static host overide entry nslookups and pings to gw.local.lan works fine.

In my System -> General Setup page, I have

Hostname: gw

Domain: local.lan

I'm pretty sure my hostname is setup correctly, when I ssh to a shell my login prompt shows:

[2.3.2-RELEASE][admin@gw.local.lan]/root:

limona21 · Apr 24, 2017, 4:37 PM

I have the same issue - pfsense is resolving all clients with static DHCP mappings however it is not resolving itself. It worked before but I restored pfsense to factory settings due to OpenVPN (unable to conact deamon) problem - which didnt solve the issue.

I also have a very basic setup with no forwarding of queries and nothing like that. DNS resolver is up and running and DNS Server Override is checked. I did check the host file and in fact there is no entry for the pfsense itself but I don't think I should put it there manually. It should've known its name right? When I run "nslookup pfsense" in the terminal is does not return an answer.

The configuration is so bare I don't know what to check. Any ideas?
I am running version 2.3.3_1

![Screen Shot 2017-04-24 at 18.32.02.png](/public/imported_attachments/1/Screen Shot 2017-04-24 at 18.32.02.png)
![Screen Shot 2017-04-24 at 18.32.02.png_thumb](/public/imported_attachments/1/Screen Shot 2017-04-24 at 18.32.02.png_thumb)
![Screen Shot 2017-04-24 at 18.28.24.png](/public/imported_attachments/1/Screen Shot 2017-04-24 at 18.28.24.png)
![Screen Shot 2017-04-24 at 18.28.24.png_thumb](/public/imported_attachments/1/Screen Shot 2017-04-24 at 18.28.24.png_thumb)
![Screen Shot 2017-04-24 at 18.37.23.png](/public/imported_attachments/1/Screen Shot 2017-04-24 at 18.37.23.png)
![Screen Shot 2017-04-24 at 18.37.23.png_thumb](/public/imported_attachments/1/Screen Shot 2017-04-24 at 18.37.23.png_thumb)

ted · Apr 25, 2017, 3:14 PM

I never found the root cause, tried the same as you and performed a reset to no avial. I left a manual host override entry under DNS resolver for gw.local.lan, ensuring that "192.168.0.1 gw.local.lan gw" persists a reboot in /etc/hosts. Everything else is working fine and as expected.

johnpoz · Apr 25, 2017, 3:22 PM

And you still have it checked to let dhcp override your settings!! So pfsense is asking who exactly for its own name?