• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

Help Setting Up DNS Resolver

Scheduled Pinned Locked Moved DHCP and DNS
18 Posts 5 Posters 9.0k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • M
    mhertzfeld
    last edited by Dec 27, 2016, 10:30 PM

    I need help setting up the DNS Resolver.

    Here are my settings so far.

    Under System/General Setup I have
    All DNS servers settings are currently empty
    DNS Server Override: UnChecked
    Disable DNS Forwarder: UnChecked

    I checked my resolv.conf file and it has nameserver 127.0.01 as the first line.  The second line has search and then the domain name.

    Under Services/DNS Resolver/General Settings I have
    Enable DNS Resolver: Checked
    Network Interfaces: LAN, LAN2 and Localhost selected
    Outgoing Network Interfaces: WAN
    System Domain Local Zone Type: Transparent (not sure about this, it was pre selected)
    Enable DNSSEC Support: Checked
    Enable Forwarding Mode: UnChecked

    Under Services/DNS Forwarder
    Enable DNSforwarder: UnChecked

    My clients "seem" to be resolving addresses ok.  I am able to ping random addresses like www.espn.com and am able to resolve the name and get the ipaddress.  The DNS server the clients are using (according to ipconfig) is the address of my pfsense router.

    However when I do a lookup using Diagnostics/DNS Lookup of www.espn.com I get a message saying "No Response" under Query Time.  The Name server is 127.0.0.1

    I am able to overcome this by adding my pfsense routers ip address (192.168.0.1) to the System/General Setup/DNS Servers list.  When added there is still No Response from 127.0.0.1 but there is a successful response from 192.168.0.1.

    So from what I can tell there is still something messed up with my configurations since from what I've read up to this point leads me to believe that I shouldn't have to add 192.168.0.1 to the list of DNS servers under System/General Setup.

    1 Reply Last reply Reply Quote 0
    • H
      hda
      last edited by Dec 27, 2016, 10:53 PM Dec 27, 2016, 10:42 PM

      @mhertzfeld:

      Network Interfaces: LAN, LAN2 and Localhost selected
      Outgoing Network Interfaces: WAN

      I think you need Localhost always.
      I use All and All interfaces (my IPv6), works OK for your [www.espn.com]
      Ofcourse I do not allow an open WAN port 53 !

      1 Reply Last reply Reply Quote 0
      • M
        mhertzfeld
        last edited by Dec 27, 2016, 11:00 PM

        Thanks.  After reading your comment I changed to All, All.  I saved and applied the settings then waited a few minutes.

        When running dns lookup there is still no response from nameserver 127.0.0.1

        I am still getting a successful response from nameserver 192.168.0.1

        1 Reply Last reply Reply Quote 0
        • H
          hda
          last edited by Dec 27, 2016, 11:41 PM Dec 27, 2016, 11:30 PM

          I assume you are on 2.3.2., else clear out all GUI config of Forwarder and save.

          Anyway this: stop Resolver & stop Forwarder first, dead. (uncheck enable & save both)
          So be sure you do not have both Services active. (Exclusive service (No need for Forwarder if Resolver)).

          You do not need anything like 192… in setting General.
          Clear those setting for General out and save,
          All your other config input are fine as I read it with All & All.

          Then start Resolver again. (check enable & save)

          1 Reply Last reply Reply Quote 0
          • M
            mhertzfeld
            last edited by Dec 28, 2016, 12:00 AM

            yes I am on 2.3.2-p1

            I disabled the Resolver, saved and applied.  Went to services to confirm it was gone.

            The forwarder was already disable and never was enabled, so I did not do anything with that.

            I cleared out all entries under General/DNS Servers.  (there was only the one that pointed to 192.168.0.1 with no gateway selected)

            I re-enabled the Resolver, saved and applied.

            Ran DNS Lookup again and received no response from 127.0.0.1

            1 Reply Last reply Reply Quote 0
            • S
              S_Erickson
              last edited by Dec 28, 2016, 1:12 AM

              It is possible that the config file has been changed to override the settings. Go to the diag/edit file page and open /conf/config.xml then search for the loopback address, and see if it shows up.

              1 Reply Last reply Reply Quote 0
              • J
                johnpoz LAYER 8 Global Moderator
                last edited by Dec 28, 2016, 2:29 AM

                So you look at you see it listening on loopback?

                listen.png
                listen.png_thumb

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                1 Reply Last reply Reply Quote 0
                • M
                  mhertzfeld
                  last edited by Dec 28, 2016, 2:36 PM

                  @S_Erickson:

                  It is possible that the config file has been changed to override the settings. Go to the diag/edit file page and open /conf/config.xml then search for the loopback address, and see if it shows up.

                  I searched the config.xml for "loopback" and was not able to find any occurrence.

                  Tried just "loop" as well and found no occurrence.

                  Tried searching for 127.0.0.1 and it came back with two occurrences.  One under FreeRadius on element "vareapconfocspurl" with a value of "http://127.0.0.1/ocsp/".  Then another under using squid guard on element "redirect" with a value of "http://127.0.0.1".

                  I am not using SquidGuard.  I was probably trying it out a long while back.

                  1 Reply Last reply Reply Quote 0
                  • M
                    mhertzfeld
                    last edited by Dec 28, 2016, 2:36 PM

                    @johnpoz:

                    So you look at you see it listening on loopback?

                    Here is the screenshot of the command you asked me to run.

                    sockstat.PNG
                    sockstat.PNG_thumb

                    1 Reply Last reply Reply Quote 0
                    • H
                      hda
                      last edited by Dec 28, 2016, 3:06 PM

                      @mhertzfeld:

                      Here is the screenshot of the command…

                      Well, that should work. I have the same.
                      There is likely more to your basic pfSense setup that is undetermined.
                      You could revert to a simple config.xml, like from a fresh install ?
                      Clear-out-house ;)

                      1 Reply Last reply Reply Quote 0
                      • S
                        S_Erickson
                        last edited by Dec 28, 2016, 3:30 PM Dec 28, 2016, 3:26 PM

                        The loopback address regarding the Radius server is probably fine, as long as you are running free Radius as a server on the firewall it should be pointing to 127.0.0.1 as the location to go for authentication. 
                        The one to do with squidguard though may not be. if you half configured it then left it, then it is possible it could be blocking things.
                        When we did the setup here, we had a few problems setting up squidguard the way we wanted it. Would have deployed a few days earlier probably. It was causing some unusual behaviour, like randomly deciding to block certain websites such as google or microsoft. I have it up and running now over 5 interfaces at the moment and don't have a loopback address anywhere in my config. if you're not using it remove the package just to see if anything changes.

                        1 Reply Last reply Reply Quote 0
                        • M
                          mhertzfeld
                          last edited by Dec 28, 2016, 3:46 PM

                          @S_Erickson:

                          The loopback address regarding the Radius server is probably fine, as long as you are running free Radius as a server on the firewall it should be pointing to 127.0.0.1 as the location to go for authentication. 
                          The one to do with squidguard though may not be. if you half configured it then left it, then it is possible it could be blocking things.
                          When we did the setup here, we had a few problems setting up squidguard the way we wanted it. Would have deployed a few days earlier probably. It was causing some unusual behaviour, like randomly deciding to block certain websites such as google or microsoft. I have it up and running now over 5 interfaces at the moment and don't have a loopback address anywhere in my config. if you're not using it remove the package just to see if anything changes.

                          I do not have the SquidGuard package installed.  I may have installed it at one time in the past, probably when I was first setting up pfsense, but it has long since been uninstalled.  My uneducated guess is that the entries in the config file are artifacts from this uninstalled package but I am not sure.  I would be willing to delete the lines from the config file related to squidgaurd with some guidance if you think it will help.

                          The packages I have installed are as follows

                          FreeRadius
                          pfBlocker (both pfBlocker and DNSBL are disabled right now)
                          snort (running only on LAN2 which is my primary LAN)

                          1 Reply Last reply Reply Quote 0
                          • D
                            doktornotor Banned
                            last edited by Dec 28, 2016, 3:54 PM

                            Squidguard does not block DNS queries. Read the Snort logs, and make it NOT block traffic.

                            1 Reply Last reply Reply Quote 0
                            • M
                              mhertzfeld
                              last edited by Dec 28, 2016, 4:26 PM

                              @doktornotor:

                              Squidguard does not block DNS queries. Read the Snort logs, and make it NOT block traffic.

                              I do not see anything that stands out in the snort logs.

                              So snort doesn't muddy the waters.  I have now set snort not to block and saved.  Then for good measure I went back into the snort config screen and disabled snort.

                              I then went to run a DNS lookup for www.cbs.com, still no reply from 127.0.0.1

                              I have attached a screen shot from my firewall log right after I ran the DNS lookup  (my clock read 11:16 when I ran the DNS Lookup).  Not sure if that will help with troubleshooting this or not.

                              After that I also re-added the DNS Server Entry for 192.168.0.1 under System/General Setup.  When I run DNS Lookup I am getting a successful response from 192.168.0.1 but no response from 127.0.0.1

                              ![Firewall log.PNG](/public/imported_attachments/1/Firewall log.PNG)
                              ![Firewall log.PNG_thumb](/public/imported_attachments/1/Firewall log.PNG_thumb)

                              1 Reply Last reply Reply Quote 0
                              • M
                                mhertzfeld
                                last edited by Dec 28, 2016, 8:28 PM

                                I tried pinging 127.0.0.1 and came back 100% packet loss.  Cannot believe I hadn't already tried that.

                                So not a DNS configuration issue.  Seems like there's something wrong with my systems configuration.

                                1 Reply Last reply Reply Quote 0
                                • D
                                  doktornotor Banned
                                  last edited by Dec 28, 2016, 8:39 PM

                                  Dude, if you have ping blocked to localhost, I'd suggest to flush your config down the drain and start from scratch.

                                  1 Reply Last reply Reply Quote 0
                                  • J
                                    johnpoz LAYER 8 Global Moderator
                                    last edited by Dec 28, 2016, 9:36 PM

                                    If you can not ping loopback, you got something really borked for sure.  I would go with dok suggestion.. Nuke it from orbit!!

                                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                                    If you get confused: Listen to the Music Play
                                    Please don't Chat/PM me for help, unless mod related
                                    SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                                    1 Reply Last reply Reply Quote 0
                                    • M
                                      mhertzfeld
                                      last edited by Dec 28, 2016, 11:12 PM

                                      A reboot fixed both the pinging issue and the dns resolver issue.

                                      Not sure why.  I rebooted last night before I started the thread and it was not working after that reboot.

                                      By the time I rebooted I had disabled nearly all my packages and any questionable firewall rules testing after each one with no luck.  Rebooted with my fingers crossed and I was able to ping the loopback.

                                      I slowly re-enabled the fire wall rules testing between each one and rebooted after they were all re-enabled and things are still working as expected.

                                      I re-enabled the packages I was using one by one with a reboot and test between each one and things are still working as expected.

                                      Not really sure what the problem was?  Maybe just a config stuck in limbo?  I really am not sure.  The only other configuration I recall tinkering with while trying to debug this was rearranging some of the outbound NAT mappings.

                                      I wish I had an explanation for myself for what was messing this up.  I spent a few hours on troubleshooting and am regretful that a simple two minute reboot was the solution.  I guess my take away from this is to perform multiple reboots while troubleshooting.

                                      I am hoping the case is closed on this.  I will keep testing tonight and tomorrow to make sure I am still able to ping and resolve.

                                      1 Reply Last reply Reply Quote 0
                                      18 out of 18
                                      • First post
                                        18/18
                                        Last post
                                      Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                        This community forum collects and processes your personal information.
                                        consent.not_received