Help Setting Up DNS Resolver

mhertzfeld · Dec 27, 2016, 10:30 PM

I need help setting up the DNS Resolver.

Here are my settings so far.

Under System/General Setup I have
All DNS servers settings are currently empty
DNS Server Override: UnChecked
Disable DNS Forwarder: UnChecked

I checked my resolv.conf file and it has nameserver 127.0.01 as the first line. The second line has search and then the domain name.

Under Services/DNS Resolver/General Settings I have
Enable DNS Resolver: Checked
Network Interfaces: LAN, LAN2 and Localhost selected
Outgoing Network Interfaces: WAN
System Domain Local Zone Type: Transparent (not sure about this, it was pre selected)
Enable DNSSEC Support: Checked
Enable Forwarding Mode: UnChecked

Under Services/DNS Forwarder
Enable DNSforwarder: UnChecked

My clients "seem" to be resolving addresses ok. I am able to ping random addresses like www.espn.com and am able to resolve the name and get the ipaddress. The DNS server the clients are using (according to ipconfig) is the address of my pfsense router.

However when I do a lookup using Diagnostics/DNS Lookup of www.espn.com I get a message saying "No Response" under Query Time. The Name server is 127.0.0.1

I am able to overcome this by adding my pfsense routers ip address (192.168.0.1) to the System/General Setup/DNS Servers list. When added there is still No Response from 127.0.0.1 but there is a successful response from 192.168.0.1.

So from what I can tell there is still something messed up with my configurations since from what I've read up to this point leads me to believe that I shouldn't have to add 192.168.0.1 to the list of DNS servers under System/General Setup.

hda · Dec 27, 2016, 10:53 PM

@mhertzfeld:

Network Interfaces: LAN, LAN2 and Localhost selected
Outgoing Network Interfaces: WAN

I think you need Localhost always.
I use All and All interfaces (my IPv6), works OK for your [www.espn.com]
Ofcourse I do not allow an open WAN port 53 !

mhertzfeld · Dec 27, 2016, 11:00 PM

Thanks. After reading your comment I changed to All, All. I saved and applied the settings then waited a few minutes.

When running dns lookup there is still no response from nameserver 127.0.0.1

I am still getting a successful response from nameserver 192.168.0.1

hda · Dec 27, 2016, 11:41 PM

I assume you are on 2.3.2., else clear out all GUI config of Forwarder and save.

Anyway this: stop Resolver & stop Forwarder first, dead. (uncheck enable & save both)
So be sure you do not have both Services active. (Exclusive service (No need for Forwarder if Resolver)).

You do not need anything like 192… in setting General.
Clear those setting for General out and save,
All your other config input are fine as I read it with All & All.

Then start Resolver again. (check enable & save)

mhertzfeld · Dec 28, 2016, 12:00 AM

yes I am on 2.3.2-p1

I disabled the Resolver, saved and applied. Went to services to confirm it was gone.

The forwarder was already disable and never was enabled, so I did not do anything with that.

I cleared out all entries under General/DNS Servers. (there was only the one that pointed to 192.168.0.1 with no gateway selected)

I re-enabled the Resolver, saved and applied.

Ran DNS Lookup again and received no response from 127.0.0.1

S_Erickson · Dec 28, 2016, 1:12 AM

It is possible that the config file has been changed to override the settings. Go to the diag/edit file page and open /conf/config.xml then search for the loopback address, and see if it shows up.

johnpoz · Dec 28, 2016, 2:29 AM

So you look at you see it listening on loopback?

mhertzfeld · Dec 28, 2016, 2:36 PM

@S_Erickson:

It is possible that the config file has been changed to override the settings. Go to the diag/edit file page and open /conf/config.xml then search for the loopback address, and see if it shows up.

I searched the config.xml for "loopback" and was not able to find any occurrence.

Tried just "loop" as well and found no occurrence.

Tried searching for 127.0.0.1 and it came back with two occurrences. One under FreeRadius on element "vareapconfocspurl" with a value of "http://127.0.0.1/ocsp/". Then another under using squid guard on element "redirect" with a value of "http://127.0.0.1".

I am not using SquidGuard. I was probably trying it out a long while back.

mhertzfeld · Dec 28, 2016, 2:36 PM

@johnpoz:

So you look at you see it listening on loopback?

Here is the screenshot of the command you asked me to run.

hda · Dec 28, 2016, 3:06 PM

@mhertzfeld:

Here is the screenshot of the command…

Well, that should work. I have the same.
There is likely more to your basic pfSense setup that is undetermined.
You could revert to a simple config.xml, like from a fresh install ?
Clear-out-house ;)

S_Erickson · Dec 28, 2016, 3:30 PM

The loopback address regarding the Radius server is probably fine, as long as you are running free Radius as a server on the firewall it should be pointing to 127.0.0.1 as the location to go for authentication.
The one to do with squidguard though may not be. if you half configured it then left it, then it is possible it could be blocking things.
When we did the setup here, we had a few problems setting up squidguard the way we wanted it. Would have deployed a few days earlier probably. It was causing some unusual behaviour, like randomly deciding to block certain websites such as google or microsoft. I have it up and running now over 5 interfaces at the moment and don't have a loopback address anywhere in my config. if you're not using it remove the package just to see if anything changes.

mhertzfeld · Dec 28, 2016, 3:46 PM

@S_Erickson:

The loopback address regarding the Radius server is probably fine, as long as you are running free Radius as a server on the firewall it should be pointing to 127.0.0.1 as the location to go for authentication.
The one to do with squidguard though may not be. if you half configured it then left it, then it is possible it could be blocking things.
When we did the setup here, we had a few problems setting up squidguard the way we wanted it. Would have deployed a few days earlier probably. It was causing some unusual behaviour, like randomly deciding to block certain websites such as google or microsoft. I have it up and running now over 5 interfaces at the moment and don't have a loopback address anywhere in my config. if you're not using it remove the package just to see if anything changes.

I do not have the SquidGuard package installed. I may have installed it at one time in the past, probably when I was first setting up pfsense, but it has long since been uninstalled. My uneducated guess is that the entries in the config file are artifacts from this uninstalled package but I am not sure. I would be willing to delete the lines from the config file related to squidgaurd with some guidance if you think it will help.

The packages I have installed are as follows

FreeRadius
pfBlocker (both pfBlocker and DNSBL are disabled right now)
snort (running only on LAN2 which is my primary LAN)

doktornotor · Dec 28, 2016, 3:54 PM

Squidguard does not block DNS queries. Read the Snort logs, and make it NOT block traffic.

mhertzfeld · Dec 28, 2016, 4:26 PM

@doktornotor:

Squidguard does not block DNS queries. Read the Snort logs, and make it NOT block traffic.

I do not see anything that stands out in the snort logs.

So snort doesn't muddy the waters. I have now set snort not to block and saved. Then for good measure I went back into the snort config screen and disabled snort.

I then went to run a DNS lookup for www.cbs.com, still no reply from 127.0.0.1

I have attached a screen shot from my firewall log right after I ran the DNS lookup (my clock read 11:16 when I ran the DNS Lookup). Not sure if that will help with troubleshooting this or not.

After that I also re-added the DNS Server Entry for 192.168.0.1 under System/General Setup. When I run DNS Lookup I am getting a successful response from 192.168.0.1 but no response from 127.0.0.1

![Firewall log.PNG](/public/imported_attachments/1/Firewall log.PNG)
![Firewall log.PNG_thumb](/public/imported_attachments/1/Firewall log.PNG_thumb)

mhertzfeld · Dec 28, 2016, 8:28 PM

I tried pinging 127.0.0.1 and came back 100% packet loss. Cannot believe I hadn't already tried that.

So not a DNS configuration issue. Seems like there's something wrong with my systems configuration.

doktornotor · Dec 28, 2016, 8:39 PM

Dude, if you have ping blocked to localhost, I'd suggest to flush your config down the drain and start from scratch.

johnpoz · Dec 28, 2016, 9:36 PM

If you can not ping loopback, you got something really borked for sure. I would go with dok suggestion.. Nuke it from orbit!!

mhertzfeld · Dec 28, 2016, 11:12 PM

A reboot fixed both the pinging issue and the dns resolver issue.

Not sure why. I rebooted last night before I started the thread and it was not working after that reboot.

By the time I rebooted I had disabled nearly all my packages and any questionable firewall rules testing after each one with no luck. Rebooted with my fingers crossed and I was able to ping the loopback.

I slowly re-enabled the fire wall rules testing between each one and rebooted after they were all re-enabled and things are still working as expected.

I re-enabled the packages I was using one by one with a reboot and test between each one and things are still working as expected.

Not really sure what the problem was? Maybe just a config stuck in limbo? I really am not sure. The only other configuration I recall tinkering with while trying to debug this was rearranging some of the outbound NAT mappings.

I wish I had an explanation for myself for what was messing this up. I spent a few hours on troubleshooting and am regretful that a simple two minute reboot was the solution. I guess my take away from this is to perform multiple reboots while troubleshooting.

I am hoping the case is closed on this. I will keep testing tonight and tomorrow to make sure I am still able to ping and resolve.