Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Help Setting Up DNS Resolver

    DHCP and DNS
    5
    18
    8557
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      mhertzfeld
      last edited by

      I need help setting up the DNS Resolver.

      Here are my settings so far.

      Under System/General Setup I have
      All DNS servers settings are currently empty
      DNS Server Override: UnChecked
      Disable DNS Forwarder: UnChecked

      I checked my resolv.conf file and it has nameserver 127.0.01 as the first line.  The second line has search and then the domain name.

      Under Services/DNS Resolver/General Settings I have
      Enable DNS Resolver: Checked
      Network Interfaces: LAN, LAN2 and Localhost selected
      Outgoing Network Interfaces: WAN
      System Domain Local Zone Type: Transparent (not sure about this, it was pre selected)
      Enable DNSSEC Support: Checked
      Enable Forwarding Mode: UnChecked

      Under Services/DNS Forwarder
      Enable DNSforwarder: UnChecked

      My clients "seem" to be resolving addresses ok.  I am able to ping random addresses like www.espn.com and am able to resolve the name and get the ipaddress.  The DNS server the clients are using (according to ipconfig) is the address of my pfsense router.

      However when I do a lookup using Diagnostics/DNS Lookup of www.espn.com I get a message saying "No Response" under Query Time.  The Name server is 127.0.0.1

      I am able to overcome this by adding my pfsense routers ip address (192.168.0.1) to the System/General Setup/DNS Servers list.  When added there is still No Response from 127.0.0.1 but there is a successful response from 192.168.0.1.

      So from what I can tell there is still something messed up with my configurations since from what I've read up to this point leads me to believe that I shouldn't have to add 192.168.0.1 to the list of DNS servers under System/General Setup.

      1 Reply Last reply Reply Quote 0
      • H
        hda
        last edited by

        @mhertzfeld:

        Network Interfaces: LAN, LAN2 and Localhost selected
        Outgoing Network Interfaces: WAN

        I think you need Localhost always.
        I use All and All interfaces (my IPv6), works OK for your [www.espn.com]
        Ofcourse I do not allow an open WAN port 53 !

        1 Reply Last reply Reply Quote 0
        • M
          mhertzfeld
          last edited by

          Thanks.  After reading your comment I changed to All, All.  I saved and applied the settings then waited a few minutes.

          When running dns lookup there is still no response from nameserver 127.0.0.1

          I am still getting a successful response from nameserver 192.168.0.1

          1 Reply Last reply Reply Quote 0
          • H
            hda
            last edited by

            I assume you are on 2.3.2., else clear out all GUI config of Forwarder and save.

            Anyway this: stop Resolver & stop Forwarder first, dead. (uncheck enable & save both)
            So be sure you do not have both Services active. (Exclusive service (No need for Forwarder if Resolver)).

            You do not need anything like 192… in setting General.
            Clear those setting for General out and save,
            All your other config input are fine as I read it with All & All.

            Then start Resolver again. (check enable & save)

            1 Reply Last reply Reply Quote 0
            • M
              mhertzfeld
              last edited by

              yes I am on 2.3.2-p1

              I disabled the Resolver, saved and applied.  Went to services to confirm it was gone.

              The forwarder was already disable and never was enabled, so I did not do anything with that.

              I cleared out all entries under General/DNS Servers.  (there was only the one that pointed to 192.168.0.1 with no gateway selected)

              I re-enabled the Resolver, saved and applied.

              Ran DNS Lookup again and received no response from 127.0.0.1

              1 Reply Last reply Reply Quote 0
              • S
                S_Erickson
                last edited by

                It is possible that the config file has been changed to override the settings. Go to the diag/edit file page and open /conf/config.xml then search for the loopback address, and see if it shows up.

                1 Reply Last reply Reply Quote 0
                • johnpozJ
                  johnpoz LAYER 8 Global Moderator
                  last edited by

                  So you look at you see it listening on loopback?


                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 23.05.1 | Lab VMs CE 2.6, 2.7

                  1 Reply Last reply Reply Quote 0
                  • M
                    mhertzfeld
                    last edited by

                    @S_Erickson:

                    It is possible that the config file has been changed to override the settings. Go to the diag/edit file page and open /conf/config.xml then search for the loopback address, and see if it shows up.

                    I searched the config.xml for "loopback" and was not able to find any occurrence.

                    Tried just "loop" as well and found no occurrence.

                    Tried searching for 127.0.0.1 and it came back with two occurrences.  One under FreeRadius on element "vareapconfocspurl" with a value of "http://127.0.0.1/ocsp/".  Then another under using squid guard on element "redirect" with a value of "http://127.0.0.1".

                    I am not using SquidGuard.  I was probably trying it out a long while back.

                    1 Reply Last reply Reply Quote 0
                    • M
                      mhertzfeld
                      last edited by

                      @johnpoz:

                      So you look at you see it listening on loopback?

                      Here is the screenshot of the command you asked me to run.


                      1 Reply Last reply Reply Quote 0
                      • H
                        hda
                        last edited by

                        @mhertzfeld:

                        Here is the screenshot of the command…

                        Well, that should work. I have the same.
                        There is likely more to your basic pfSense setup that is undetermined.
                        You could revert to a simple config.xml, like from a fresh install ?
                        Clear-out-house ;)

                        1 Reply Last reply Reply Quote 0
                        • S
                          S_Erickson
                          last edited by

                          The loopback address regarding the Radius server is probably fine, as long as you are running free Radius as a server on the firewall it should be pointing to 127.0.0.1 as the location to go for authentication. 
                          The one to do with squidguard though may not be. if you half configured it then left it, then it is possible it could be blocking things.
                          When we did the setup here, we had a few problems setting up squidguard the way we wanted it. Would have deployed a few days earlier probably. It was causing some unusual behaviour, like randomly deciding to block certain websites such as google or microsoft. I have it up and running now over 5 interfaces at the moment and don't have a loopback address anywhere in my config. if you're not using it remove the package just to see if anything changes.

                          1 Reply Last reply Reply Quote 0
                          • M
                            mhertzfeld
                            last edited by

                            @S_Erickson:

                            The loopback address regarding the Radius server is probably fine, as long as you are running free Radius as a server on the firewall it should be pointing to 127.0.0.1 as the location to go for authentication. 
                            The one to do with squidguard though may not be. if you half configured it then left it, then it is possible it could be blocking things.
                            When we did the setup here, we had a few problems setting up squidguard the way we wanted it. Would have deployed a few days earlier probably. It was causing some unusual behaviour, like randomly deciding to block certain websites such as google or microsoft. I have it up and running now over 5 interfaces at the moment and don't have a loopback address anywhere in my config. if you're not using it remove the package just to see if anything changes.

                            I do not have the SquidGuard package installed.  I may have installed it at one time in the past, probably when I was first setting up pfsense, but it has long since been uninstalled.  My uneducated guess is that the entries in the config file are artifacts from this uninstalled package but I am not sure.  I would be willing to delete the lines from the config file related to squidgaurd with some guidance if you think it will help.

                            The packages I have installed are as follows

                            FreeRadius
                            pfBlocker (both pfBlocker and DNSBL are disabled right now)
                            snort (running only on LAN2 which is my primary LAN)

                            1 Reply Last reply Reply Quote 0
                            • D
                              doktornotor Banned
                              last edited by

                              Squidguard does not block DNS queries. Read the Snort logs, and make it NOT block traffic.

                              1 Reply Last reply Reply Quote 0
                              • M
                                mhertzfeld
                                last edited by

                                @doktornotor:

                                Squidguard does not block DNS queries. Read the Snort logs, and make it NOT block traffic.

                                I do not see anything that stands out in the snort logs.

                                So snort doesn't muddy the waters.  I have now set snort not to block and saved.  Then for good measure I went back into the snort config screen and disabled snort.

                                I then went to run a DNS lookup for www.cbs.com, still no reply from 127.0.0.1

                                I have attached a screen shot from my firewall log right after I ran the DNS lookup  (my clock read 11:16 when I ran the DNS Lookup).  Not sure if that will help with troubleshooting this or not.

                                After that I also re-added the DNS Server Entry for 192.168.0.1 under System/General Setup.  When I run DNS Lookup I am getting a successful response from 192.168.0.1 but no response from 127.0.0.1

                                ![Firewall log.PNG](/public/imported_attachments/1/Firewall log.PNG)
                                ![Firewall log.PNG_thumb](/public/imported_attachments/1/Firewall log.PNG_thumb)

                                1 Reply Last reply Reply Quote 0
                                • M
                                  mhertzfeld
                                  last edited by

                                  I tried pinging 127.0.0.1 and came back 100% packet loss.  Cannot believe I hadn't already tried that.

                                  So not a DNS configuration issue.  Seems like there's something wrong with my systems configuration.

                                  1 Reply Last reply Reply Quote 0
                                  • D
                                    doktornotor Banned
                                    last edited by

                                    Dude, if you have ping blocked to localhost, I'd suggest to flush your config down the drain and start from scratch.

                                    1 Reply Last reply Reply Quote 0
                                    • johnpozJ
                                      johnpoz LAYER 8 Global Moderator
                                      last edited by

                                      If you can not ping loopback, you got something really borked for sure.  I would go with dok suggestion.. Nuke it from orbit!!

                                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                                      If you get confused: Listen to the Music Play
                                      Please don't Chat/PM me for help, unless mod related
                                      SG-4860 23.05.1 | Lab VMs CE 2.6, 2.7

                                      1 Reply Last reply Reply Quote 0
                                      • M
                                        mhertzfeld
                                        last edited by

                                        A reboot fixed both the pinging issue and the dns resolver issue.

                                        Not sure why.  I rebooted last night before I started the thread and it was not working after that reboot.

                                        By the time I rebooted I had disabled nearly all my packages and any questionable firewall rules testing after each one with no luck.  Rebooted with my fingers crossed and I was able to ping the loopback.

                                        I slowly re-enabled the fire wall rules testing between each one and rebooted after they were all re-enabled and things are still working as expected.

                                        I re-enabled the packages I was using one by one with a reboot and test between each one and things are still working as expected.

                                        Not really sure what the problem was?  Maybe just a config stuck in limbo?  I really am not sure.  The only other configuration I recall tinkering with while trying to debug this was rearranging some of the outbound NAT mappings.

                                        I wish I had an explanation for myself for what was messing this up.  I spent a few hours on troubleshooting and am regretful that a simple two minute reboot was the solution.  I guess my take away from this is to perform multiple reboots while troubleshooting.

                                        I am hoping the case is closed on this.  I will keep testing tonight and tomorrow to make sure I am still able to ping and resolve.

                                        1 Reply Last reply Reply Quote 0
                                        • First post
                                          Last post