DNS stopped working



  • Last night everything was fine, but this AM things have gone awry.

    I made no changes between it working and not working.  Something happened over night, and I can't figure it out.

    I can do a DNS lookup from Pfsense, but cannot do DNS lookup from any of the computers on the LAN.  If I manually set the DNS server on each computer everything works fine.  But if I have it get it from DHCP, nothing works.

    I tried rebooting, tried changing DNS servers to use the ones from DHCP (Spectrum aka TimeWarner), instead of google, but nothing works.

    Any ideas on what I can look at to figure out what changed?

    thanks,
    david



  • I've been thinking about this, as something had to change, even if I didn't do it last night.

    Unfortunately, I didn't look at the uptime of the router when I rebooted it today.  I hadn't rebooted it for many months.  I wonder if it rebooted last night.

    The only changes I've made in the last year or so was to add pfBlockerNG.  That didn't require a reboot.  So I disabled it, but that didn't help.

    Hoping someone has an idea of what to look for.

    thanks
    david



  • What do the clients have for IP4 settings?  Did they get served the correct info from DHCP server?



  • Yes, they get their proper IP, and the DNS is the PFsense lan address 192.168.1.1

    EDIT: I have DNS forwarder off, and DNS Resolver on.  I enable the DNS Forward option in the resolver, if I read it correctly that should send the DNS servers from the setup->general settings.  In my case 8.8.8.8, but I still get 192.168.1.1 after I renew my client configs.

    did i read that correctly?  Should I see 8.8.8.8 instead?

    thanks
    david



  • Your clients should be getting pfSense LAN IP for their DNS, and pfSense handles the lookups via the Resolver.  I don't use pfSense DHCP server so I don't know how those all inter-relate.  WHat is the actual error you're seeing?  Do the requests just time out or is there a message?  What's the output of nslookup www.google.com on one of your clients?



  • They time out.



  • What's the output of nslookup www.google.com on one of your clients?



  • C:\Users\David>nslookup www.google.com
    DNS request timed out.
        timeout was 2 seconds.
    Server:  UnKnown
    Address:  192.168.1.1

    DNS request timed out.
        timeout was 2 seconds.
    DNS request timed out.
        timeout was 2 seconds.
    DNS request timed out.
        timeout was 2 seconds.
    DNS request timed out.
        timeout was 2 seconds.
    *** Request to UnKnown timed-out

    C:\Users\David>



  • Having the exact same issue.  Made no changes and it stopped working last night 1/18/17.  computers are all set to DHCP, Pfsense is in a VM (FYI).

    Screenshots of the various DNS locations in Pfsense
    https://drive.google.com/file/d/0B15p4ppbxdipMFczSHlvVm1SRVU/view?usp=sharing
    https://drive.google.com/file/d/0B15p4ppbxdipUUNnTk02bk1HbE0/view?usp=sharing
    https://drive.google.com/file/d/0B15p4ppbxdipLWRMT1plOXNCd1k/view?usp=sharing

    if there's another screenshot I can share to understand why, please let me know.
    no ping, no traceroute, no nslookup will work.

    I'm at a loss.  Did a factory reset, assigned the interfaces and IP's. Can ping around locally, nothing externally.



  • Anything of note in Status - System Logs - System - General or Status - System Logs - System - DNS Resolver?



  • As for the logs for DNS Resolver, I see a bunch of
    notice:init module 1: iterator
    same : validator

    repeats a few times in the past 10 minutes.



  • I see nothing of note in general, just that the system rebooted

    Under Resolver it is empty, no messaging at all.

    david


  • LAYER 8 Global Moderator

    validate that your dns of choice be it the resolver or the forwarder is listening, ie running.. What is the logs for which your using?

    Do a simple sockstat

    
    [2.3.2-RELEASE][root@pfsense.local.lan]/root: sockstat -4l | grep :53
    unbound  unbound    98827 4  udp4   192.168.9.253:53      *:*
    unbound  unbound    98827 5  tcp4   192.168.9.253:53      *:*
    unbound  unbound    98827 8  udp4   192.168.2.253:53      *:*
    unbound  unbound    98827 9  tcp4   192.168.2.253:53      *:*
    unbound  unbound    98827 15 udp4   192.168.3.253:53      *:*
    unbound  unbound    98827 16 tcp4   192.168.3.253:53      *:*
    unbound  unbound    98827 19 udp4   192.168.4.253:53      *:*
    unbound  unbound    98827 20 tcp4   192.168.4.253:53      *:*
    unbound  unbound    98827 21 udp4   192.168.6.253:53      *:*
    unbound  unbound    98827 22 tcp4   192.168.6.253:53      *:*
    unbound  unbound    98827 25 udp4   192.168.7.253:53      *:*
    unbound  unbound    98827 26 tcp4   192.168.7.253:53      *:*
    unbound  unbound    98827 27 udp4   127.0.0.1:53          *:*
    unbound  unbound    98827 28 tcp4   127.0.0.1:53          *:*
    [2.3.2-RELEASE][root@pfsense.local.lan]/root:
    
    

    I limited mine to my ipv4 in this check, its also listening on the ipv6 address.

    Check your rules on the interface, that your allowing access to that pfsense interface that dns is listening on from that network.  Validate that you can ping that IP, validate if you can not ping or do not have it open on your rules that your client shows a mac for that IP in its arp table.

    Be it pfsense can forward or resolver has little to do with if it will answer your dns query, it should respond back with nx or refused, or servfail if it can not lookup what your asking for, etc.  But it shouldn't timeout, and it should be able to resolve the PTR for your IP of pfsense..

    If your going to use nslookup to test with then put in debug mode.

    
    C:\>nslookup
    Default Server:  pfsense.local.lan
    Address:  192.168.9.253
    
    > set debug
    > www.google.com
    Server:  pfsense.local.lan
    Address:  192.168.9.253
    
    ------------
    Got answer:
        HEADER:
            opcode = QUERY, id = 2, rcode = NOERROR
            header flags:  response, want recursion, recursion avail.
            questions = 1,  answers = 1,  authority records = 0,  additional = 0
    
        QUESTIONS:
            www.google.com, type = A, class = IN
        ANSWERS:
        ->  www.google.com
            internet address = 172.217.0.4
            ttl = 73 (1 min 13 secs)
    
    ------------
    Non-authoritative answer:
    ------------
    Got answer:
        HEADER:
            opcode = QUERY, id = 3, rcode = NOERROR
            header flags:  response, want recursion, recursion avail.
            questions = 1,  answers = 1,  authority records = 0,  additional = 0
    
        QUESTIONS:
            www.google.com, type = AAAA, class = IN
        ANSWERS:
        ->  www.google.com
            AAAA IPv6 address = 2607:f8b0:4009:813::2004
            ttl = 300 (5 mins)
    
    ------------
    Name:    www.google.com
    Addresses:  2607:f8b0:4009:813::2004
              172.217.0.4
    
    >
    
    

    So you can tell what was asked and what the nameserver responded back with, etc..



  • I get nothing:
    [2.2.4-RELEASE][root@pfsense.home]/root: sockstat | grep :53
    root    miniupnpd  86865 16 udp6  *:5351                :

    when setting nslookup into debug mode I get a more robust timing message.

    EDIT:
    When I go to DNS resolver, there is a red square that says unbound Service is Stopped.  Is that the same thing as DNS Resolver?

    david



  • Under status/services.  Is the unbound service running?



  • Similar to lovingHD's.

    [https://drive.google.com/file/d/0B15p4ppbxdipNWJaVzNxVWtleE0/view?usp=sharing/url]

    status/Service : everything's green but pfblocker which is disabled.](https://drive.google.com/file/d/0B15p4ppbxdipNWJaVzNxVWtleE0/view?usp=sharing/url]<br /><br />status/Service : everything's green but pfblocker which is disabled.)



  • OK that was it!

    I saw this in the logs:
    php: rc.bootup: The command '/usr/local/sbin/unbound -c /var/unbound/unbound.conf' returned exit code '1', the output was '/var/unbound/unbound.conf:88: error: cannot open include file '/var/unbound/pfb_dnsbl.conf': No such file or directory read /var/unbound/unbound.conf failed: 1 errors in configuration file [1484921851] unbound[37111:0] fatal error: Could not read config file: /var/unbound/unbound.conf'

    Sorry for not seeing it before.

    I saw I had something in the advanced box that matched the log:
    server:include: /var/unbound/pfg_dnsbl.conf

    I didn't see that file on the file system, so I removed it from the setup window and now it is working!

    I've no idea what that file is, why it was setup that way, or why things changed, but removing it lets the resolver run.

    I guess that file "used" to exist, but no longer does.

    EDIT: I did add the pfBlockerNG packages several months ago.  I don't remember making the change to the resolver, and looked back at the how to I used to set it up and it doesn't talk about making the change.  I wonder if they are related, due to the name of the file.  I've disable the package as well.

    thanks for all the help,
    david


Log in to reply