Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    DNS stopped working

    Scheduled Pinned Locked Moved DHCP and DNS
    17 Posts 5 Posters 5.4k Views 1 Watching
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • L Offline
      lovingHDTV
      last edited by

      Last night everything was fine, but this AM things have gone awry.

      I made no changes between it working and not working.  Something happened over night, and I can't figure it out.

      I can do a DNS lookup from Pfsense, but cannot do DNS lookup from any of the computers on the LAN.  If I manually set the DNS server on each computer everything works fine.  But if I have it get it from DHCP, nothing works.

      I tried rebooting, tried changing DNS servers to use the ones from DHCP (Spectrum aka TimeWarner), instead of google, but nothing works.

      Any ideas on what I can look at to figure out what changed?

      thanks,
      david

      1 Reply Last reply Reply Quote 0
      • L Offline
        lovingHDTV
        last edited by

        I've been thinking about this, as something had to change, even if I didn't do it last night.

        Unfortunately, I didn't look at the uptime of the router when I rebooted it today.  I hadn't rebooted it for many months.  I wonder if it rebooted last night.

        The only changes I've made in the last year or so was to add pfBlockerNG.  That didn't require a reboot.  So I disabled it, but that didn't help.

        Hoping someone has an idea of what to look for.

        thanks
        david

        1 Reply Last reply Reply Quote 0
        • KOMK Offline
          KOM
          last edited by

          What do the clients have for IP4 settings?  Did they get served the correct info from DHCP server?

          1 Reply Last reply Reply Quote 0
          • L Offline
            lovingHDTV
            last edited by

            Yes, they get their proper IP, and the DNS is the PFsense lan address 192.168.1.1

            EDIT: I have DNS forwarder off, and DNS Resolver on.  I enable the DNS Forward option in the resolver, if I read it correctly that should send the DNS servers from the setup->general settings.  In my case 8.8.8.8, but I still get 192.168.1.1 after I renew my client configs.

            did i read that correctly?  Should I see 8.8.8.8 instead?

            thanks
            david

            1 Reply Last reply Reply Quote 0
            • KOMK Offline
              KOM
              last edited by

              Your clients should be getting pfSense LAN IP for their DNS, and pfSense handles the lookups via the Resolver.  I don't use pfSense DHCP server so I don't know how those all inter-relate.  WHat is the actual error you're seeing?  Do the requests just time out or is there a message?  What's the output of nslookup www.google.com on one of your clients?

              1 Reply Last reply Reply Quote 0
              • L Offline
                lovingHDTV
                last edited by

                They time out.

                1 Reply Last reply Reply Quote 0
                • KOMK Offline
                  KOM
                  last edited by

                  What's the output of nslookup www.google.com on one of your clients?

                  1 Reply Last reply Reply Quote 0
                  • L Offline
                    lovingHDTV
                    last edited by

                    C:\Users\David>nslookup www.google.com
                    DNS request timed out.
                        timeout was 2 seconds.
                    Server:  UnKnown
                    Address:  192.168.1.1

                    DNS request timed out.
                        timeout was 2 seconds.
                    DNS request timed out.
                        timeout was 2 seconds.
                    DNS request timed out.
                        timeout was 2 seconds.
                    DNS request timed out.
                        timeout was 2 seconds.
                    *** Request to UnKnown timed-out

                    C:\Users\David>

                    1 Reply Last reply Reply Quote 0
                    • M Offline
                      mkyb14
                      last edited by

                      Having the exact same issue.  Made no changes and it stopped working last night 1/18/17.  computers are all set to DHCP, Pfsense is in a VM (FYI).

                      Screenshots of the various DNS locations in Pfsense
                      https://drive.google.com/file/d/0B15p4ppbxdipMFczSHlvVm1SRVU/view?usp=sharing
                      https://drive.google.com/file/d/0B15p4ppbxdipUUNnTk02bk1HbE0/view?usp=sharing
                      https://drive.google.com/file/d/0B15p4ppbxdipLWRMT1plOXNCd1k/view?usp=sharing

                      if there's another screenshot I can share to understand why, please let me know.
                      no ping, no traceroute, no nslookup will work.

                      I'm at a loss.  Did a factory reset, assigned the interfaces and IP's. Can ping around locally, nothing externally.

                      1 Reply Last reply Reply Quote 0
                      • KOMK Offline
                        KOM
                        last edited by

                        Anything of note in Status - System Logs - System - General or Status - System Logs - System - DNS Resolver?

                        1 Reply Last reply Reply Quote 0
                        • M Offline
                          mkyb14
                          last edited by

                          As for the logs for DNS Resolver, I see a bunch of
                          notice:init module 1: iterator
                          same : validator

                          repeats a few times in the past 10 minutes.

                          1 Reply Last reply Reply Quote 0
                          • L Offline
                            lovingHDTV
                            last edited by

                            I see nothing of note in general, just that the system rebooted

                            Under Resolver it is empty, no messaging at all.

                            david

                            1 Reply Last reply Reply Quote 0
                            • johnpozJ Offline
                              johnpoz LAYER 8 Global Moderator
                              last edited by

                              validate that your dns of choice be it the resolver or the forwarder is listening, ie running.. What is the logs for which your using?

                              Do a simple sockstat

                              
[2.3.2-RELEASE][root@pfsense.local.lan]/root: sockstat -4l | grep :53
unbound  unbound    98827 4  udp4   192.168.9.253:53      *:*
unbound  unbound    98827 5  tcp4   192.168.9.253:53      *:*
unbound  unbound    98827 8  udp4   192.168.2.253:53      *:*
unbound  unbound    98827 9  tcp4   192.168.2.253:53      *:*
unbound  unbound    98827 15 udp4   192.168.3.253:53      *:*
unbound  unbound    98827 16 tcp4   192.168.3.253:53      *:*
unbound  unbound    98827 19 udp4   192.168.4.253:53      *:*
unbound  unbound    98827 20 tcp4   192.168.4.253:53      *:*
unbound  unbound    98827 21 udp4   192.168.6.253:53      *:*
unbound  unbound    98827 22 tcp4   192.168.6.253:53      *:*
unbound  unbound    98827 25 udp4   192.168.7.253:53      *:*
unbound  unbound    98827 26 tcp4   192.168.7.253:53      *:*
unbound  unbound    98827 27 udp4   127.0.0.1:53          *:*
unbound  unbound    98827 28 tcp4   127.0.0.1:53          *:*
[2.3.2-RELEASE][root@pfsense.local.lan]/root:

                              I limited mine to my ipv4 in this check, its also listening on the ipv6 address.

                              Check your rules on the interface, that your allowing access to that pfsense interface that dns is listening on from that network.  Validate that you can ping that IP, validate if you can not ping or do not have it open on your rules that your client shows a mac for that IP in its arp table.

                              Be it pfsense can forward or resolver has little to do with if it will answer your dns query, it should respond back with nx or refused, or servfail if it can not lookup what your asking for, etc.  But it shouldn't timeout, and it should be able to resolve the PTR for your IP of pfsense..

                              If your going to use nslookup to test with then put in debug mode.

                              
C:\>nslookup
Default Server:  pfsense.local.lan
Address:  192.168.9.253

> set debug
> www.google.com
Server:  pfsense.local.lan
Address:  192.168.9.253

------------
Got answer:
    HEADER:
        opcode = QUERY, id = 2, rcode = NOERROR
        header flags:  response, want recursion, recursion avail.
        questions = 1,  answers = 1,  authority records = 0,  additional = 0

    QUESTIONS:
        www.google.com, type = A, class = IN
    ANSWERS:
    ->  www.google.com
        internet address = 172.217.0.4
        ttl = 73 (1 min 13 secs)

------------
Non-authoritative answer:
------------
Got answer:
    HEADER:
        opcode = QUERY, id = 3, rcode = NOERROR
        header flags:  response, want recursion, recursion avail.
        questions = 1,  answers = 1,  authority records = 0,  additional = 0

    QUESTIONS:
        www.google.com, type = AAAA, class = IN
    ANSWERS:
    ->  www.google.com
        AAAA IPv6 address = 2607:f8b0:4009:813::2004
        ttl = 300 (5 mins)

------------
Name:    www.google.com
Addresses:  2607:f8b0:4009:813::2004
          172.217.0.4

>

                              So you can tell what was asked and what the nameserver responded back with, etc..

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 25.07.1 | Lab VMs 2.8.1, 25.07.1

                              1 Reply Last reply Reply Quote 0
                              • L Offline
                                lovingHDTV
                                last edited by

                                I get nothing:
                                [2.2.4-RELEASE][root@pfsense.home]/root: sockstat | grep :53
                                root    miniupnpd  86865 16 udp6  *:5351                :

                                when setting nslookup into debug mode I get a more robust timing message.

                                EDIT:
                                When I go to DNS resolver, there is a red square that says unbound Service is Stopped.  Is that the same thing as DNS Resolver?

                                david

                                1 Reply Last reply Reply Quote 0
                                • chpalmerC Offline
                                  chpalmer
                                  last edited by

                                  Under status/services.  Is the unbound service running?

                                  Triggering snowflakes one by one..
                                  Intel(R) Core(TM) i5-4590T CPU @ 2.00GHz on an M400 WG box.

                                  1 Reply Last reply Reply Quote 0
                                  • M Offline
                                    mkyb14
                                    last edited by

                                    Similar to lovingHD's.

                                    [https://drive.google.com/file/d/0B15p4ppbxdipNWJaVzNxVWtleE0/view?usp=sharing/url]

                                    status/Service : everything's green but pfblocker which is disabled.](https://drive.google.com/file/d/0B15p4ppbxdipNWJaVzNxVWtleE0/view?usp=sharing/url]<br /><br />status/Service : everything's green but pfblocker which is disabled.)

                                    1 Reply Last reply Reply Quote 0
                                    • L Offline
                                      lovingHDTV
                                      last edited by

                                      OK that was it!

                                      I saw this in the logs:
                                      php: rc.bootup: The command '/usr/local/sbin/unbound -c /var/unbound/unbound.conf' returned exit code '1', the output was '/var/unbound/unbound.conf:88: error: cannot open include file '/var/unbound/pfb_dnsbl.conf': No such file or directory read /var/unbound/unbound.conf failed: 1 errors in configuration file [1484921851] unbound[37111:0] fatal error: Could not read config file: /var/unbound/unbound.conf'

                                      Sorry for not seeing it before.

                                      I saw I had something in the advanced box that matched the log:
                                      server:include: /var/unbound/pfg_dnsbl.conf

                                      I didn't see that file on the file system, so I removed it from the setup window and now it is working!

                                      I've no idea what that file is, why it was setup that way, or why things changed, but removing it lets the resolver run.

                                      I guess that file "used" to exist, but no longer does.

                                      EDIT: I did add the pfBlockerNG packages several months ago.  I don't remember making the change to the resolver, and looked back at the how to I used to set it up and it doesn't talk about making the change.  I wonder if they are related, due to the name of the file.  I've disable the package as well.

                                      thanks for all the help,
                                      david

                                      1 Reply Last reply Reply Quote 0
                                      • First post
                                        Last post
                                      Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.