DNS stopped working
-
Last night everything was fine, but this AM things have gone awry.
I made no changes between it working and not working. Something happened over night, and I can't figure it out.
I can do a DNS lookup from Pfsense, but cannot do DNS lookup from any of the computers on the LAN. If I manually set the DNS server on each computer everything works fine. But if I have it get it from DHCP, nothing works.
I tried rebooting, tried changing DNS servers to use the ones from DHCP (Spectrum aka TimeWarner), instead of google, but nothing works.
Any ideas on what I can look at to figure out what changed?
thanks,
david -
I've been thinking about this, as something had to change, even if I didn't do it last night.
Unfortunately, I didn't look at the uptime of the router when I rebooted it today. I hadn't rebooted it for many months. I wonder if it rebooted last night.
The only changes I've made in the last year or so was to add pfBlockerNG. That didn't require a reboot. So I disabled it, but that didn't help.
Hoping someone has an idea of what to look for.
thanks
david -
What do the clients have for IP4 settings? Did they get served the correct info from DHCP server?
-
Yes, they get their proper IP, and the DNS is the PFsense lan address 192.168.1.1
EDIT: I have DNS forwarder off, and DNS Resolver on. I enable the DNS Forward option in the resolver, if I read it correctly that should send the DNS servers from the setup->general settings. In my case 8.8.8.8, but I still get 192.168.1.1 after I renew my client configs.
did i read that correctly? Should I see 8.8.8.8 instead?
thanks
david -
Your clients should be getting pfSense LAN IP for their DNS, and pfSense handles the lookups via the Resolver. I don't use pfSense DHCP server so I don't know how those all inter-relate. WHat is the actual error you're seeing? Do the requests just time out or is there a message? What's the output of nslookup www.google.com on one of your clients?
-
They time out.
-
What's the output of nslookup www.google.com on one of your clients?
-
C:\Users\David>nslookup www.google.com
DNS request timed out.
timeout was 2 seconds.
Server: UnKnown
Address: 192.168.1.1DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.
*** Request to UnKnown timed-outC:\Users\David>
-
Having the exact same issue. Made no changes and it stopped working last night 1/18/17. computers are all set to DHCP, Pfsense is in a VM (FYI).
Screenshots of the various DNS locations in Pfsense
https://drive.google.com/file/d/0B15p4ppbxdipMFczSHlvVm1SRVU/view?usp=sharing
https://drive.google.com/file/d/0B15p4ppbxdipUUNnTk02bk1HbE0/view?usp=sharing
https://drive.google.com/file/d/0B15p4ppbxdipLWRMT1plOXNCd1k/view?usp=sharingif there's another screenshot I can share to understand why, please let me know.
no ping, no traceroute, no nslookup will work.I'm at a loss. Did a factory reset, assigned the interfaces and IP's. Can ping around locally, nothing externally.
-
Anything of note in Status - System Logs - System - General or Status - System Logs - System - DNS Resolver?
-
As for the logs for DNS Resolver, I see a bunch of
notice:init module 1: iterator
same : validatorrepeats a few times in the past 10 minutes.
-
I see nothing of note in general, just that the system rebooted
Under Resolver it is empty, no messaging at all.
david
-
validate that your dns of choice be it the resolver or the forwarder is listening, ie running.. What is the logs for which your using?
Do a simple sockstat
[2.3.2-RELEASE][root@pfsense.local.lan]/root: sockstat -4l | grep :53 unbound unbound 98827 4 udp4 192.168.9.253:53 *:* unbound unbound 98827 5 tcp4 192.168.9.253:53 *:* unbound unbound 98827 8 udp4 192.168.2.253:53 *:* unbound unbound 98827 9 tcp4 192.168.2.253:53 *:* unbound unbound 98827 15 udp4 192.168.3.253:53 *:* unbound unbound 98827 16 tcp4 192.168.3.253:53 *:* unbound unbound 98827 19 udp4 192.168.4.253:53 *:* unbound unbound 98827 20 tcp4 192.168.4.253:53 *:* unbound unbound 98827 21 udp4 192.168.6.253:53 *:* unbound unbound 98827 22 tcp4 192.168.6.253:53 *:* unbound unbound 98827 25 udp4 192.168.7.253:53 *:* unbound unbound 98827 26 tcp4 192.168.7.253:53 *:* unbound unbound 98827 27 udp4 127.0.0.1:53 *:* unbound unbound 98827 28 tcp4 127.0.0.1:53 *:* [2.3.2-RELEASE][root@pfsense.local.lan]/root:
I limited mine to my ipv4 in this check, its also listening on the ipv6 address.
Check your rules on the interface, that your allowing access to that pfsense interface that dns is listening on from that network. Validate that you can ping that IP, validate if you can not ping or do not have it open on your rules that your client shows a mac for that IP in its arp table.
Be it pfsense can forward or resolver has little to do with if it will answer your dns query, it should respond back with nx or refused, or servfail if it can not lookup what your asking for, etc. But it shouldn't timeout, and it should be able to resolve the PTR for your IP of pfsense..
If your going to use nslookup to test with then put in debug mode.
C:\>nslookup Default Server: pfsense.local.lan Address: 192.168.9.253 > set debug > www.google.com Server: pfsense.local.lan Address: 192.168.9.253 ------------ Got answer: HEADER: opcode = QUERY, id = 2, rcode = NOERROR header flags: response, want recursion, recursion avail. questions = 1, answers = 1, authority records = 0, additional = 0 QUESTIONS: www.google.com, type = A, class = IN ANSWERS: -> www.google.com internet address = 172.217.0.4 ttl = 73 (1 min 13 secs) ------------ Non-authoritative answer: ------------ Got answer: HEADER: opcode = QUERY, id = 3, rcode = NOERROR header flags: response, want recursion, recursion avail. questions = 1, answers = 1, authority records = 0, additional = 0 QUESTIONS: www.google.com, type = AAAA, class = IN ANSWERS: -> www.google.com AAAA IPv6 address = 2607:f8b0:4009:813::2004 ttl = 300 (5 mins) ------------ Name: www.google.com Addresses: 2607:f8b0:4009:813::2004 172.217.0.4 >
So you can tell what was asked and what the nameserver responded back with, etc..
-
I get nothing:
[2.2.4-RELEASE][root@pfsense.home]/root: sockstat | grep :53
root miniupnpd 86865 16 udp6 *:5351 :when setting nslookup into debug mode I get a more robust timing message.
EDIT:
When I go to DNS resolver, there is a red square that says unbound Service is Stopped. Is that the same thing as DNS Resolver?david
-
Under status/services. Is the unbound service running?
-
Similar to lovingHD's.
[https://drive.google.com/file/d/0B15p4ppbxdipNWJaVzNxVWtleE0/view?usp=sharing/url]
status/Service : everything's green but pfblocker which is disabled.](https://drive.google.com/file/d/0B15p4ppbxdipNWJaVzNxVWtleE0/view?usp=sharing/url]<br /><br />status/Service : everything's green but pfblocker which is disabled.)
-
OK that was it!
I saw this in the logs:
php: rc.bootup: The command '/usr/local/sbin/unbound -c /var/unbound/unbound.conf' returned exit code '1', the output was '/var/unbound/unbound.conf:88: error: cannot open include file '/var/unbound/pfb_dnsbl.conf': No such file or directory read /var/unbound/unbound.conf failed: 1 errors in configuration file [1484921851] unbound[37111:0] fatal error: Could not read config file: /var/unbound/unbound.conf'Sorry for not seeing it before.
I saw I had something in the advanced box that matched the log:
server:include: /var/unbound/pfg_dnsbl.confI didn't see that file on the file system, so I removed it from the setup window and now it is working!
I've no idea what that file is, why it was setup that way, or why things changed, but removing it lets the resolver run.
I guess that file "used" to exist, but no longer does.
EDIT: I did add the pfBlockerNG packages several months ago. I don't remember making the change to the resolver, and looked back at the how to I used to set it up and it doesn't talk about making the change. I wonder if they are related, due to the name of the file. I've disable the package as well.
thanks for all the help,
david