Windows 10 nslookup not working on 2.4 beta
-
I really fail to understand what your not understanding here
";; connection timed out; no servers could be reached"
Seems pretty clear.. either unbound is not listing on your ipv6 address or your not able to talk to it on the address your client is using for ipv6 dns.. What address is that? And does dig even support that command in the version running on windows?
So why don't you do some basic troubleshooting - what IPv6 address is your client pointing to for dns? Can you ping this address. Do you see its mac in your ndp table? Is unbound set to listen on this interface? The link local address of that interface? Sniff to see if your query is even going out from your client via ipv6..
Quick test from linux shows that working fine..
But windows running latest version of dig seems to balk at that command, but if use @ipv6address working fine.. So seems more a bug in dig on windows with -6 than any issue with ipv6 dns queries.nslookup is using ipv6 on windows to unbound on pfsense just fine.
edit: you might notice my query from windows to a different ipv6 prefix than from my linux query - this is because they are on 2 different /64s on my network.
-
I really fail to understand what your not understanding here
";; connection timed out; no servers could be reached"
Seems pretty clear.. either unbound is not listing on your ipv6 address or your not able to talk to it on the address your client is using for ipv6 dns.. What address is that? And does dig even support that command in the version running on windows?
So why don't you do some basic troubleshooting - what IPv6 address is your client pointing to for dns? Can you ping this address. Do you see its mac in your ndp table? Is unbound set to listen on this interface? The link local address of that interface? Sniff to see if your query is even going out from your client via ipv6..
Quick test from linux shows that working fine..
But windows running latest version of dig seems to balk at that command, but if use @ipv6address working fine.. So seems more a bug in dig on windows with -6 than any issue with ipv6 dns queries.nslookup is using ipv6 on windows to unbound on pfsense just fine.
edit: you might notice my query from windows to a different ipv6 prefix than from my linux query - this is because they are on 2 different /64s on my network.
I was away for a week and I forgot about this. While I was away, the system was completely idle. nslookup was not working before I left and aside from updating the pfsense snapshot when I got back, I made no changes to either pfsense or the client. Now nslookup is working again - at least for the moment.
C:\Users\User>nslookup google.com
Server: UnKnown
Address: 2001
b:c::215:5dff:fe5c:e21e*** UnKnown can't find google.com: Query refused
[the system was completely idle for over a week between the first command and the second command]
C:\Users\User>nslookup google.com
Server: pfSense.localdomain
Address: 2001b:c::215:5dff:fe5c:e21eNon-authoritative answer:
Name: google.com
Addresses: 2607:f8b0:400a:800::200e
216.58.193.78I really fail to understand what your not understanding here
You can see your getting REFUSED - not that it didn't answer you or timed out, or couldn't find what you were looking for (nxdomain) it REFUSED your query..
What's with your snide tone of voice? Do you think I'm asking about this to be annoying or because I get off on you implying I'm stupid?!? Obviously the query was being refused, but the reason it was being refused is not obvious and it seems to have gone away.
Dig is also much better tool for debugging dns. You can install dig on windows without any issues.. It is a must have for me on any windows box ;)
I used dig because you recommended it. If it doesn't support ipv6 on windows, I'm not sure why you think dig is a "much better tool for debugging dns, that you can install it "without any issues" and why it's a "must have". Maybe it's good on *nix, but IMO if it doesn't support ipv6, it's utility on windows is debatable.
As I said before I went away, I followed your recommendation to set up an ACL. I further told you that after setting up an ACLs in the manner you described, it made no difference.
I also reinstalled pfsense 2.4 beta from scratch, using as few non-default settings as possible, which also made no difference.
I've never used ACLs before and had no previous dns problems.
I don't use ACLs on my 2.3.4 system and also have no dns problems (at least none that I'm currently aware of).
Before I went away, while this problem was occurring, I switched the windows 10 guest from the 2.3.4 system to the 2.4 beta system. It worked properly on the former, but not on the latter.
According to ipconfig /all, here are the dns addresses:
DNS Servers . . . . . . . . . . . : 2001
b:c:215:5dff:fe5c:e21e
192.168.1.1Both are pingable from the windows client.
Here are the default gateway addresses:
Default Gateway . . . . . . . . . : fe80::1:1%5
192.168.1.1Also can ping the default gateway from the client.
Also can ping the client on all four of its ipv6 addresses using pfsense diagnostics ping.
So for some reason, on windows 10, ipv6 queries were being refused. Now they are are working. If it walks like a pfsense problem and quacks like a pfsense problem, it's probably a pfsense problem - one that seems to have gone away.
-
"If it doesn't support ipv6 on windows"
It does support ipv6 on windows - nobody ever said it didn't - there is just a bug currently with it pulling the IPv6 address from windows with the -6 option. As you saw I could query pfsense via ipv6 with it no problem just using @ipv6 address is all.
Your issue would of been easy to figure out of you could of just done some basic troubleshooting.. if it quacks like its stupid, and walks like its stupid and walks like its stupid - its most likely stupid ;) Sorry just couldn't help myself after you started the quack nonsense after doing zero actual troubleshooting to the problem as presented!!!
-
"If it doesn't support ipv6 on windows"
It does support ipv6 on windows - nobody ever said it didn't - there is just a bug currently with it pulling the IPv6 address from windows with the -6 option. As you saw I could query pfsense via ipv6 with it no problem just using @ipv6 address is all.
Your issue would of been easy to figure out of you could of just done some basic troubleshooting.. if it quacks like its stupid, and walks like its stupid and walks like its stupid - its most likely stupid ;) Sorry just couldn't help myself after you started the quack nonsense after doing zero actual troubleshooting to the problem as presented!!!
I misread your post about getting dig to work on windows, so I stand corrected about that. However, with regards to your "zero actual troubleshooting" remark, I'm still without words that wouldn't get me banned…
