Optimize Unbound Speeds?

killmasta93 · Jul 28, 2017, 1:38 AM

Hi,
I was wondering if someone can shed some light on the issue im having recently. Recently been noticing slow navigation speeds as i think it might be a dns issue. Right now I have Windows server which is hosting the DNS and DHCP but on the roots its pointing to pfSense which manages the DNS request. Right now I have unbound to Enable DNSSEC Support checked and unchecked Enable Forwarding Mode, would this be the correct setup? I have DNS servers pointing to google. I just want to make sure im not looping anything.

So in theory the DNS request would be like this

user consults navigation dns though server–--server has roots pointing to pfSense----DNS servers of pfSense points to google----then goes back to the server----then to the user

Or am i wrong?

Thank you

johnpoz · Jul 28, 2017, 10:33 AM

"-server has roots pointing to pfSense"

No that is not how you would do it!! You would just forward to pfsense, if all you want to do is forward to

"DNS servers of pfSense points to google"

Then why not just set your windows AD dns server to forward to google?

Also looks like your using pfblocker, and your not forwarding.. Your resolving - so pfsense is never checking google! You have forwarding mode unchecked, so you are resolving..

Pfsense asks roots hey who is NS for .com
Hey NS for .com who is NS for domain.com
Hey NS for domain.com what is A record of www.domain.com

That is resolving forwarding is
Hey Googledns what is A record of www.domain.com

If google doesn' have it cached, then it either forwards it somewhere or resolves it just like pfsense would do.. At some point in dns lookup there is a resolver!

killmasta93 · Jul 28, 2017, 12:42 PM

Thanks for the reply, i had i feeling i was doing something wrong. As before pfBlockerNG I had on the roots google DNS servers on the windows server. But because i wanted to implement pfBlockerNG DNSBL i had to point the roots from Windows server to pfSense.

Now the question is do i uncheck DNSSEC and check forwarding mode? As i read on the wiki pfSense its recommended not the check forwarding mode while having DNSSEC?

And on pfSense DNS servers should i use googles or openDNS servers? I tried using namebench but did not convince me much as it says i should use 8.8.4.4 as the primary DNS rather then 8.8.8.8.

Thank you

johnpoz · Jul 28, 2017, 12:47 PM

Again you would not mess with Roots on your windows server dns.. You would just forward to where you want to forward, or let it directly use roots. You wouldn't set roots to pfsense..

If you are forwarding from pfsense vs resolving then you have no idea to where your forwarding supports dnssec or not.. You would have to check to where you want to forward too.

As too use google or open - why would you not just resolve from pfsense, this is the only way to be 100% sure you will have dnssec support.. Is this something you want to use or not?

Do you understand the different between resolving and forwarding? Doesn't seem like it.

killmasta93 · Jul 28, 2017, 2:32 PM

Thanks for the reply, sorry for the ignorance :(
Hmm.. i guess your right im somewhat lost with the DNS resolver. What i understood from the DNS forwarder would send all requests to google for fast replies. I have been using recently Unbound (DNS resolver) because it was needed for pfBlockerNG DNSBL. I was also reading on few forums that DNS forwarding is a tab bit quicker then resolver which might be true. for the root part on the windows server i meant forwarders sorry. I guess the question how is pfSense resolving name servers by it self? if i only leave DNS server to 127.0.0.1

Thank you

See pictures

johnpoz · Aug 1, 2017, 9:43 AM

it walks its way down from roots..

Hey roots (.) who is the NS for .com
Hey NS for .com who is the NS for domain.com
Hey NS for domain.com what is the A record for www.domain.com

killmasta93 · Aug 2, 2017, 3:42 AM

Thanks for the reply OooOO but if it does not find nothing in the roots it starts asking who is NS to pfSense? so meaning that I should leave for pfSense DNS servers only 127.0.0.1?

johnpoz · Aug 2, 2017, 10:09 AM

if there is nothing in the roots then its not a valid tld, and so forth.. So there would be no point to go ask anything else..

If you query for your own local domain - it would never go query roots.. But you correct if you are using unbound as resolver then there is no need for anything other than 127.0.0.1

kpa · Aug 3, 2017, 5:53 PM

What you're probably not aware of is that the system uses the so called "stub resolver" *) for the DNS resolution of locally running services and applications and this stub resolver only forwards to the name servers specified in /etc/resolv.conf, it can't do resolution on its own. The DNS forwarder or the DNS resolver services are completely separate to this and can be used as one of the forwarders specified in /etc/resolv.conf, the 127.0.0.1 entry is just for that.

Whatever the DNS forwarder or DNS resolver services do to actually resolve the queries is a separate matter and querying of roots and so on or forwarding the queries to let's say Google's forwarders is done independently of the system's own stub resolver.

The LAN clients that use the pfSense's DNS services connect directly to the DNS forwarder or resolver, they don't connect to the stub resolver.

*) https://www.freebsd.org/cgi/man.cgi?query=resolver&apropos=0&sektion=0&manpath=FreeBSD+11.1-RELEASE+and+Ports&arch=default&format=html