Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    DNS resolution fails

    Scheduled Pinned Locked Moved DHCP and DNS
    15 Posts 5 Posters 1.7k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      McFrisch
      last edited by

      Hi all,
      I am new to pfSense, so please tolerate my ignorance. Here is my original setup:  Cable Modem===WirelessRouter1 (DD-WRT)<–-Bridged--->WirelessRouter2 (Linksys Native)  This worked flawlessly, but I had no ability to monitor network traffic.  I decided to insert an old laptop with pfSense between the Modem and WirelessRouter1.  I was successful in configuring everything so I can ping any Internet IP from a PC anywhere on the network, so I am pretty sure that is all good.  However, DNS does not resolve any names.  I have tried manually using Cox DNS1,2&3, as well as Google DNS on the machines, and in the DHCP server on WirelessRouter1.  Also, I can get resolution in the pfSense diagnostics of any address, but WirelessRouter1 will not resolve.  Logically the problem is between the WAN side of WirelessRouter1 and LAN side of pfSense.

      Anything I am totally missing here?  I thought if I had manually assigned the DNS servers in the network adapter of my PC, it would work, but no...

      Thanks in advance!

      1 Reply Last reply Reply Quote 0
      • JKnottJ
        JKnott
        last edited by

        Without knowing how you configured pfSense, it's impossible to answer that question.  However, a simple test is to try to ping a DNS server, such as Google's.  What happens if you ping 8.8.8.8?

        Incidentally, using an old computer like that is not the best way to monitor a connection.  What I did was buy a cheap managed switch and configured it so that port 1 mirrors 2.  I then place the switch in between the devices, passing through port 2 and connect a computer running Wireshark into port 1.

        PfSense running on Qotom mini PC
        i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
        UniFi AC-Lite access point

        I haven't lost my mind. It's around here...somewhere...

        1 Reply Last reply Reply Quote 0
        • M
          McFrisch
          last edited by

          JKnott,
          I can ping any IP on the Internet from any device on the network, just no name resolution on the LAN side of the pfSense firewall.  I only have 4 desktops, a laptop, tablet, and 2 iPhones using the connection.  I use 2 wireless routers to cover the whole house and patio.  The laptop is AMD 64-Bit 2 Ghz 4 GB ram.

          Shouldn't the DNS resolution work, if I have them statically set on the PC or is it being blocked by pfSenses?  I was going to investigate the DNS Resolver/Forwarder configuration.  Thanks!

          1 Reply Last reply Reply Quote 0
          • B
            Birke
            last edited by

            have you set up a rule in pfsense to allow outgoing dns-traffic (port 53 udp)?
            i guess it gets blocked by the default-block-rule (you could enable logging of that rule and then check under status->system logs->firewall)

            1 Reply Last reply Reply Quote 0
            • johnpozJ
              johnpoz LAYER 8 Global Moderator
              last edited by

              "i guess it gets blocked by the default-block-rule"

              No the default lan rule is any any… If he had modified that sure that is common problem users pick tcp only, but that wouldn't explain being able to ping.

              If this is a new interface and not the lan which defaults to any any then he would have to create the rules he wants to allow - if so then yup again common for new users to forget to allow for dns.

              If he dns is working in the diagnostic screen of pfsense then you would guess that resolver is working - this is the default out of hte box configuration..

              Simple test from client via dig or nslook should tell you want the client is using and what answer if any getting back.

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.8, 24.11

              1 Reply Last reply Reply Quote 0
              • M
                McFrisch
                last edited by

                I will check later when I am in front of the firewall.

                1 Reply Last reply Reply Quote 0
                • M
                  McFrisch
                  last edited by

                  Thanks for the help.  DNS now resolves.  Here is what I did…

                  • Added Firewall Rule for LAN - Action: PASS - Interface: LAN - IPV4+6 - TCP/UDP - Source: Any Port: Any - Dest: Any Port Range 53-53

                  • Turned on DNS Resolver - Listen All Interfaces - outgoing: All - System Domain Local Zone Type: Transparent - DNSSEC Enabled - DNS Query Forward: Enabled

                  • On System>General Setup> DNS Server:  Set 8.8.8.8 WAN(DHCP) and 8.8.4.4 WAN(DHCP)

                  That's the good news.  I get resolution everywhere on the network. 
                  Bad News: I can't bring up a web page.  Guessing this means 80 is blocked.  So I tried the setting a rule similar for 80 and 443. It just sits and spins.  I will explore the other sections as this is probably not a topic for this area.

                  Thanks all!

                  1 Reply Last reply Reply Quote 0
                  • johnpozJ
                    johnpoz LAYER 8 Global Moderator
                    last edited by

                    Dude so you dicked with the default rules?  The default rules on lan are any any..

                    Post your lan rules!

                    The resolver is on out of the box with dnssec…

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                    1 Reply Last reply Reply Quote 0
                    • M
                      McFrisch
                      last edited by

                      John,
                      I only added a rule for port 53, suggested by Birke.  Once I got the DNS resolving I figured I would pose my NAT/Firewall issue in another Section, more related to my issue.  I do appreciate the help!
                      Here are my LAN rules, I disabled the port 53 rule as it wasn't necessary.

                      LANrules.jpg_thumb
                      LANrules.jpg

                      1 Reply Last reply Reply Quote 0
                      • M
                        McFrisch
                        last edited by

                        In order to test this setup safely, I have internalized the firewall.  I have a single desktop connected to the LAN port of the pfsense box and my internal LAN connected to the WAN port.  Is this acceptable for testing purposes?  I figured if I get this correctly configured, I would be able to connect to the webpage of my current router.

                        1 Reply Last reply Reply Quote 0
                        • chpalmerC
                          chpalmer
                          last edited by

                          What model of cablemodem?

                          Not one on this list is it?    http://badmodems.com/Forum/app.php/badmodems

                          This is a common issue with systems behind these modems.

                          Triggering snowflakes one by one..
                          Intel(R) Core(TM) i5-4590T CPU @ 2.00GHz on an M400 WG box.

                          1 Reply Last reply Reply Quote 0
                          • M
                            McFrisch
                            last edited by

                            chpalmer,  It is not on that list.  It is a Cisco DPQ3212 (Cox.net)

                            1 Reply Last reply Reply Quote 0
                            • JKnottJ
                              JKnott
                              last edited by

                              I have a Hitron CGN3ACSMR, which is on that list.  It works fine.

                              PfSense running on Qotom mini PC
                              i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                              UniFi AC-Lite access point

                              I haven't lost my mind. It's around here...somewhere...

                              1 Reply Last reply Reply Quote 0
                              • chpalmerC
                                chpalmer
                                last edited by

                                McFrisch- Sorry I think I was trying to answer another post

                                JKnott and anyone else wondering-

                                Anything with an Intel Puma chipset has one of the problems mentioned.  The Puma 6 is the worst.

                                Try this test..  http://www.dslreports.com/tools/puma6

                                Try running this-  https://www.grc.com/dns/benchmark.htm    Let it run for a couple of minutes and look at the tabular data.

                                Puma 6 modems on older firmware will show less than 100% results.  With my system I get 100% easily. I have Motorola MB8600 models all over the place. They are Broadcom chips and work flawlessly.  Ive had a couple of the Puma 6 models in hand and they tested as low as 70%.

                                Puma 6 modems with newer firmware have fixed this particular issue but still have all the other issues mentioned on DSLreports and the badmodems site.  http://badmodems.com/images/DOSABC.gif

                                http://badmodems.com/Fix.htm    Make sure you read and understand the issue.  If having these issues is acceptable to you then to each his own.

                                If you have one of these modems your fooling yourself if you think your not affected.

                                If you have a Puma 6 modem and are having DNS issues then you should look at the modem first.

                                http://www.dslreports.com/forum/r31122204-SB6190-Puma6-TCP-UDP-Network-Latency-Issue-Discussion    Just over 8000 replies.

                                Triggering snowflakes one by one..
                                Intel(R) Core(TM) i5-4590T CPU @ 2.00GHz on an M400 WG box.

                                1 Reply Last reply Reply Quote 0
                                • M
                                  McFrisch
                                  last edited by

                                  Puma 6 Test
                                  21ms : x
                                  24ms : x
                                  25ms : xx
                                  27ms : xxx
                                  28ms : xx
                                  31ms : xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx»
                                  32ms : xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
                                  33ms : xxx
                                  34ms : xxxx
                                  35ms : x
                                  36ms : xxxxx
                                  37ms : xxxxxxxx
                                  38ms : xxxxxxxxxxx
                                  39ms : xxxxxxxxxxxxx
                                  40ms : xxxxxxxx
                                  41ms : xx
                                  42ms : x
                                  43ms : xxx
                                  45ms : x
                                  46ms : x
                                  47ms : xxx
                                  52ms : x
                                  54ms : x
                                  62ms : x
                                  63ms : xxx
                                  64ms : x
                                  75ms : x
                                  78ms : xx
                                  79ms : xx
                                  150 - 199ms :xx
                                  250 - 299ms :x
                                  350 - 399ms :x

                                  I think that passes.  I will try the other test and post results. Thanks!

                                  1 Reply Last reply Reply Quote 0
                                  • First post
                                    Last post
                                  Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.