DNS Resolver not working, request timed out
-
Goodmorning everyone,
I have a problem with the PfSense DNS Resolver. I'm doing lab tests to use pfsense during an event, so I connected the wan to the corporate network that takes the address via dhcp with internal dns. I have the DNS Resolver active with the default settings and PfSense has the default settings, I left everything as it was.
If I query the DNS from a windows machine connected to the LAN port, I get the answer "DNS request timed out". Analyzing the traffic with Wireshark I get an answer "server Failure" with flag "Authoritative: Server is not an authority for domain"
Where am I doing wrong?thank you
-
You got a servfail… Where is pfsense? In a corp network.. Yeah pfsense out of the box tries and resolve.. Many corp networks block outbound dns.. So you would need to forward pfsense to whatever your corp dns is, or allow outbound on 53..
Also if pfsense is going to forward to some dns, and lookup rfc1918 addresses its going to complain of rebind, etc.
So you just want it to resolve public dns or internal dns as well?
-
thank you for the fast response.
I need to configure PfSense to permit navigation on client using wifi, with proxy and traffic shaping, so I don't need to resolve internal addresses, only public traffic.
The private corp addresses are on the class like 10.8.x.x
thank you -
And again out of the box pfsense will resolve, not forward. Does your corp network allow any box on their network to query say 8.8.8.8 dns without interception?
Shoot many corp networks do not even allow internal clients to resolve anything public.. Only the proxy in the corp network can resolve say www.google.com
Out of the box pfsense unbound will resolve, meaning it walks down from roots until it talks to the actual authoritative NameServer for the domain your looking.. So if your corp network does not allow this.. Then you would need to put unbound in forwarder mode and forward dns queries to some nameservers that will allow return the public info you want. So in turn pfsense can hand that back to clients behind it using it for dns.
-
ok ok, I understand what you mean, so I've tried to enable "Enable Forwarding Mode" on DNS Resolver but it works only if I uncheck the "DNSSEC data is required for trust-anchored zones", in advanced settings page
-
Well if where you forward to doesn't support dnssec than yeah you would need to disable dnssec. Also trying to ask a forwarder for dnssec and the trust anchors is pretty pointless anyway.
-
Tengo una buena respuesta de este hilo.