Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    DNS over TLS with CloudFlare not working for LAN hosts

    Scheduled Pinned Locked Moved DHCP and DNS
    27 Posts 18 Posters 4.5k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • P
      pbnet
      last edited by

      Hello,

      I've followed this article: https://www.netgate.com/blog/dns-over-tls-with-pfsense.html and now none of the Windows or Linux machine on my 2 VLANs are able to perform DNS resolution.

      If I don't use the custom settings
      server:
      ssl-upstream: yes
      do-tcp: yes
      forward-zone:
      name: "."
      forward-addr: 1.1.1.1@853
      forward-addr: 1.0.0.1@853

      Everything works fine, but IMHO it doesn't use TLS anymore.

      Any hint/idea would be greatly appreciated.

      Andy.

      1 Reply Last reply Reply Quote 0
      • amassiA
        amassi
        last edited by

        same trouble. It s look like pfsense dont agree with certificate

        1 Reply Last reply Reply Quote 0
        • P
          pbnet
          last edited by

          Thanks for confirming that I'm not the only one experiencing the issue.

          I wonder if Mr.  Ivor Kreso who wrote the official article is among the forum's readers/admins.

          1 Reply Last reply Reply Quote 0
          • H
            horost
            last edited by

            Seeing the same thing with 2.4.3-RELEASE.  Glad it's not just me.

            1 Reply Last reply Reply Quote 0
            • J
              James5mith
              last edited by

              Just tried this last night and it seemed to be working.  This morning, nothing on the internal network could do DNS resolution until I removed the custom settings and let it out over standard port 53.

              Wonder if something happened this morning to Cloudflare's DNS?

              1 Reply Last reply Reply Quote 0
              • D
                dansherman
                last edited by

                It wasn't working for me until I whitelisted 1.1.1.1 in pfBlockerNG.

                One of the lists (Abuse-Zeus) was blocking access to 1.1.1.1.

                Seems to be working now though.

                1 Reply Last reply Reply Quote 0
                • D
                  digs
                  last edited by

                  Can confirm it's an issue for me too. Running pfSense 2.4.3. Not running pfBlocker.

                  1 Reply Last reply Reply Quote 0
                  • R
                    rdlugosz
                    last edited by

                    A few of us appear to be having a similar issue and started a thread here with some error logs: https://forum.pfsense.org/index.php?topic=146207.0

                    I'm guessing we're all experiencing the same problem.

                    1 Reply Last reply Reply Quote 0
                    • ivorI
                      ivor
                      last edited by

                      We're seeing it as well. While we're investigating this issue, it seems to work with quad9 so I suggest you try it.

                      Need help fast? Our support is available 24/7 https://www.netgate.com/support/

                      1 Reply Last reply Reply Quote 0
                      • wgstarksW
                        wgstarks
                        last edited by

                        @ivor:

                        We're seeing it as well. While we're investigating this issue, it seems to work with quad9 so I suggest you try it.

                        What changes need to be made to use quad9?

                        Box: SG-4200

                        1 Reply Last reply Reply Quote 0
                        • ivorI
                          ivor
                          last edited by

                          We will be updating the blog post with that information, for now just replace the Cloudflare IP's with Quad9 ones (9.9.9.9 and 149.112.112.112).

                          Need help fast? Our support is available 24/7 https://www.netgate.com/support/

                          1 Reply Last reply Reply Quote 0
                          • wgstarksW
                            wgstarks
                            last edited by

                            @ivor:

                            We will be updating the blog post with that information, for now just replace the Cloudflare IP's with Quad9 ones (9.9.9.9 and 149.112.112.112).

                            Thanks. That worked.

                            I’ve seen similar reports on other forums regarding cloudflare’s primary server not working. Hopefully whatever the issue is will get resolved soon.

                            Box: SG-4200

                            1 Reply Last reply Reply Quote 0
                            • NeoDudeN
                              NeoDude
                              last edited by

                              Also had this issue with CloudFlare's DNS servers. Using Quad9 until someone can figure out what's going on.

                              Home Server "Gandalf":  unRAID Pro 6 | MB**:**  ASUS Z9PE-D8 WS | CPU:  Dual Xeon E5-2670 | RAM:  64GB Crucial PC-1600 ECC

                              1 Reply Last reply Reply Quote 0
                              • G
                                gsmornot
                                last edited by

                                Not that its needed but, same here. First thing this morning no DNS service. Quick fix but strange, worked well all day yesterday.

                                Apr 4 09:28:42 unbound 15056:0 error: SSL_read syscall: Connection reset by peer

                                1 Reply Last reply Reply Quote 0
                                • ivorI
                                  ivor
                                  last edited by

                                  We have updated the blog post with Quad9 settings https://www.netgate.com/blog/dns-over-tls-with-pfsense.html

                                  Need help fast? Our support is available 24/7 https://www.netgate.com/support/

                                  1 Reply Last reply Reply Quote 0
                                  • demD
                                    dem
                                    last edited by

                                    @ivor:

                                    We will be updating the blog post with that information, for now just replace the Cloudflare IP's with Quad9 ones (9.9.9.9 and 149.112.112.112).

                                    Ivor, I see you've updated the instructions in the blog post to be closer to what I suggested here. However I still don't think you need the server: line.

                                    Also I suggest against recommending people mix and match DNS providers since that could result in inconsistent results as the various providers block different sets of phishing and malware sites.

                                    Finally it might be easier to confirm DNS over TLS is working by filtering States by :853 and :53.

                                    Thanks.

                                    1 Reply Last reply Reply Quote 0
                                    • jimpJ
                                      jimp Rebel Alliance Developer Netgate
                                      last edited by

                                      You need the "server:" line because you cannot guarantee that the unbound config will still be in the "server:" context by the time it adds in the custom options. Depending on whatever else the user has configured in the resolver it may be in another section and break.

                                      Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                                      Need help fast? Netgate Global Support!

                                      Do not Chat/PM for help!

                                      1 Reply Last reply Reply Quote 0
                                      • demD
                                        dem
                                        last edited by

                                        Good to know, thanks Jim.

                                        1 Reply Last reply Reply Quote 0
                                        • T
                                          T5000
                                          last edited by

                                          Doesn't work well, for me anyway. I have DNSBL enabled and my options look like this:

                                          server:include: /var/unbound/pfb_dnsbl.*conf
                                          forward-zone:
                                          name: "."
                                          forward-ssl-upstream: yes
                                          forward-addr: 1.1.1.1@853
                                          forward-addr: 1.0.0.1@853
                                          

                                          many websites don't load at all or very slow (some are ok), iOS Appstore won't work either.

                                          1 Reply Last reply Reply Quote 0
                                          • jimpJ
                                            jimp Rebel Alliance Developer Netgate
                                            last edited by

                                            Cloudflare 's 1.1.1.1 server has been flaky for some people since it launched, try adding a line for 9.9.9.9 instead of 1.1.1.1

                                            Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                                            Need help fast? Netgate Global Support!

                                            Do not Chat/PM for help!

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.