No LAN Internet Access



  • I recently had to get Satellite Internet from Viasat/Exede and have been having nothing but issues with pfsense.  I've search and have not found the issue.

    Initially, I couldn't get my  Wireless side working.  I have a Linksys E3000 setup as an AP that connects into the Computers/Etc section below, pfSense worked, but nothing connecting into the AP or the wireless off of it could access the internet.  I could connect to the LAN but not WAN.  So I backed up my pfsense box and wiped it, unsure if the issue was due to corruption as I was seeing many errors appearing.

    Normal Network layout is:
    ISP Modem -> pfSense -> Switch -> Computers/Etc.

    I'm putting my ISP info here, in case it is causing the issue.  My ISP router/modem can work as wifi and router.  Most of these settings are defaults.
    Wifi
      disabled

    LAN Setup
      IP Address: 192.168.1.1
      Subnet: 255.255.255.0
      DHCP Server enabled
      Starting IP: 192.168.1.100
      Max Users: 50
      Static DNSs are blank, WINs is blank and lease time is 1 day

    Internet Setup
      Connection Type: Automatic Config - DHCP
      (can't make any changes)

    Firewall
      SPI Protection = enabled
      Internet Filter
          Checked = Filter anonymous Internet Requests, Filter IDENT (Port 113)
          Unchecked = Filter Multicast, Filter Internet NAT Redirection for IPv4 Internet Only

    VPN Passthrough
      All enabled (IPSEC, PPTP, L2TP)

    UPNP
      Enabled = UPNP, User Configuration
      Disabled = User Disabled Internet Access

    Bridge Mode
      disabled

    Port Forwarding & Triggering
      all empty

    DMZ
      Enabled
      Source IP: Any IP (can set it at a range)
      Destination: set to MAC of pfsense WAN port (can set to an IP)  – currently have a ddwrt router as my primary router until pfsense is up this doesnt affect it

    QoS
      Enabled = WMM Support
      Disabled = No Acknowledgement, Internet Access Policy
      Nothing else set

    I have wiped my pfSense box and it has nothing on it other than a bare bones install of pfSense 2.4.3-RELEASE (amd64).

    Console of pfSense shows, below.  It grabbed both automatically, but I did set the LAN side
    WAN -> v4/DHCP: 192.168.1.101/24
    LAN -> v4: 10.0.0.1/24

    I can ping google.com from the pfsense box, but a computer attached to the LAN side of pfsense cannot access google.com.

    The DNS pfsense is showing is 127.0.0.1 and 2 of the hard coded DNS addresses from the ISP router.

    Anytime I restore from one of my old configurations, no LAN internet access.  I can't figure out what the issue is.



  • You first need to separate the issue into either DNS or route.  From your client, can you ping 8.8.8.8?  Can you perform 'nslookup google.com'?



  • @kaysersosa:

    DMZ
      Enabled
      Source IP: Any IP (can set it at a range)
      Destination: set to MAC of pfsense WAN port (can set to an IP)  – currently have a ddwrt router as my primary router until pfsense is up this doesnt affect it

    Disable DMZ on your ISP Router.
    pfSense obtains an IP from your ISP Router, using DHCP - the "WAN -> v4/DHCP: 192.168.1.101/24", and all will be fine.



  • @KOM:

    You first need to separate the issue into either DNS or route.  From your client, can you ping 8.8.8.8?  Can you perform 'nslookup google.com'?

    Well, it appears to be working, accessing the internet.  I had powered off the pfsense router and the client system.  Powered them back on just to respond to both of your comments and it's working.  Going to attempt to restore my config from a prior build either later tonight or tomorrow and see what happens.

    @Gertjan:

    Disable DMZ on your ISP Router.
    pfSense obtains an IP from your ISP Router, using DHCP - the "WAN -> v4/DHCP: 192.168.1.101/24", and all will be fine.

    Unless my understanding is incorrect, I DMZ so I don't have to enter firewall rules into both routers and I can just pass through the ISP router.



  • The issue still persists.

    I uploaded a former config and it didn't work again.
    I have wiped my pfSense box and it has nothing on it other than a bare bones install of pfSense 2.4.3-RELEASE (amd64).

    Console of pfSense shows, below.  It grabbed both automatically, but I did set the LAN side
    WAN -> v4/DHCP: 192.168.1.101/24
    LAN -> v4: 10.0.0.1/25

    webConfigurator is set to HTTPS.

    I can ping google.com from the pfsense box, but a computer attached to the LAN side of pfsense cannot access google.com.

    The DNS pfsense is showing is 127.0.0.1 and 2 of the hard coded DNS addresses from the ISP router.

    Still looking for assistance.



  • Computer attached to LAN must have an IP address in the 10.0.0.1/25 range, a gateway of 10.0.0.1, and DNS of either 10.0.0.1 or an external DNS like 8.8.8.8.



  • @KOM:

    Computer attached to LAN must have an IP address in the 10.0.0.1/25 range, a gateway of 10.0.0.1, and DNS of either 10.0.0.1 or an external DNS like 8.8.8.8.

    IPv4: 10.0.0.100
    Gateway: 10.0.0.1
    DNS: 10.0.0.1


  • Rebel Alliance Global Moderator

    "10.0.0.1/25 range"

    That is not a network address, that is a host address with a mask.. The network address would be 10.0.0.0/25, once you move the address into an actual possible host address then it no longer is a network address but a host address with mask.

    10.0.0.0/25 would be
    10.0.0.0 - 10.0.0.127

    Where .0 is the wire or network and .127 would be the broadcast..



  • OK, now from a DOS box on that client can you do:

    nslookup google.com
    

    Have you gone through the Connectivity Troubleshooting guide?

    That is not a network address, that is a host address with a mask.

    Yes, I know.  I figured he would get the point.



  • I'm unable to access the internet from the client at all.  I can ping from the pfSense box.

    Client IP provided by the DHCP of the pfSense box is 10.0.0.100.



  • @kaysersosa:

    I uploaded a former config and it didn't work again.

    Proofs something is not good in that config.

    @kaysersosa:

    Console of pfSense shows, below.  It grabbed both automatically, but I did set the LAN side
    WAN -> v4/DHCP: 192.168.1.101/24
    LAN -> v4: 10.0.0.1/25

    /25 ? I would have chosen /24 ;)
    Seems fine for the rest.

    @kaysersosa:

    I can ping google.com from the pfsense box, but a computer attached to the LAN side of pfsense cannot access google.com.

    On that PC, what says

    ipconfig /all
    

    ?

    edit : ok, was already asked.
    nslookup
    test can also show the 'why'.

    A PC should obtain a gateway == IP LAN pfSense - and the DNS IP should also be this IP. pfSense will be the 'DNS' for all your network devices.

    The firewall rule on LAN is the "default pass all rule", right ?

    @kaysersosa:

    The DNS pfsense is showing is 127.0.0.1 and 2 of the hard coded DNS addresses from the ISP router.

    This is what I have - my Dashboard says the same - I'm using the default Resolver.

    @kaysersosa:

    Unless my understanding is incorrect, I DMZ so I don't have to enter firewall rules into both routers and I can just pass through the ISP router.

    Correct. Activate DMZ or individual firewall later, if every else works.



  • Former configs worked without issues under other ISPs.  Why I included current ISP info.

    No firewall rules have been added to the pfSense box other than was is created by default.

    ======================
    nslookup from the client pc

    nslookup google.com

    Server: pfSense-router.localdomain
    Address: 10.0.0.1

    DNS request timed out.
        timeout was 2 seconds.
    *** Request to pfSense-router.localdomain timed-out

    ======================
    ipconfig from the client pc

    ipconfig /all

    Windows IP Configuration

    Host Name . . . . . . . . . . . . : ********
      Primary Dns Suffix  . . . . . . . :
      Node Type . . . . . . . . . . . . : Hybrid
      IP Routing Enabled. . . . . . . . : No
      WINS Proxy Enabled. . . . . . . . : No
      DNS Suffix Search List. . . . . . : localdomain

    Ethernet adapter Ethernet:

    Connection-specific DNS Suffix  . : localdomain
      Description . . . . . . . . . . . : This Qualcomm Atheros network Controller connects you to the network.
      Physical Address. . . . . . . . . : ********
      DHCP Enabled. . . . . . . . . . . : Yes
      Autoconfiguration Enabled . . . . : Yes
      Link-local IPv6 Address . . . . . : ********(Preferred)
      IPv4 Address. . . . . . . . . . . : 10.0.0.100(Preferred)
      Subnet Mask . . . . . . . . . . . : 255.255.255.128
      Lease Obtained. . . . . . . . . . : Thursday, May 3, 2018 8:06:08 AM
      Lease Expires . . . . . . . . . . : Thursday, May 3, 2018 10:06:08 AM
      Default Gateway . . . . . . . . . : 10.0.0.1
      DHCP Server . . . . . . . . . . . : 10.0.0.1
      DHCPv6 IAID . . . . . . . . . . . : ********
      DHCPv6 Client DUID. . . . . . . . : ********
      DNS Servers . . . . . . . . . . . : 10.0.0.1
      NetBIOS over Tcpip. . . . . . . . : Enabled

    Ethernet adapter Ethernet 3:

    Media State . . . . . . . . . . . : Media disconnected
      Connection-specific DNS Suffix  . :
      Description . . . . . . . . . . . : PdaNet Broadband Adapter
      Physical Address. . . . . . . . . : ********
      DHCP Enabled. . . . . . . . . . . : Yes
      Autoconfiguration Enabled . . . . : Yes

    Ethernet adapter Ethernet 2:

    Media State . . . . . . . . . . . : Media disconnected
      Connection-specific DNS Suffix  . :
      Description . . . . . . . . . . . : TeamViewer VPN Adapter
      Physical Address. . . . . . . . . : ********
      DHCP Enabled. . . . . . . . . . . : Yes
      Autoconfiguration Enabled . . . . : Yes



  • DNS isn't working.  Is forwarder or resolver enabled and running?



  • @KOM:

    DNS isn't working.  Is forwarder or resolver enabled and running?

    DNS Resolver is enabled, Forwarder is not.



  • What says :

    sockstat -4l | grep 'unbound'
    
    ps ax | grep 'unbound'
    


  • @Gertjan:

    What says :

    sockstat -4l | grep 'unbound'
    
    ps ax | grep 'unbound'
    

    Shell Output - sockstat -4l | grep 'unbound'

    unbound  unbound    22802 5  udp4  *:53                  :
    unbound  unbound    22802 6  tcp4  *:53                  :
    unbound  unbound    22802 7  tcp4  127.0.0.1:953        :
    unbound  unbound    22802 15 udp4  *:21274              :
    unbound  unbound    22802 16 udp4  *:5518                :
    unbound  unbound    22802 17 udp4  *:56616              :
    unbound  unbound    22802 18 udp4  *:26302              :
    unbound  unbound    22802 19 udp4  *:7986                :
    unbound  unbound    22802 20 udp4  *:47597              :
    unbound  unbound    22802 21 udp4  *:39864              :
    unbound  unbound    22802 22 udp4  *:25131              :
    unbound  unbound    22802 23 udp4  *:39016              :
    unbound  unbound    22802 24 udp4  *:23576              :
    unbound  unbound    22802 25 udp4  *:54912              :
    unbound  unbound    22802 27 udp4  *:16242              :
    unbound  unbound    22802 28 udp4  *:38933              :

    Shell Output - ps ax | grep 'unbound'

    22802  -  Ss    0:21.49 /usr/local/sbin/unbound -c /var/unbound/unbound.conf
    88305  -  S      0:00.00 sh -c ps ax | grep 'unbound' 2>&1
    88692  -  S      0:00.00 grep unbound



  • Still not resolved, any help out there?


  • Rebel Alliance Global Moderator

    And what does diagnostics, dns lookup show for www.google.com

    Validate pfsense can actually resolve..

    If it can resolve but clients can not - are they actually using pfsense for dns?  Post up your lan rules.




  • @johnpoz:

    And what does diagnostics, dns lookup show for www.google.com

    Validate pfsense can actually resolve..

    If it can resolve but clients can not - are they actually using pfsense for dns?  Post up your lan rules.

    DNS Lookup for www.google.com - attached

    LAN Rules - attached (default install, nothing changed by me on them)

    ![dns lookup.jpg](/public/imported_attachments/1/dns lookup.jpg)
    ![dns lookup.jpg_thumb](/public/imported_attachments/1/dns lookup.jpg_thumb)
    ![lan rules.jpg](/public/imported_attachments/1/lan rules.jpg)
    ![lan rules.jpg_thumb](/public/imported_attachments/1/lan rules.jpg_thumb)


  • Rebel Alliance Global Moderator

    Well from your client do a nslookup.. or better yet dig..

    What does it come back?

    Why would you be showing CNAME?  www.google.com does not have any cname…  And where is your AAAA record..  Your isp is dicking with your dns maybe?

    Also if you are using resolver, all you should see is the loopback... why do you have those 99.x.x.x ?




  • I some how magically have internet through the pfSense router now.  No clue how or why.  I have done nothing other than reboot my IPS modem yesterday, I've done this multiple times with the pfSense router attached.  I had lost connection to the internet yesterday for a short time and rebooted the IPS modem.

    Attached are a couple of NSLookups.  The top one was from yesterday when the pfSense client didn't have any internet.  The bottom is from today when I noticed it did have internet.

    No clue on the CNAME or AAAA record.  The 99's are default DNS from IPS router.

    Any thoughts on what is going on?  I'm going to leave it alone other than any testing/checks recommended here until next week.  Then I'm going to try and set it up.  Currently attempting to attach an AP to it and see if that works.  Was another issue I had.

    nslookup.txt


  • Rebel Alliance Global Moderator

    Your having connectivity problems even talking to pfsense on 10.7.13.1 from that..

    Even when say its working you still had timeout for 2 seconds.

    How is your client connected to this 10.7.13 network?  Or unbound is starting and stopping a lot - look in your log for that.



  • When I stated it was working the other day, the hardware setup was (IPS Modem -> AP -> Client PC).

    The AP is an old Linksys WRT54GL router with DD-WRT installed and setup as a wireless switch.  By working I simply mean the Client PC could get to www.google.com.  It was unable at all prior.

    Testing again today.  The Client PC is no longer able to get to www.google.com.  pfSense can still ping www.google.com.  I did nothing to the system over the weekend.  Left it on untouched.

    This morning I changed the network layout to be similar to how it will be when put into use (IPS Modem -> Gigbit Switch -> Client PC / AP / etc.).
    Still not working, meaning Client PC unable to get to www.google.com.


  • Rebel Alliance Global Moderator

    And are you able to query with nslookup?  Your post was timeout even talking to pfsense.

    Did you look in the log, is unbound restarting over and over again?



  • nslookup - DNS request timed out on the Client PC.

    Attached are the last few DNS Resolver logs.



  • Rebel Alliance Global Moderator

    You have a problem there could not fetch dnskey.

    I would suggest you up the logging level and then do a few queries for stuff.  Quite possible your isp is messing with resolving..

    Average 20 sec processing time??

    look here
    Apr 23 05:43:48 unbound 10564:0 info: average recursion processing time 0.088876 sec
    Apr 23 05:43:48 unbound 10564:0 info: server stats for thread 3: requestlist max 32 avg 0.991393 exceeded 0 jostled 0
    Apr 23 05:43:48 unbound 10564:0 info: server stats for thread 3: 53901 queries, 49987 answers from cache, 3914 recursions, 10726 prefetch, 0 rejected by ip ratelimiting

    Your dns is not functioning…  See my processing time and how many queries..

    I would suggest you install dig and do a trace for something to see why your having problems...

    
    E:\>dig www.google.com +trace
    
    ; <<>> DiG 9.11.3 <<>> www.google.com +trace
    ;; global options: +cmd
    .                       514566  IN      NS      a.root-servers.net.
    .                       514566  IN      NS      b.root-servers.net.
    .                       514566  IN      NS      c.root-servers.net.
    .                       514566  IN      NS      d.root-servers.net.
    .                       514566  IN      NS      e.root-servers.net.
    .                       514566  IN      NS      f.root-servers.net.
    .                       514566  IN      NS      g.root-servers.net.
    .                       514566  IN      NS      h.root-servers.net.
    .                       514566  IN      NS      i.root-servers.net.
    .                       514566  IN      NS      j.root-servers.net.
    .                       514566  IN      NS      k.root-servers.net.
    .                       514566  IN      NS      l.root-servers.net.
    .                       514566  IN      NS      m.root-servers.net.
    .                       514566  IN      RRSIG   NS 8 0 518400 20180520050000 20180507040000 39570 . hH/aRa4rRPFYuy0W2RrTkOPFoGuQoyatqK7QbSQWY1D4/iZlZIRR2Zsj MIeG+GYZ+9u3Yq5t4wDrrMmgZQ39NTY1PURh+ZRz7LBZl8ZxlAp89xkS IB6P8/7k2wcAlIcLK7U1ukayR2SyPu3GWFt3z9loY15e++MuRnAtE9vM zjtG/9ioWsQMugMQ/JPH04645E5oKNunHiSyi92h018JS4CKsignxI/T 878CDEm7beFBLe1ouJZJlJoeNvemLJT3rhVZ0w1AzTX8cyGLtTggkNX2 jeQcFgciRfVXEbdnJ3ivvqIYjbKYL0NdVsrkVNdS86cH82Z0vuuJjNFT wiyIGA==
    ;; Received 525 bytes from 192.168.3.10#53(192.168.3.10) in 1 ms
    
    com.                    172800  IN      NS      a.gtld-servers.net.
    com.                    172800  IN      NS      b.gtld-servers.net.
    com.                    172800  IN      NS      c.gtld-servers.net.
    com.                    172800  IN      NS      d.gtld-servers.net.
    com.                    172800  IN      NS      e.gtld-servers.net.
    com.                    172800  IN      NS      f.gtld-servers.net.
    com.                    172800  IN      NS      g.gtld-servers.net.
    com.                    172800  IN      NS      h.gtld-servers.net.
    com.                    172800  IN      NS      i.gtld-servers.net.
    com.                    172800  IN      NS      j.gtld-servers.net.
    com.                    172800  IN      NS      k.gtld-servers.net.
    com.                    172800  IN      NS      l.gtld-servers.net.
    com.                    172800  IN      NS      m.gtld-servers.net.
    com.                    86400   IN      DS      30909 8 2 E2D3C916F6DEEAC73294E8268FB5885044A833FC5459588F4A9184CF C41A5766
    com.                    86400   IN      RRSIG   DS 8 1 86400 20180520050000 20180507040000 39570 . GiCsdUG5kyf5edT12Gdr/DT6dNUqILHfdqZ2t1vS0VY8YErVjoXRwNlr SoufI39JoZ6ChuMA3wLCo+Q9uTtRoqDKHKJU8MS7MXWyhitbQeL1cdSW insHZZVMltOH4lblQgSSPm4rte4fW+4J9lissWSPNW4d1JnHTTVtDPo+ A6jx6aYpapREv69eE89CfZ8lWBxyr788PDLw/bpwQYX5FuwzpmVZeRCQ G5j/ujt2wGn1NGs/EX3cOXpX4+0RS6fTo4YhTDZ2IIOoMg3ISz55w8Ai FczfOxxW35Gy6dhf6pV1VX943AepsYTUHjDVnK6aHTiwUcrShBtvDmXb Otk2Vg==
    ;; Received 1174 bytes from 192.58.128.30#53(j.root-servers.net) in 45 ms
    
    google.com.             172800  IN      NS      ns2.google.com.
    google.com.             172800  IN      NS      ns1.google.com.
    google.com.             172800  IN      NS      ns3.google.com.
    google.com.             172800  IN      NS      ns4.google.com.
    CK0POJMG874LJREF7EFN8430QVIT8BSM.com. 86400 IN NSEC3 1 1 0 - CK0Q1GIN43N1ARRC9OSM6QPQR81H5M9A  NS SOA RRSIG DNSKEY NSEC3PARAM
    CK0POJMG874LJREF7EFN8430QVIT8BSM.com. 86400 IN RRSIG NSEC3 8 2 86400 20180512044510 20180505033510 36707 com. ojEZ8Iv1J7vE5QEfjJM1YQSdFLvHhVqppd6HA3cZDZff+TdX5YSsNPf1 gVepdTn0W03LMHSmQhtZJKWE7TzTpQfJUF+UZz/Nj8CPOvRJ+hdDfoPw CIAg5ZVfzfYNSrdsOGFbkxGQ6drlE/Os5tnTcQnrDJktwBilZcohoAkn ioY=
    S849LHDDSVU9A9N2FIRO5NKMQB321BEP.com. 86400 IN NSEC3 1 1 0 - S84CEFMDU6ABFSN4V0L2VLLOASCD5IV2  NS DS RRSIG
    S849LHDDSVU9A9N2FIRO5NKMQB321BEP.com. 86400 IN RRSIG NSEC3 8 2 86400 20180513051411 20180506040411 36707 com. kQVTehhrmgeTzalwPVhWotamwKGxGb5VuGsm/T+FGU5pxaSNcutQ+YXI uukidbNumZGDv7p8hKNWy3C+RZ/o6Cm5puaxwslSBXL8jOiXau7uOnIb qFFN2pWrCsQcBUfXDTZg+mpUBk2DFPV7Ny+QZXnAAzfthbmu0L9sD+VA TBs=
    ;; Received 776 bytes from 192.52.178.30#53(k.gtld-servers.net) in 36 ms
    
    www.google.com.         300     IN      A       172.217.6.100
    ;; Received 48 bytes from 216.239.34.10#53(ns2.google.com) in 24 ms
    
    E:\>
    
    

    That is a full resolve from my client.. lets take pfsense out of the picture for you resolving and do some tests with dig on your client.  You can download it here, just install the tools in the bind install.

    https://www.isc.org/downloads/

    Your dns is not functioning correctly that is for sure.. You could try using forwarding mode vs resolving. But I would be interested in finding the root cause of your problem.



  • Ran DIG from the Client PC, below is the output.

    C:\Program Files\ISC BIND 9\bin>dig www.google.com +trace

    ; <<>> DiG 9.11.3 <<>> www.google.com +trace
    ;; global options: +cmd
    ;; Received 12 bytes from 10.7.13.1#53(10.7.13.1) in 1 ms

    C:\Program Files\ISC BIND 9\bin>


  • Rebel Alliance Global Moderator

    that is not a +trace..

    You got back nothing from unbound..  You should of gotten back roots and walked down from there.

    Force getting the roots… do say

    E:>dig @8.8.8.8 www.google.com +trace

    ; <<>> DiG 9.11.3 <<>> @8.8.8.8 www.google.com +trace
    ; (1 server found)
    ;; global options: +cmd
    .                      175855  IN      NS      a.root-servers.net.
    .                      175855  IN      NS      b.root-servers.net.
    .                      175855  IN      NS      c.root-servers.net.
    .                      175855  IN      NS      d.root-servers.net.
    .                      175855  IN      NS      e.root-servers.net.
    .                      175855  IN      NS      f.root-servers.net.
    .                      175855  IN      NS      g.root-servers.net.
    .                      175855  IN      NS      h.root-servers.net.
    .                      175855  IN      NS      i.root-servers.net.
    .                      175855  IN      NS      j.root-servers.net.
    .                      175855  IN      NS      k.root-servers.net.
    .                      175855  IN      NS      l.root-servers.net.
    .                      175855  IN      NS      m.root-servers.net.
    .                      175855  IN      RRSIG  NS 8 0 518400 20180519170000 20180506160000 39570 . l8I2NF/qog7oKasVnbc5E50ay3bAXx+PahYvKlyxf+IpcoJdPrl6LUIO Z7Sfx+GJRaUyNCnBsiBdQqjyGKE/RSv+HtbUlwGb57lwOJsV3GAcCDBw gePDO350Q7kSueVqY+/Xdjyc4BbhhmGe5X4PdMONI8V74k2qMyrNVjzE vi8yL6IWizDPt3K9boWxJHVpE03GRxC9NfxtCrcTzwXdIHUBSnK6ZoYt Bys2S6/mqqeJyqJqpglpZzuvOw03MTplye0HcGZ/w7u5u2Pdhxm7Oghj Kepa0xtQEuT3oPpBFRvZTg5MKCPoeZgy82Wq8heakZztqN/gpvAgrmoL iO2mvA==
    ;; Received 525 bytes from 8.8.8.8#53(8.8.8.8) in 12 ms

    notice I got back the roots from 8.8.8.8



  • From the Client PC

    C:\Program Files\ISC BIND 9\bin>dig @8.8.8.8 www.google.com +trace

    ; <<>> DiG 9.11.3 <<>> @8.8.8.8 www.google.com +trace
    ; (1 server found)
    ;; global options: +cmd
    .                      115791  IN      NS      a.root-servers.net.
    .                      115791  IN      NS      b.root-servers.net.
    .                      115791  IN      NS      c.root-servers.net.
    .                      115791  IN      NS      d.root-servers.net.
    .                      115791  IN      NS      e.root-servers.net.
    .                      115791  IN      NS      f.root-servers.net.
    .                      115791  IN      NS      g.root-servers.net.
    .                      115791  IN      NS      h.root-servers.net.
    .                      115791  IN      NS      i.root-servers.net.
    .                      115791  IN      NS      j.root-servers.net.
    .                      115791  IN      NS      k.root-servers.net.
    .                      115791  IN      NS      l.root-servers.net.
    .                      115791  IN      NS      m.root-servers.net.
    .                      115791  IN      RRSIG  NS 8 0 518400 20180518170000 20180505160000 39570 . NEoKyFHHEdXvMg1bip/9XeAQhV22bQa04O5tUH/g2SN/9AcYb0vbkLP/ 1ur6HNU8K57rUWZl94Zmbh7NA4gGQ7SarA9OvG9wz4YrdLkWEV9Up+JI JvvH9d+IlFQdlsV9XGwZ9xJRAnz2KflsOlFO8/vbRIQyLSJXANaNp/NV KYkOaWgjghVzN8x5qbsErU9P5G/UUQ6BZdis03rGLOMkchRggV9y7+/G 5JlPtyXoNBczvDS5j29yTV0F3P3Tf5cmtiK2DfwD4Lk6thTymBcf7qfL Ga9amC4QdfvDUhXVzPOFTARvST7yzIDCqwqbuW8s7imw2Z23Q2TqTqwq 6RDhbQ==
    couldn't get address for 'a.root-servers.net': not found
    couldn't get address for 'b.root-servers.net': not found
    couldn't get address for 'c.root-servers.net': not found
    couldn't get address for 'd.root-servers.net': not found
    couldn't get address for 'e.root-servers.net': not found
    couldn't get address for 'f.root-servers.net': not found
    couldn't get address for 'g.root-servers.net': not found
    couldn't get address for 'h.root-servers.net': not found
    couldn't get address for 'i.root-servers.net': not found
    couldn't get address for 'j.root-servers.net': not found
    couldn't get address for 'k.root-servers.net': not found
    couldn't get address for 'l.root-servers.net': not found
    couldn't get address for 'm.root-servers.net': not found
    dig: couldn't get address for 'a.root-servers.net': no more

    C:\Program Files\ISC BIND 9\bin>


  • Rebel Alliance Global Moderator

    dude change your client to use 8.8.8.8 as its dns… Then do you dig..

    So that allowed you to get the roots, but after that client will use its default dns to get the IP address of roots.  Your case that seems to be broken.

    If you set your client to use 8.8.8.8 and then do a

    dig www.google.com +trace

    it should work



  • I think I know where to make that change, see attachment.
    Added the 8.8.8.8 and the 8.8.4.4 and unchecked DNS Server Override.

    Run on Client PC after change above.

    C:\Program Files\ISC BIND 9\bin>dig www.google.com +trace

    ; <<>> DiG 9.11.3 <<>> www.google.com +trace
    ;; global options: +cmd
    ;; Received 12 bytes from 10.7.13.1#53(10.7.13.1) in 0 ms

    C:\Program Files\ISC BIND 9\bin>

    ![sys setup.png](/public/imported_attachments/1/sys setup.png)
    ![sys setup.png_thumb](/public/imported_attachments/1/sys setup.png_thumb)



  • Forgot to mention that on the Dashboard page under DNS server(s) I see the following.

    127.0.0.1
    8.8.8.8
    8.8.4.4

    Prior it was showing
    127.0.0.1
    99…from ISP modem
    99...from ISP modem
    anything I added


  • Rebel Alliance Global Moderator

    all meaning less..

    Can your client work when pointing directly at 8.8.8.8 and not to pfsense.



  • Yes, hooked directly up to the ISP modem it can connect to the internet.


  • Rebel Alliance Global Moderator

    Dude point your client to 8.8.8.8 leave it behind pfsense..

    This is not that hard to pin down..



  • Sorry miss-understood what you were asking.

    Network setup
    ISP Modem -> Gig Switch -> Client PC / AP / etc

    I hard-set 8.8.8.8 as the DNS on the Client under Network/Properties.

    The client can now get to the internet.



  • So I should be good if I can get rid of the 127.0.0.1 on the pfSense router?

    Dashboard page under DNS server(s) I see the following.

    127.0.0.1
    8.8.8.8
    8.8.4.4

    Where is this setting at?



  • Network setup
    ISP Modem -> pfSense -> Gig Switch -> Client PC / AP / etc

    Forgot to add the pfSense in earlier in the thread.


  • Rebel Alliance Global Moderator

    If client is working fine using 8.8.8.8 then you have 2 choices troubleshoot why pfsense resolving is haivng a problem.

    Or just turn off resolving mode and use forwarder mode and point to 8.8.8.8

    No you are never going to want to remove loopback, that is pfsense asking itself.  If pfsense doesn't ask itself it will never be able to resolve any of your local host names.  And your clients your going to want to point back to pfsense once pfsense is just forwarding..

    But pfsense should be able to just resolve..  So I would be more curious to why it can not resolve?



  • Just for your reference.  The ISP modem has 2 ports on it.  I have my pfSense router in one of the ports and my active DD-WRT router in the other.  DD-WRT is running my home network currently.

    Ok, so I removed the hard-set 8.8.8.8 as the DNS on the Client under Network/Properties.  Then on pfSense under Services/DNS Resolver/General Settings - unchecked enable and saved/applied and thn on pfSense under Services/DNS Forwarder I checked enable and saved/applied.  No internet on the Client PC.

    Are there any other settings required with the DNS Forwarder?  If not and you are willing to help I'm all for attempting to troubleshoot the DNS Resolver.