Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    DNS server in pfsence prevent connecting to this DNS server for more than 1 hop?

    Scheduled Pinned Locked Moved General pfSense Questions
    7 Posts 3 Posters 470 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • F
      feilongwudi2088
      last edited by

      I happen to find a pretty weird issue when I do the home lab in GNS3 server. The pfsense is running in latest version 2.4.3.

      Other router is mikrotik or cisco CSR1000v.

      other router –> pfsense --> Internet
      If we set up 8.8.8.8 as DNS server in pfsense, other routers also set up 8.8.8.8 as DNS server, they all work properly.

      Microcore Linux -->other router --> pfsense --> Internet
      If we set up 8.8.8.8 as DNS server in pfsense, other routers also set up 8.8.8.8 as DNS server, they all work properly. However, if we set up Microcore Linux with DNS server 8.8.8.8, it cannot ping 8.8.8.8.

      other router A --> other router B--> pfsense --> Internet
      If we set up 8.8.8.8 as DNS server in pfsense, other routers also set up 8.8.8.8 as DNS server. Router A cannot ping 8.8.8.8, Router B can ping 8.8.8.8.

      DNS server in pfsence could prevent DNS request for more than 1 hop????
      If I delete the DNS server setting in pfsense, all three examples work properly with pinging to 8.8.8.8.

      When ping cannot work, the DNS resolving is not working too.

      1 Reply Last reply Reply Quote 0
      • DerelictD
        Derelict LAYER 8 Netgate
        last edited by

        Setting a GATEWAY on a DNS server in System > General creates a host route for that IP address out that - and only that - interface.

        Perhaps that is making it appear to be behaving in an unexpected manner.

        Chattanooga, Tennessee, USA
        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
        Do Not Chat For Help! NO_WAN_EGRESS(TM)

        1 Reply Last reply Reply Quote 0
        • johnpozJ
          johnpoz LAYER 8 Global Moderator
          last edited by

          Dude if you have downstream routers you have to configure them or no they will not be able to get out to the internet.  What is the connection of these downstream routers to pfsense, are you doing natting are they on a transit?

          Router A – Router B --- pfsense

          This gives no information at all to try and help you... Draw up your network and put in networks your using and routes, etc.

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.8, 24.11

          1 Reply Last reply Reply Quote 0
          • F
            feilongwudi2088
            last edited by

            @Derelict:

            Setting a GATEWAY on a DNS server in System > General creates a host route for that IP address out that - and only that - interface.

            Perhaps that is making it appear to be behaving in an unexpected manner.

            Hello, thanks for reply. pfsense has Internet access now. Surely, it has a gateway. As I said in the description, they are able to ping to 8.8.8.8 or resolve Google.com when the hop is not more than 1. The other routers have set up the default route to pfsense.

            1 Reply Last reply Reply Quote 0
            • F
              feilongwudi2088
              last edited by

              @johnpoz:

              Dude if you have downstream routers you have to configure them or no they will not be able to get out to the internet.  What is the connection of these downstream routers to pfsense, are you doing natting are they on a transit?

              Router A – Router B --- pfsense

              This gives no information at all to try and help you... Draw up your network and put in networks your using and routes, etc.

              Hello, thanks for reply. pfsense has Internet access now. Surely, it has a gateway. As I said in the description, they are able to ping to 8.8.8.8 or resolve Google.com when the hop is not more than 1. The other routers have set up the default route to pfsense.

              Okay, actually, there is an ASA after pfsense like

              other router –> pfsense --> ASA ---> Internet

              There is no NAT between pfsense and ASA. In addition, other routers, pfsense, ASA are configured using OSPF for routing.

              1 Reply Last reply Reply Quote 0
              • johnpozJ
                johnpoz LAYER 8 Global Moderator
                last edited by

                Dude you could have 30 "hops" if you wanted…

                But you have to have it setup and working..

                Can your downstream client ping pfsense IP?

                "The other routers have set up the default route to pfsense. "

                Your downstream router A in your ascii art default gateway sure and the F would not be pfsense..

                What are the networks involved in all your different hops?  So all your downstream routers are connected via transit networks?  With their client networks hanging off them.. Or do you have a natting nightmare going upstream?  With possible overlaps of your networks, etc.

                Draw up this up or nobody is going to be able to help you find were your problem is.  Unbound or pfsense doesn't give 2 shits how many hops away you are..

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.8, 24.11

                1 Reply Last reply Reply Quote 0
                • DerelictD
                  Derelict LAYER 8 Netgate
                  last edited by

                  I was referring to setting a GATEWAY on the DNS SERVER configured in SYSTEM > GENERAL exactly as I stated.

                  This has nothing to do with the default gateway the firewall might have for general routing. In fact, it overrides this for THAT DNS SERVER ADDRESS.

                  ![Screen Shot 2018-05-05 at 10.06.41 AM.png_thumb](/public/imported_attachments/1/Screen Shot 2018-05-05 at 10.06.41 AM.png_thumb)
                  ![Screen Shot 2018-05-05 at 10.06.41 AM.png](/public/imported_attachments/1/Screen Shot 2018-05-05 at 10.06.41 AM.png)

                  Chattanooga, Tennessee, USA
                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                  1 Reply Last reply Reply Quote 0
                  • First post
                    Last post
                  Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.