Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    DNS query to WAN port doesn't resolve against DNS Resolver

    Scheduled Pinned Locked Moved DHCP and DNS
    4 Posts 2 Posters 572 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • S
      shaker242
      last edited by

      I hope this isn't going to be too confusing… here we go :)

      I have a pfsense micro-server installed between various lans, it's use to segment off a couple lab environments. I have a working DNS Resolver installed and configured which properly resolves queries from the LAN and OPT1 interfaces. If I try to query against the WAN side, the DNS is refused. Since this is a lab within labs, every interface is wide open. Maybe this will help...

      WAN_IP=192.168.1.254
      LAN_IP=172.16.1.1
      OPT1_IP=172.16.10.1

      Within the 192 network, it's gateway is 192.168.1.1 with a static route to 192.168.1.254 for networks 172.16.1/10.

      Inside the LAN 172 network, I can test dns like so...

      shaker@replica2:~$ dig @172.16.1.1 ucp1.domain.ee

      ; <<>> DiG 9.10.3-P4-Ubuntu <<>> @172.16.1.1 ucp1.domain.ee
      ; (1 server found)
      ;; global options: +cmd
      ;; Got answer:
      ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 43613
      ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

      ;; OPT PSEUDOSECTION:
      ; EDNS: version: 0, flags:; udp: 4096
      ;; QUESTION SECTION:
      ;ucp1.domain.ee. IN A

      ;; ANSWER SECTION:
      ucp1.domain.ee. 3600 IN A 172.16.1.101

      ;; Query time: 0 msec
      ;; SERVER: 172.16.1.1#53(172.16.1.1)
      ;; WHEN: Fri May 18 20:42:36 EDT 2018
      ;; MSG SIZE  rcvd: 59

      Now let's test against the WAN side...

      DevMac2:~ $ dig @192.168.1.254 ucp1.domain.ee

      ; <<>> DiG 9.10.6 <<>> @192.168.1.254 ucp1.domain.ee
      ; (1 server found)
      ;; global options: +cmd
      ;; Got answer:
      ;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 16265
      ;; flags: qr rd ad; QUERY: 0, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
      ;; WARNING: recursion requested but not available

      ;; Query time: 37 msec
      ;; SERVER: 192.168.1.254#53(192.168.1.254)
      ;; WHEN: Fri May 18 20:44:40 EDT 2018
      ;; MSG SIZE  rcvd: 12

      Thoughts?

      fwrules_wan.png
      fwrules_wan.png_thumb
      DNS_Resolver__General_Settings.png
      DNS_Resolver__General_Settings.png_thumb

      1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator
        last edited by

        And your ACL settings in unbound are what exactly?  See the ACL tab..

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.8, 24.11

        1 Reply Last reply Reply Quote 0
        • S
          shaker242
          last edited by

          I left the access list empty, but your question prompted me to review the doc https://doc.pfsense.org/index.php/Unbound_DNS_Resolver and apparently, in some cases you do have to explicitly permit access by various networks. I then created a access list for the 192 network and tested it. Appears to have resolved the issue. Appreciate the tip!

          1 Reply Last reply Reply Quote 0
          • johnpozJ
            johnpoz LAYER 8 Global Moderator
            last edited by

            Unless you disable all auto added ACLs, only internal interface networks are added.  So yeah on a wan interface you would need to add the acl to allow query.

            By default, IPv4 and IPv6 networks residing on internal interfaces of this system are permitted. Allowed networks must be manually configured on the Access Lists tab if the auto-added entries are disabled."

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.8, 24.11

            1 Reply Last reply Reply Quote 0
            • First post
              Last post
            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.