Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Unable to resolve certain sites DNS Resolver

    Scheduled Pinned Locked Moved DHCP and DNS
    29 Posts 3 Posters 2.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • B
      bigraz1968
      last edited by

      Has anyone seen this issue? I set 5 machines on my LAN for DHCP static registration. I did that to allow those IP's to route around the VPN. This was working fine for months, no issues All of a sudden, some sites were not able to resolve any longer, The site would just timeout. I deleted the DHCP registrations, deleted the ARP cache and restarted the DHCP service. Each device picked up a new IP but is still unable to resolve certain sites, request just times out. On my DMZ using the DNS Resolver, all sites resolve just fine.

      I have no idea what to try next Any suggestions. This has me stumped.I stopped pfblocker and Sqiud.

      My setup:

      pfsense 2.3.4_1
      pfblocker
      Sqiud
      Squidgard
      ntop

      Thanks

      RandY

      GertjanG 1 Reply Last reply Reply Quote 0
      • GertjanG
        Gertjan @bigraz1968
        last edited by Gertjan

        @bigraz1968 said in Unable to resolve certain sites DNS Resolver:

        some sites were not able to resolve any longer

        This somewhat confirms that your LAN is working fine.
        It confirms that your machines have an local IP, a gateway, and a DNS.
        So no need to look at DHCP server settings.
        You could even ask to your machines if everything is ok. Like releasing the IP info, renew and check.

        What happens if you enter console mode, option 8 and test DNS from there ?
        Like

        dig facebook.com
        

        or, if you want to see everything :

        dig facebook.com +trace
        

        (can also be done from GUI I think)

        This :
        @bigraz1968 said in Unable to resolve certain sites DNS Resolver:

        On my DMZ using the DNS Resolver, all sites resolve just fine.

        is important info.
        Compare firewall rules on both interfaces, LAN and DMZ.
        Do you filter any DNS traffic on LAN ? (show us your rules for LAN and DMZ please).

        Of course, if your

        @bigraz1968 said in Unable to resolve certain sites DNS Resolver:

        some sites

        became "pfblocker-listed" then everything is quiet normal : pfSense does what you are asking for ;)

        No "help me" PM's please. Use the forum, the community will thank you.
        Edit : and where are the logs ??

        1 Reply Last reply Reply Quote 1
        • B
          bigraz1968
          last edited by

          Gertjan Thanks for you response.

          The other machines on the LAN work fine. The issue only occurs on the machines that were assigned a DHCP reservation. My machines in the DMZ resolve the same sites just fine. Other machines on the LAN resolve just fine. Only machines in that were assigned a static reservation has the issue.

          I don't filter DNS. I do route all my traffic thru a VPN.

          Randy

          GertjanG 1 Reply Last reply Reply Quote 0
          • GertjanG
            Gertjan @bigraz1968
            last edited by

            @bigraz1968 said in Unable to resolve certain sites DNS Resolver:

            The other machines on the LAN work fine

            Compare IP config on working and not working machines and you'll find the answer.

            No "help me" PM's please. Use the forum, the community will thank you.
            Edit : and where are the logs ??

            1 Reply Last reply Reply Quote 1
            • B
              bigraz1968
              last edited by

              I did all that. All of the clients on the LAN are getting their IP configuration from the same DHCP server.

              Thanks

              Randy

              1 Reply Last reply Reply Quote 0
              • GertjanG
                Gertjan
                last edited by

                IP ok, but DNS ? Gateway ?

                No "help me" PM's please. Use the forum, the community will thank you.
                Edit : and where are the logs ??

                1 Reply Last reply Reply Quote 0
                • B
                  bigraz1968
                  last edited by

                  I checked and all the same.

                  johnpozJ 1 Reply Last reply Reply Quote 0
                  • johnpozJ
                    johnpoz LAYER 8 Global Moderator @bigraz1968
                    last edited by

                    So your saying something resolve for this client and other things do not - or dns is not not working at all?

                    What error do you get when you do a dig or nslookup?

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                    1 Reply Last reply Reply Quote 0
                    • B
                      bigraz1968
                      last edited by

                      It seems like the firewall is holding some stale information somewhere and rebooting isn't fixing the issue.

                      1 Reply Last reply Reply Quote 0
                      • B
                        bigraz1968
                        last edited by

                        Hi John

                        The two clients are my TV's have the issue My Netflix smart app. doesn't work I get the message 'Unable to connect' I use the builtin browser to load Netflix and Netflix still doesn't load. Other sites will load. Sharp TV support worked on the issue and finally said the problem is my router.

                        I hookup my Chromebook and Netflix.com doesn't load. It just says 'Waiting on cache' an then it stops loading

                        I hookup another laptop and that laptop loads Netflix without issue.

                        The common denominator is machines that had a static DHCP reservation don't work, but machines not assigned statically have no issues

                        1 Reply Last reply Reply Quote 0
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator
                          last edited by johnpoz

                          doesn't answer the question.. What happens when you query - and does it happen for all things or just some sites?

                          Lets see an example dig or nslookup query (dig is BETTER) from client that works, and from client that doesn't work.

                          edit: Well what are you doing different in your static reservation? You know you can point to different dns.. Or you could have different rules, etc.

                          Simple solution would be to sniff on pfsense to see exactly what the client is trying to do, etc. Netflix apps can be hard coded to try and query say google dns.

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                          1 Reply Last reply Reply Quote 0
                          • B
                            bigraz1968
                            last edited by

                            DNS is working. Just a couple frequent sites I use will not resolve. I picked Netflix because in my house it is used frequently. I can do a working client but unable to perform dig on a broken client. I am at work.

                            1 Reply Last reply Reply Quote 0
                            • B
                              bigraz1968
                              last edited by

                              Nslookup query from working machine

                              C:\Users\rdevone-desktop>nslookup netflix.com
                              Server: pfSense.localdomain
                              Address: 192.168.1.1

                              Non-authoritative answer:
                              Name: netflix.com
                              Address: 45.76.252.24

                              1 Reply Last reply Reply Quote 0
                              • johnpozJ
                                johnpoz LAYER 8 Global Moderator
                                last edited by johnpoz

                                ok well that is a cached response from 192.168.1.1 (assume pfsense IP since it resolve to pfsense.localdomain)... so lets see something broken when you get home..

                                I take it you did not mess with the the unbound views and acls..

                                An intelligent man is sometimes forced to be drunk to spend time with his fools
                                If you get confused: Listen to the Music Play
                                Please don't Chat/PM me for help, unless mod related
                                SG-4860 24.11 | Lab VMs 2.8, 24.11

                                1 Reply Last reply Reply Quote 1
                                • B
                                  bigraz1968
                                  last edited by

                                  I take it you did not mess with the the unbound views and acls.. No I don't know what that is. I haven't made any changes at all.

                                  You always have been so helpful. I really appreciate your help. My family is going to kill me if I don't get this fixed soon.

                                  Thanks

                                  Randy

                                  1 Reply Last reply Reply Quote 0
                                  • B
                                    bigraz1968
                                    last edited by

                                    Johnpoz;

                                    I did a dig on one of the clients that is having a issue and the dig command completes successfully as it did on a client that has no issue.

                                    Thanks

                                    Randy

                                    1 Reply Last reply Reply Quote 0
                                    • B
                                      bigraz1968
                                      last edited by

                                      Johnpoz;

                                      I made a mistake. I did the dig with the wrong DNS server. I switched the DNS to my resolver and I get 'connection timed out, no servers can be reached'.

                                      Thanks

                                      Randy

                                      1 Reply Last reply Reply Quote 0
                                      • johnpozJ
                                        johnpoz LAYER 8 Global Moderator
                                        last edited by

                                        so you can not get any sort of answer from pfsense? From this client? Or you saying that certain looks fail?

                                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                                        If you get confused: Listen to the Music Play
                                        Please don't Chat/PM me for help, unless mod related
                                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                                        1 Reply Last reply Reply Quote 0
                                        • B
                                          bigraz1968
                                          last edited by

                                          Correct. for Netflix.com Most sites do resolve. If I switch to a client in my DMZ. Netflix resolves successfully. DMZ uses the resolver as well.

                                          1 Reply Last reply Reply Quote 0
                                          • johnpozJ
                                            johnpoz LAYER 8 Global Moderator
                                            last edited by

                                            Here is the thing the resolve doesn't care what network your on local - if you can talk to it, then it the same no matter what local network your on.. UNLESS you have messed with the acls or created views.

                                            What are your firewall rules on this interface?

                                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                                            If you get confused: Listen to the Music Play
                                            Please don't Chat/PM me for help, unless mod related
                                            SG-4860 24.11 | Lab VMs 2.8, 24.11

                                            GertjanG 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.