Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    DNS forwarder not working on query mode

    Scheduled Pinned Locked Moved DHCP and DNS
    14 Posts 4 Posters 1.3k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • L
      La6er
      last edited by

      Hi, I am trying to set the following scenario, I have configured my pfsense 2.4.4 with DNS forwarder, on general settings I have set internal DNS 172.16.1.63 and secondary 10.16.1.40, I am using static ips on my host using 10.30.251.59 (my pfsense) as DNS server, when I try to do an nslookup on pfsense to host 10.45.33.201 (known by the secondary dns) I received an error... unable to resolve host, however if I set nslookup, server 10.16.1.40 it does resolve... so apperantly my pfsense is only using the first DNS 172.16.1.63 which does not know 10.45.33.201... how can I set my pfsense to ask 10.16.1.40 if the first dns 172.16.1.63 does not know the resolution?

      1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator
        last edited by

        @la6er said in DNS forwarder not working on query mode:

        so apperantly my pfsense is only using the first DNS 172.16.1.63 which does not know 10.45.33.201

        That is WHY you never setup more than 1 DNS, unless your multiple DNS resolve the same stuff. If you want to use specific name server than knows how to resolve host.something.xyz then you would use a domain override to tell pfsense where to go ask for records in something.xyz

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.8, 24.11

        L 1 Reply Last reply Reply Quote 0
        • L
          La6er @johnpoz
          last edited by

          @johnpoz I have used domain override to set 2 different domains .home and .office if I set this 2 entries on domain override it indeed gets me the IP but I cannot resolve ips in reverse... is there a way to do this ?

          1 Reply Last reply Reply Quote 0
          • DerelictD
            Derelict LAYER 8 Netgate
            last edited by

            Yeah. You also have to do a domain override for the in-addr.arpa domain for those addresses.

            Chattanooga, Tennessee, USA
            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
            Do Not Chat For Help! NO_WAN_EGRESS(TM)

            L 1 Reply Last reply Reply Quote 0
            • L
              La6er @Derelict
              last edited by

              @derelict I have set a domain override 10.45.33.in-addr.arpa pointed to DNS 10.45.1.60 but still not working... is this current config correct?

              KOMK 1 Reply Last reply Reply Quote 0
              • KOMK
                KOM @La6er
                last edited by

                @la6er said in DNS forwarder not working on query mode:

                is this current config correct?

                I don't see any config.

                1 Reply Last reply Reply Quote 0
                • L
                  La6er
                  last edited by La6er

                  this is how i have set my domain override at this moment

                  the second entrie is working fine everything x.sduop.net is resolving correctly through 10.45.1.60, however reverse is not working

                  I am currently testing with this host as example

                  n00214wsw7ws102.sduop.net
                  server: pfsense3.geq.net
                  Address: 10.30.251.59

                  Non-authoritative response:
                  name: n00214wsw7ws102.sduop.net
                  Address: 10.45.33.201

                  _______________________________________________-
                  10.45.33.201
                  Servidor: pfsense3.geq.net
                  Address: 10.30.251.59

                  *** pfsense3.geq.net do not find 10.45.33.201: Non-existent domain

                  0_1539179860439_3912ac27-97be-402d-8252-1f3a6cdf2c95-image.png

                  1 Reply Last reply Reply Quote 0
                  • KOMK
                    KOM
                    last edited by

                    @derelict said in DNS forwarder not working on query mode:

                    in-addr.arpa

                    Shouldn't it be 33.45.10.in-addr.arpa?

                    DerelictD 1 Reply Last reply Reply Quote 0
                    • johnpozJ
                      johnpoz LAYER 8 Global Moderator
                      last edited by

                      ^exactly a ptr zone for a network of 10.45.33 would be as KOM stated.. Your way would be for a network 33.45.10

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                      1 Reply Last reply Reply Quote 0
                      • L
                        La6er
                        last edited by

                        Thanks a lot guys !! it is working now as expected ! I really appreciate your help !

                        1 Reply Last reply Reply Quote 0
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator
                          last edited by

                          I would prob adjust your NS you have listed in pfsense - pointing to NS that can not resolve the same stuff is destined for grief..

                          If your going to forward, all the NS you forward to should resolve the same stuff. If your NS can not both resolve the same stuff I would just pick one, and then use overrides for domains a different NS can resolve.

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                          L 1 Reply Last reply Reply Quote 0
                          • L
                            La6er @johnpoz
                            last edited by

                            @johnpoz Thanks a lot, I do have 2 DNS server which resolve different stuff... so I am going with the domain override option and pick 1 as a general DNS on the forwarder

                            1 Reply Last reply Reply Quote 0
                            • DerelictD
                              Derelict LAYER 8 Netgate @KOM
                              last edited by

                              @kom Well, yeah. Just pointing in the right direction.

                              Chattanooga, Tennessee, USA
                              A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                              DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                              Do Not Chat For Help! NO_WAN_EGRESS(TM)

                              KOMK 1 Reply Last reply Reply Quote 0
                              • KOMK
                                KOM @Derelict
                                last edited by

                                @derelict Haha I didn't actually mean to reply to you, but to him. No idea how that happened.

                                1 Reply Last reply Reply Quote 0
                                • First post
                                  Last post
                                Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.