Rule not working with FQDN because it's not being resolved - Table empty

stephenw10

There was a bug in a very very old version of pfSense that prevented using IPs and FQDNs in the same alias. I still have mine separated as a result.
I don't imagine you're running that but just in case what pfSense version are you running?

Steve

bmeeks

There is also an open bug report on the filterdns service stalling for some users. According to reports, when this happens the alias tables are left empty for the addresses being resolved by filterdns. Here is a link to the bug report: filterdns stops working on a regular basis.

This service is used to resolve FQDN aliases to their actual IP address.

mateusscheper

Hey again @johnpoz, thank you for replying.

I have DNS Resolver enabled and DNS Forwarder disabled.
Where do we see when it resolves an FQDN? Status > System logs > DNS Resolver?
I went there and I only see info and notice lines.

DNS Resolver is enabled, set to all interfaces, no custom options.
In System > General Setup I have 1.1.1.1 and 8.8.8.8 set to gateway none. I had it set to my default gateway too, but it wasn't working anyway.

I have several IPs and FQDNs in a single ALIAS. It always worked OK.
How can I check filterdns?

I see an error in Status > System Logs > System:

/services_unbound.php: The command '/usr/sbin/arp -s 'firewall_lan_ip' 'mac_ip'' returned exit code '1', the output was 'arp: writing to routing socket: Operation not permitted'

Not sure what happened, but now I rebooted and it works OK.

My pfSense is 2.4.3.

stephenw10

If you go to Status > Filter reload and hit the reload button and then check the DNS Recolver logs you will see all the filterdns entries for your FQDNs. Anything with a problem should show there or in the system log.

Steve

mateusscheper

Okay, it's happening again.

/services_dnsmasq.php: The command '/usr/sbin/arp -s 'firewall_lan_ip' 'mac_ip'' returned exit code '1', the output was 'arp: writing to routing socket: Operation not permitted'

stephenw10

Hmm, OK that's the actual LAN interface MAC and IP?

Do you have that defined somewhere? Static ARP entries?
I would search the config for the MAC top be sure it isn't defined there unexpectedly.

It looks like it's denied because that is an interface on the firewall itself.

Steve

mateusscheper

@stephenw10 I had it in my DHCP Server as a static entry. I removed a few hours ago but it's still refusing to update my tables.

stephenw10

Are you still seeing that error? You might have a process still running trying to update it.

I assume you didn't see any filterdns errors in the DNS log when you ran the Filter Reload?
Did you see entries for the FQDNs that are not loading?

Steve

mateusscheper

@stephenw10 I don't see any errors anymore, but still not updating my tables.
Strangely, I have an ALIAS with one particular FQDN that it is working (this FQDN is on the same ALIAS I'm having trouble with). I'm not sure if it resolved the IP before this issue though.

stephenw10

What I expect to see is all the FQDNs you have being resolved in the DNS log when you reload the filter.
If you see nothing there that's a problem.
If you see some and then an error that's a problem.
Of you see them all resolved there and they still don't make it into the tables that's a different problem.

Steve