Unable to get DNS on VLAN working



  • Unable to get DNS on VLANs to work :

    I am having real issues with getting DNS to work on VLANS. I have attached a doc that shows the config I have:

    Diagnosis:

    • Configured mac for direct connection to LAN with DHCP - DNS works

    • Setup with VLAN VSLOOKUP does not work however I am able to ping 9.9.9.9 which suggests to me that DNS on VLAN is not working

    • Checked that I can do DNS lookup under diagnostics it works

    • Tried various Firewall rules

    • Have setup DNS resolver

    As mentioned the topology and screenshots are attached. Would very much appreciate some advice.

    Regards,

    Mike[0_1544708681553_DNS Error.pptx](Uploading 75%)


  • LAYER 8 Global Moderator

    There is nothing attached... and really a pptx?

    Mike[0_1544708681553_DNS Error.pptx](Uploading 75%)
    

    Out of the box unbound will listen on all interfaces.. Out of the box it will auto create ACL for your networks.. Out of the box a vlan interface will have NO rules so you would have to allow access to dns on that vlan to pfsense vlan address.

    Post up your images as images, and not some power point and will be happy to help you figure out where you went wrong.

    I am able to ping 9.9.9.9 which suggests to me that DNS on VLAN is not working

    Huh?? That just makes no sense at all!! Pinging 9.9.9.9 has ZERO to do with dns at all..



  • John,

    attached are some images of the network and screenshots. Rules have been created on VLAN.

    Regards and thanks,

    1_1544711531343_Screenshot 2.png 0_1544711531342_Screenshot 1.png 0_1544711545188_Network.png


  • LAYER 8 Global Moderator

    dude post up something can actually SEE!!!

    Can not make any of those out...

    How is anyone suppose to be able to make those out?

    0_1544712132647_viewthis.png







  • Disable your first and second rule.
    Save. Apply.
    DNS goes through ?

    edit : Probably not related : What are your intentions with the "Custom Options" on the DNS General Settings page ?



  • @gertjan

    Ok this did not work. I can ping 9.9.9.9 and 1.1.1.1 but cannot do name resolution (NSLOOKUP does not work). Directly connected avoiding VLAN, all works.


  • LAYER 8 Global Moderator

    Nslookup doesn't work where? You have setup tls forwarding. Can pfsense resolve using that - test with dns lookup under diagnostics..

    Can your client talk to pfsense even for dns... do a simple query for say pfsense own name.. Does that resolve?



  • @mikeelawson said in Unable to get DNS on VLAN working:

    @gertjan

    Ok this did not work. I can ping 9.9.9.9 and 1.1.1.1 but cannot do name resolution (NSLOOKUP does not work). Directly connected avoiding VLAN, all works.

    Make your third rule a "pass-all". Change the source "VLAN30 net" for "any" or "*".
    Now your firewall is transparent for everything as long as it is "IPv4".

    Rule 1 and 2 are disabled, right ??

    It should work.

    If not, the issue is : your VLAN settings (pfsense and/or your switch).

    Btw : easy to check if unbound is listening on the "VLAN30" network.

    sockstat -4 -l | grep "53"
    

    I check my interface "192.168.2.1" (my OPT1 interface) :

    dig @192.168.2.1 microsoft.com +short
    40.112.72.205
    40.113.200.201
    104.215.148.63
    13.77.161.179
    40.76.4.15
    

    dig will hit 192.168.2.1 using port 53.



  • @johnpoz

    John,

    NSLOOKUP does not work under VLAN30 but does work under direct connection to LAN

    I setup TLS forwarding so that I can secure my DNS comms with providers

    DNS lookup under diagnostics works (see attached) 0_1544720752504_DNS Lookup.png

    Did a simple query to Pfsense on Corporate LAN worked, under VLAN30 failed



  • 0_1544721714020_Ping 2.png @gertjan

    I did this on VLAN30 and didn't work I am dirrectly connecting my Mac onto VLAN30 before I connect to USG switch to test everything works ![0_1544721303922_Ping 2.png](Uploading 0%)


  • LAYER 8 Global Moderator

    Well as already asked did you dick with your ACLs for unbound.. Did you validate its actually listening on your vlan30 interface?

    Do you have any rules floating rules that would be blocking or any port forwards to redirect dns?

    If unbound is listening on the interface, and you all it on firewall rules.. If unbound doesn't allow you to query then you would get a REFUSED... But since you used the +short can not be sure what the actual details are.

    BTW: 3.5ms is a pretty shitty local network ping response..

    user@uc:~$ ping 192.168.2.253
    PING 192.168.2.253 (192.168.2.253) 56(84) bytes of data.
    64 bytes from 192.168.2.253: icmp_seq=1 ttl=64 time=0.836 ms
    64 bytes from 192.168.2.253: icmp_seq=2 ttl=64 time=0.332 ms
    64 bytes from 192.168.2.253: icmp_seq=3 ttl=64 time=0.304 ms
    64 bytes from 192.168.2.253: icmp_seq=4 ttl=64 time=0.343 ms
    64 bytes from 192.168.2.253: icmp_seq=5 ttl=64 time=0.328 ms
    64 bytes from 192.168.2.253: icmp_seq=6 ttl=64 time=0.364 ms
    64 bytes from 192.168.2.253: icmp_seq=7 ttl=64 time=0.330 ms
    ^C
    --- 192.168.2.253 ping statistics ---
    7 packets transmitted, 7 received, 0% packet loss, time 6000ms
    rtt min/avg/max/mdev = 0.304/0.405/0.836/0.177 ms
    user@uc:~$ 
    

    That is a VM on one of my vlans, ping pfsense..

    And your 2nd upload didn't work!

    ![0_1544721303922_Ping 2.png](Uploading 0%)
    


  • @johnpoz

    John,

    Found it, the original config was correct, had a firewall on the Mac that was preventing this. My apologies for taking up your time on this matter. As soon as this was disabled all worked.

    Regards,

    Mike


Log in to reply