DNS Resolver Host Override not working

johnpoz · Jan 29, 2019, 12:08 PM

@l0rdraiden said in DNS Resolver Host Override not working:

But when I use forwarding to a server like 1.1.1.1 DNSSEC works.

If where you forward to does dnssec - then yeah you get dnssec, you don't have to have it checked.. The resolver is what does dnssec.. You asking for it or not asking for it has nothing to do with it the resolver does it or not.

l0rdraiden · Jan 29, 2019, 12:09 PM

@johnpoz

But do you know why the host override works for a while and then stops working?

johnpoz · Jan 29, 2019, 3:16 PM

Not off the top... Trying to figure out what that error is you posted. That is pfsense trying to get something with nginx?

Do you have pfsense pointing to anything other than localhost for dns?

In your system widget what does it show for dns?

l0rdraiden · Jan 29, 2019, 3:16 PM

@johnpoz

Yes but I don't know what is trying to get
No, DNS general settings is empty and the DNS in the clients is the pfsense IP
enable up and running.

BTW I have disable pfblockerng and now it works fine... so I guess is some kind of incompatibility. I will try to report it to see if I get the dev to read this thread.

Gertjan · Jan 29, 2019, 10:34 PM

@johnpoz said in DNS Resolver Host Override not working:

That is pfsense trying to get something with nginx?

Yeah, what is this :

@l0rdraiden said in DNS Resolver Host Override not working:

...... open() "/usr/local/www/index.php/204" failed (20: Not a directory), client: 192.168.1.30, server: , request: "GET /index.php/204 HTTP/1.1", host: "ne*********.duckdns.org"
.... open() "/usr/local/www/ocs/v1.php/cloud/user" failed (2: No such file or directory), client: 192.168.1.30, server: , request: "GET /ocs/v1.php/cloud/user?format=json HTTP/1.1", host: "tc***s.duckdns.org"

/index.php/204 => this doesn't exists on pfSense (the web server / files ).
//ocs/v1.php/cloud/user => same thing.

Just the browser who 'thinks' it's connected to some site, but redirected to the pfSense webroot, and obtaining a "non - not here".

johnpoz · Jan 30, 2019, 9:55 PM

@Gertjan you think that is something to do with his host override trying to ask pfsense for something... I can not really tell what that error is without more context.

Gertjan · Jan 30, 2019, 9:38 PM

Realy, .... dono.

I guess @l0rdraiden want to reach a local server (coming from local), the server he exposes on the Internet using a duckdns.org DDNS domain name.
Local host overrides always worked for me, using the default Resolver.

johnpoz · Jan 30, 2019, 9:40 PM

yup zero issue with them.. But I don't see how an error on pfsense for nginx has anything to do with unbound?

Gertjan · Jan 30, 2019, 9:45 PM

IMHO, the errors are cached URL's in a browser, that thinks it's connected to a webserer (dsame URL) but it is connected to the GUI (or portal web server).
It's hitting the server (nginx) with the stored URL's and nginx is complaining about it.
I see this all the time on my own web servers : the most strange page requests are popping up - and errored out by the web server.

RonpfS · Jan 30, 2019, 9:55 PM

@johnpoz said in DNS Resolver Host Override not working:

@Gertjan you think that is something to do with his host override trying to ask pfsense for something... I can not really tell what that error is without more context.

He disabled Resolver Live Sync in DNSBL and it seems to work fine for now.

Gertjan · Jan 30, 2019, 10:00 PM

@ronpfs said in DNS Resolver Host Override not working:

Resolver Live Sync

I read about this (new ?) option. Not finding much btw.
unbound man pages do not mention them.

Isn't it a somewhat hidden : "do a restart" ?
As far as I know, bind, for example, places "watches" on files, and read them in on the fly when they changed - without a global restart.

RonpfS · Jan 30, 2019, 10:10 PM

@gertjan
It's basically a bunch of unbound-control cmds to change the local-data and local-zone in unbound live db.
Something the DHCP services could do to register new leases.

But now BBcan177 has implemented a Python module to unbound. .
It's faster, has more functionality and doesn't require GBs of memory for unbound.

Gertjan · Jan 30, 2019, 10:09 PM

Ah, if so, then that looks good.
This should be implement upstream (in pfSense itself).
No more x restarts a minute on big networks, thus no more flushing the DNS cache.

And pfBlockerNG users would be really happy (parsing these mega block files take time every restart).

l0rdraiden · Jan 30, 2019, 10:12 PM

The issue is posted here finally
https://forum.netgate.com/topic/140021/dns-resolver-host-override-not-working/21