Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    DNS Lookups failing

    Scheduled Pinned Locked Moved DHCP and DNS
    16 Posts 4 Posters 592 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • P
      pmrozik
      last edited by

      Hello All,

      I am trying to figure out why DNS lookups are failing as I was trying to configure OpenDNS to be the default server.

      Here's a screenshot from the diagnostics screen:

      dnsdiagnostics.JPG

      It looks like anything but 8.8.8.8 gives no response, even 8.8.4.4.

      Any ideas as to why this may be happening?

      Thanks in advance.

      1 Reply Last reply Reply Quote 0
      • GertjanG
        Gertjan
        last edited by

        @pmrozik said in DNS Lookups failing:

        Any ideas as to why this may be happening?

        Dono.

        When I use 8.8.8.8 and 8.8.4.4 it worked right away :

        ec090e2e-42f4-47f2-a513-c06f17fdd8e2-image.png

        I didn't create a OpenDNS account needed to activate their DNS.

        I had to activate these :

        71d57567-57a9-4d4d-b13c-5437dcc54a39-image.png

        I advise you to use the default Resolver mode - I'm using it for yerars now, and works very well.
        Bonus : no need to mess up with DNS, no need to set what so ever.
        (I never use the forwarding mode).

        No "help me" PM's please. Use the forum, the community will thank you.
        Edit : and where are the logs ??

        1 Reply Last reply Reply Quote 0
        • P
          pmrozik
          last edited by

          I am using 2.4.4-RELEASE (amd64) and it is already in Resolver mode as you suggest. Initially I thought it was an issue with OpenDNS after having gone through this guide: https://disloops.com/opendns-on-pfsense/

          Then I tried another DNS provider, and as you can see, even 8.8.4.4 isn't working.

          It looks like I will most likely have to go through a reinstall, especially since I've discovered a whole other issue with the package installer.

          Thanks a lot for your input Gertjan.

          1 Reply Last reply Reply Quote 0
          • johnpozJ
            johnpoz LAYER 8 Global Moderator
            last edited by johnpoz

            Not sure why you think if your using unbound in resolver mode any of that makes any matter.. If your using unbound as resolver then what dns you have setup in general has zero to do with anything.. Other than what pfsense would use to lookup something..

            If using resolver, then the only thing pfsense should point to for dns is itself (127.0.0.1)

            I am thinking you don't actually understand what a resolver is, and how it differs from forwarding mode?

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.8, 24.11

            1 Reply Last reply Reply Quote 0
            • P
              pmrozik
              last edited by

              Thanks for the reply @johnpoz . I am definitely not an expert, but I need Unbound in Forwarding Mode as I would like to use OpenDNS filters.

              "Enable Forwarding Mode: Controls whether Unbound will query root servers directly (unchecked, disabled) or if queries will be forwarded to the upstream DNS servers defined under System > General or those obtained by DHCP/PPPoE/etc (checked, enabled)."
              Source: https://docs.netgate.com/pfsense/en/latest/dns/unbound-dns-resolver.html

              I am getting around the whole issue by assigning OpenDNS as the default DNS server via DHCP, but there is an issue with resolving on the box as well as with the repository itself:

              tempsnip.jpg

              I think a reinstall is probably the best solution as I've had no luck with this guide:
              https://docs.netgate.com/pfsense/en/latest/packages/fixing-a-broken-pkg-database.html

              1 Reply Last reply Reply Quote 0
              • johnpozJ
                johnpoz LAYER 8 Global Moderator
                last edited by

                You sure its a database issue or a resolving issue? Looks to be a dns related problem.

                it is already in Resolver mode as you suggest.

                Then its not forwarding..

                but I need Unbound in Forwarding Mode

                Which is it?? You can not do both!!

                Well kind of you can ;) You could have a domain override that forwards for specific domains.

                I you want to use "forwarding mode" you have 2 choices - use resolver in "forwarding mode" or use dnsmasq - ie the forwarder and not unbound.

                dnsmasq has an advantage if forwarding in that it can forward to ALL your listed NS, and use the fastest reply.

                Eitherway no matter what mode you use - pfsense should really only point to itself for dns..So it can resolve and host overrides you put in place.. And use the cache..

                Why don't you paste up exactly what you have configured and we can work out your issue.

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.8, 24.11

                P 1 Reply Last reply Reply Quote 0
                • GertjanG
                  Gertjan
                  last edited by Gertjan

                  I didn't do a lot of research - reading the OpenDNS doc, but right now I'm not sure if OpenDNS supports "DNS over TLS".
                  See here : last message https://support.opendns.com/hc/en-us/community/posts/115019265903-DNS-over-TLS.
                  So be careful about TLS here.

                  I just threw in

                  95bf0cb5-3a57-49c5-a3d9-662c4a427bc5-image.png

                  and activated Unbound's Forwarding mode, like this :

                  c15ac4ba-c31b-4043-95dc-01932b69b4b9-image.png

                  The rest was Ok direct :

                  cd67b643-ce64-4675-97d3-e30cf2bebaa6-image.png

                  Note : I did not test with TLS !! Just plain DNS forwarding.

                  It took me 30 seconds to set it up ....

                  Btw : Of course, I have a OpenDNS account setup correctly, and running - They have my WAN IP, so they will accept my DNS, and answer.


                  This morning I tested Google "gimeyourdata!!" DNS servers, worked also just fine.

                  It's time you tell use what you did wrong, so we can tell you what you did wrong.
                  This ought to work.

                  edit
                  @pmrozik said in DNS Lookups failing:

                  well as with the repository itself:

                  Oh, even pfSense itself has no DNS any more.

                  That's normal : as soon a people start typing 8.8.8.8 they have this right afterwards :

                  45414331-7100-41c6-a3f6-2d0f16de7488-image.png

                  Google should use another IPv4 like 6.6.6.6, it's far more appropriate.
                  .... Hummm : I do understand know the 8.8.4.4 ...

                  No "help me" PM's please. Use the forum, the community will thank you.
                  Edit : and where are the logs ??

                  1 Reply Last reply Reply Quote 0
                  • P
                    pmrozik @johnpoz
                    last edited by

                    @johnpoz

                    After reading your post I turned on dnsmasq with these the following settings:

                    dnsmasq.JPG

                    Still not resolving:

                    dnslookup.JPG

                    I then turned off the forwarder and tried unbound with the following settings:

                    unbound.JPG

                    Still broken.

                    @Gertjan I think that it was perhaps being used as a toaster? NextGen Toaster with an IP address?

                    1 Reply Last reply Reply Quote 0
                    • johnpozJ
                      johnpoz LAYER 8 Global Moderator
                      last edited by

                      So can you directly query these other ns with say dig or nslookup? What does the LOG say when you ask pfsense something..

                      Maybe your isp only allows access to 8.8.8.8

                      Do a simple query from a client to 8.8.4.4

                      $ dig @8.8.4.4 www.google.com                                                   
                                                                                                      
                      ; <<>> DiG 9.14.2 <<>> @8.8.4.4 www.google.com                                  
                      ; (1 server found)                                                              
                      ;; global options: +cmd                                                         
                      ;; Got answer:                                                                  
                      ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 64095                       
                      ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1            
                                                                                                      
                      ;; OPT PSEUDOSECTION:                                                           
                      ; EDNS: version: 0, flags:; udp: 512                                            
                      ;; QUESTION SECTION:                                                            
                      ;www.google.com.                        IN      A                               
                                                                                                      
                      ;; ANSWER SECTION:                                                              
                      www.google.com.         237     IN      A       172.217.9.68                    
                                                                                                      
                      ;; Query time: 14 msec                                                          
                      ;; SERVER: 8.8.4.4#53(8.8.4.4)                                                  
                      ;; WHEN: Wed Jun 05 05:42:48 Central Daylight Time 2019                         
                      ;; MSG SIZE  rcvd: 59                                                           
                      

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                      1 Reply Last reply Reply Quote 0
                      • GertjanG
                        Gertjan
                        last edited by

                        Just to motivate you :

                        Using a fresh install, adding 8.8.8.8 and 8.8.4.4 and activate Forwarding in the Resolver (or use the Forwarder) works direct.
                        Same thing for OpenDNS - but you need an account, otherwise they will refuse DNS requests coming from you.

                        I can't tell you from here how you managed to 'break' things ...

                        Btw : asking for DNSSEC and forwarding .... that's probably a no-go and makes no sense.
                        Compare your unbound settings with my unbound settings.

                        No "help me" PM's please. Use the forum, the community will thank you.
                        Edit : and where are the logs ??

                        1 Reply Last reply Reply Quote 1
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator
                          last edited by

                          @Gertjan said in DNS Lookups failing:

                          Btw : asking for DNSSEC and forwarding .

                          Yeah while its borked to do that.. It wouldn't stop the queries.. It just is pointless and doesn't get you anything at all..

                          For dnssec to work, you either resolve yourself... Or you forward to a resolver doing it, and if that is the case no reason to ask for it.. It going to do it for you either way..

                          Using forwarder, and asking for dnssec is just pointless, extra dns traffic for no reason.

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                          1 Reply Last reply Reply Quote 1
                          • B
                            bcruze
                            last edited by

                            who is the ISP. and is there network equipment in front of the pfsense router?

                            GertjanG 1 Reply Last reply Reply Quote 0
                            • GertjanG
                              Gertjan @bcruze
                              last edited by

                              @bcruze said in DNS Lookups failing:

                              who is the ISP. and is there network equipment in front of the pfsense router?

                              Like a router upstream that accepts only DNS requests with it's LAN IP as destination, and no one else ? Yeah, might be possible - there are people doing the same thing with pfSEnse.

                              But I guess @pmrozik administers this upstream router device as well - so, ... he would (should !?) know that.
                              IF an up stream router exists ...

                              No "help me" PM's please. Use the forum, the community will thank you.
                              Edit : and where are the logs ??

                              1 Reply Last reply Reply Quote 0
                              • johnpozJ
                                johnpoz LAYER 8 Global Moderator
                                last edited by

                                The first thing I would do is validate he can actually query 8.8.4.4 or not.. This is simple enough to do via dig or nslookup from any client..

                                If does not get an answer - then sniff on pfsense wan and validate the query did go upstream with his public IP as source, and no answer came back, etc.

                                An intelligent man is sometimes forced to be drunk to spend time with his fools
                                If you get confused: Listen to the Music Play
                                Please don't Chat/PM me for help, unless mod related
                                SG-4860 24.11 | Lab VMs 2.8, 24.11

                                1 Reply Last reply Reply Quote 0
                                • GertjanG
                                  Gertjan
                                  last edited by

                                  I just did that :

                                  dig @8.8.4.4 test-domaine.fr ANY +short
                                  

                                  The answer came back .... and was not short.
                                  8.8.4.4 is in business today, that's for sure.

                                  No "help me" PM's please. Use the forum, the community will thank you.
                                  Edit : and where are the logs ??

                                  1 Reply Last reply Reply Quote 0
                                  • johnpozJ
                                    johnpoz LAYER 8 Global Moderator
                                    last edited by

                                    Any is deprecated and really shouldn't be used any more. Many a site will not respond when asked for that.

                                    But yeah I would think something really major would have to be going on for them not to be working.. Its an anycast address so even if one region of the world was down you should get an answer from another location, etc.

                                    We really need some useful info from the OP if he wants our help.

                                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                                    If you get confused: Listen to the Music Play
                                    Please don't Chat/PM me for help, unless mod related
                                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                                    1 Reply Last reply Reply Quote 0
                                    • First post
                                      Last post
                                    Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.