DNS Stops working

[manjotsc]

@Gertjan ok, that's right I have setup pfsense to block any dns server other than 192.168.40.1 on lan side see screenshot, all my lan devices ae set to use pfsense box as DNS server(192.168.40.1). Still I can't figure out the problem. Also I noticed one thing more DNS starts working fine if pfsense or modem is rebooted.

[Gertjan]

Your doing some DNS related things with your firewall rules on LAN - all have a destination port of '53'.

DNS uses UDP and can use TCP.

Your not blocking ICMP - the protocol ping is using - so it will pass using the last, pass all rule for IPv4 stuff.
ICMP does not use the concept of 'ports'.

Ping to 1.1.1.1 should be possible from your LAN.

Thse are my LAN rule :

which is 100 % identical to your rules - I'm not blocking any DNS things. Just a big pass all.
And I also use IPv6 .... (not related to your question).

I can ping 1.1.1.1 just fine.

[manjotsc]

@Gertjan When DNS is working I am able ping 1.1.1.1, but not when DNS stops. It's been months I trying figure this out and I dont have any dns rule on guest, still causes problem.
thanks,

[Gertjan]

@manjotsc said in DNS Stops working:

When DNS is working I am able ping 1.1.1.1, but not when DNS stops.

And what if 'DNS' (the resolver / unbound) is still working and your issue is the connection between the two devices ? NIC ? Cables ? switches ?

Such a question would last a couple of minutes normally. You can be sure right away :

When your 'ping 1.1.1.1' on a LAN based device "doesn't work", does it work on pfSense at that very moment (use the console ssh access, option 8) and execute the same command over there.
To test DNS on pfSense, do a

dig one.one.one.one +trace

which will resolve from top to bottom.

If ping using an IP, and using a host name, and the proposed DNS works on pfSense, you know now where to look ...

Btw : DNS never stops working by itself, except :
Bad uplink (WAN) connection.
Some packages can receive settings that totally 'kill' pfSense, DNS, or the entire system. - The combination pfBlockerNG-devel <-> Unbound is very known.
etc etc.

[manjotsc]

@Gertjan Alright I'll give a try when It goes down again, thanks.

[serbus]

Hello!

Just a shot in the dark....

In addition to pfb, are you running snort/suricata...with blocking turned on...and maybe some ET DNS type rules...?

John

[manjotsc]

@serbus I am not using snort or surcata,

[manjotsc]

@johnpoz @Gertjan @teamits @serbus It started happening again, this time instead of reboot pfsense or modem, I unplugged the Ethernet cable from wan port and plugged back in, everything start working again, so I replaced the cable just in case. But the issue remains, I have unplug and plug back the Ethernet cable from my modem to pfsense, to restore connectivity. The Internet cuts off on pfsense not only dns, when downloading large files.

[Gertjan]

You said 'modem' : is it really a modem ?
What is your pfSense WAN IP ? An RFC1918 or a "real Internet IP" ?

When you loose DNS, the resolver is still running ? You can, for example, use Diagnostics > DNS Lookup and lookup a local host like printer.localdomain.local (or whaterer your local domain is).

[manjotsc]

@Gertjan I am extremely sorry about delayed reponse.

[Gertjan]

Several questions back :

Why all the packages ? All the VPN's ?
Who is the user setup ? This is a router/firewall : the build user 'admin' will do just fine. A router is not a central meeting place.
As you can see, the "127.0.0.1" has no answer for any existing hostname, For me, all your test hostnames resolved just fine.

I advise you to tack a huge step back.
Save your config, and go back to default.
Take the initial setup as a reference : as it has one huge advantage : everything works. Especially DNS.
You do not need / should not add 24.225.128.24 / 24.200.0.2 / 24.55.0.19 / 1.1.1.1 / 1.0.0.1 except if you have your very special private reasons (making you an expert - the one that never asks questions because he "knows").

When all works fine, add, for example, one - just one - VPN. Test it, leave it some days. Check the logs for any entries you can't explain for yourself.
Then, do a next step. And again, take your time.

As soon as something goes bad, you will have that one-click solution to get back to a stable, working situational.

Btw : stay away form 'heavy' packages.

Btw : check your ISP / ISP equipment, like the upstream router.
this is bad to start with :