Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Windows Server DNS Server can't forward to pfSense

    DHCP and DNS
    3
    52
    5.9k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • N
      netblues @Hekmil
      last edited by netblues

      @Hekmil and what do you have in system\general\dns ?

      H 1 Reply Last reply Reply Quote 0
      • H
        Hekmil @netblues
        last edited by Hekmil

        @netblues My NAT Gateway as DNS Server

        The 2 boxes are checked. I've try to uncheck them to randomly test something but as expected nothing different

        N 1 Reply Last reply Reply Quote 0
        • N
          netblues @Hekmil
          last edited by

          @Hekmil dig @yournasip cnn.com
          what happens?

          H 1 Reply Last reply Reply Quote 0
          • H
            Hekmil @netblues
            last edited by

            @netblues With NAT ip address everything is fine, just switching to LAN ip won't make it

            ; <<>> DiG 9.14.12 <<>> @192.168.101.2 cnn.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 63875
;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 4, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; MBZ: 0x0005, udp: 4096
;; QUESTION SECTION:
;cnn.com.			IN	A

;; ANSWER SECTION:
cnn.com.		5	IN	A	151.101.129.67
cnn.com.		5	IN	A	151.101.65.67
cnn.com.		5	IN	A	151.101.193.67
cnn.com.		5	IN	A	151.101.1.67

;; AUTHORITY SECTION:
cnn.com.		5	IN	NS	ns-1086.awsdns-07.org.
cnn.com.		5	IN	NS	ns-1630.awsdns-11.co.uk.
cnn.com.		5	IN	NS	ns-47.awsdns-05.com.
cnn.com.		5	IN	NS	ns-576.awsdns-08.net.

;; Query time: 11 msec
;; SERVER: 192.168.101.2#53(192.168.101.2)
;; WHEN: Thu Jul 23 14:42:25 CEST 2020
;; MSG SIZE  rcvd: 236
            N 1 Reply Last reply Reply Quote 0
            • N
              netblues @Hekmil
              last edited by

              @Hekmil But you get server failed, not no servers can be reached, right?

              ping -S 172.16.1.2 192.168.101.2 works?

              H 1 Reply Last reply Reply Quote 0
              • H
                Hekmil @netblues
                last edited by Hekmil

                @netblues Yes I get Server can't find cnn.com : SERVFAIL

                No it doesn't ping, that might be a route issue no ?

                N 1 Reply Last reply Reply Quote 0
                • N
                  netblues @Hekmil
                  last edited by

                  @Hekmil Do you have outbound nat enabled on your wan interface?

                  H 1 Reply Last reply Reply Quote 0
                  • H
                    Hekmil @netblues
                    last edited by

                    @netblues Oh my god...

                    The Outbound NAT configuration was set to automatic (which should have been enought right ?). So I tried to switch to manual and create a map ANY/ANY on WAN and everything works !

                    N 1 Reply Last reply Reply Quote 0
                    • N
                      netblues @Hekmil
                      last edited by

                      @Hekmil Your configuration is not exactly typical and "automatic" things sometimes fail.
                      From a technical point of view, pf being a router, you shouldn't need nat to reach an rfc1918 address.
                      I suspect that packets reach your nas gateway, but never return.

                      Most probably your nas gateway needs a route back for 172.16.1.0/24 pointing to your pfwan interface ip.
                      Natting, (double) just makes the call originate from the wan interface.
                      And connected networks don't need routes.

                      H 1 Reply Last reply Reply Quote 0
                      • H
                        Hekmil @netblues
                        last edited by

                        @netblues Yes I also think it reachs the nat gateway considering the logs but never returning.

                        I don't know how and where to set a route for my nat gateway though

                        N 1 Reply Last reply Reply Quote 0
                        • N
                          netblues @Hekmil
                          last edited by

                          @Hekmil Maybe you can't. You have to figure this out
                          In the mean time, stay with double nat.
                          For simple internet connectivity and dns resolution it won't make any difference.

                          H 1 Reply Last reply Reply Quote 0
                          • H
                            Hekmil @netblues
                            last edited by

                            @netblues I'm pretty I can't yes, so far the only thing I could change about the NAT configuration was the network IP and Gateway.

                            Yeah it'll do juste fine. Thanks anyway !

                            1 Reply Last reply Reply Quote 0
                            • First post
                              Last post