simple local DNS entries (unbound "vs" dnsmasq)



  • Thanks for the help understanding unbound. I've also been reading more about dnsmasq.

    If all I need is DNS name resolution for names inside my local network, it seems that either dnamasq or unbound could support that. I probably don't need the complexity of having both configured.

    Any recommendations on which to use?

    Thanks! dave


  • LAYER 8 Global Moderator

    Default is unbound, resolving with dnssec - why would you think you need to change that?

    No there would be no reason to run both in a common setup.

    Unless there is something specific that unbound is not doing? Or something that is not working in resolve mode with dnssec.. Why would you change it?



  • OK, one more question: Right now I have the PFSense device NOT as the router. But independent of that, how do I add an alias (CNAME) for the PFSense box itself, e.g. as "ns.mydomain.com", to the unbound configuration?


  • LAYER 8 Global Moderator

    To add other record types you would do that in the custom option box in the unbound section of the gui.

    But a cname in anything but an authoritative ns normally doesn't make any sense.. You have something that would be doing a cname query?

    cnames are records you use on an authoritative ns.. What exactly do you want to resolve, if you want ns.mydomain.com to resolve that would just be a A record.

    If you want to point to some other NS to resolve something that would be a domain override



  • So, a "local-data" A record without the "local-data-ptr" entry?

    (I'm starting with what I had in my previous OS X Server DNS 'mdns'? configuration)


  • LAYER 8 Global Moderator

    Huh? What dns server were you running on your OS X server?

    unbound or dnsmasq are not meant to be authoritative NS, if your goal is to run an authoritative ns on pfsense, then install the bind package.

    but you don't actually need a authoritative ns to resolve some local names. If you want ns.domain.tld to resolve that would be a simple host override



  • @johnpoz Exactly! On the OS X Server setup, that did provide an authoritative name service. (And the rest of OS X Server depended on getting the DNS configured EXACTLY CORRECTLY, which I found out The Hard Way when I first started using OS X Server...)

    But for most SOHO (small office/home office) setups, local names are all that is really needed. It's certainly all I need.

    (In defense of OS X Server, its original target was not SOHO setups, but rather full up enterprises, particularly schools, where an authoritative name server made more sense.)

    When I get the local DNS set up, I can 'decommission' my OS X Server instance for internal use (I have another instance hosting public websites, but that's a whole 'nuther issue not relevant to PFSense.)


  • LAYER 8 Global Moderator

    mdns is quite different than just normal dns.. And normally would have zero use in any sort of enteprise or school, etc.

    You could have hundreds or even 1000's of fqdn that resolve just using unbound or dnsmasq.. There is little need of actual authoritative ns.. Even in an enterprise you could get by without one.. All comes down to what exactly your doing.. None of which would be related to mdns to be honest.

    If you have a list of stuff to resolve - you can for sure input that into unbound so they resolve.. But if what you want is to run actual authoritative NS, then just install the bind package.



  • OK. But I didn't see an answer to my question about exactly how to add the alias. Is "local-data: ns2.mydomain.com A 192.168.10.88" sufficient (where 192.168.10.88 is PFSense on my mydomain.com network's LAN port)?



  • In particular, when I put this line in the "Custom Options" box, I got an error message:

    local-data: "ns2.mydomain.com. A 192.168.10.88"

    What am I doing wrong?


  • Galactic Empire

    The following works for me, try removing the trailing .

    local-data: "ping.ui.com A 127.0.0.1"
    local-data: "ping.ui.com AAAA ::1"


  • LAYER 8 Global Moderator

    Did you put a server: in the custom option box before you made any entries?

    record.png

    No reason to put that in the custom box though, unless you have lots them and you just want to paste them in.. such a record you can just put in the host override via the gui entry.



  • @johnpoz That fixed it, thanks!


  • LAYER 8 Global Moderator

    If all you have is A records, and there isn't all that many of them to put in at the same time.. Might be easier to just use the gui to put them in.. I leave the custom option box for stuff that can not put in the gui.

    example

    private-domain: "plex.direct"
    local-zone: "use-application-dns.net"  always_nxdomain
    local-zone: "local."  always_nxdomain
    

    Or if you want to alter the TTL of a record to be something other than default.

    But if you do have a lot of them, then yeah a simple paste of them would be faster ;)



  • @johnpoz I don't -think- I could use the Host Overrides to add the A record to add an alias for the PFSense box itself. For that, I just want an alias, I don't want to define the reverse look-up to the alias.


  • LAYER 8 Global Moderator

    Sure you can.. host override is host override..

    So you don't want the ptr to resolve? Doesn't make a lot of sense..



  • @deemery said in simple local DNS entries (unbound "vs" dnsmasq):

    If all I need is DNS name resolution for names inside my local network

    When you set up pfSense like this :

    ebb835d2-65ad-4fbc-a742-69ddfc2a99b5-image.png

    You will find in the /etc/hosts file this :

    127.0.0.1	localhost localhost.my-local-domain.tld
    ::1	localhost localhost.my-local-domain.tld
    192.168.1.1	myrouter.my-local-domain.tld myrouter
    2001:470:dead:beef:2::1	myrouter.my-local-domain.tld myrouter
    .....
    

    Every other known host will also be present in that file.
    Any modern OS has a /etc/hosts file (yep, even windows, it's in the system root, in /etc/hosts)
    DHCP lease info (IP and host name) will be recorded.
    Static hosts will be recorded there also.

    And this file is used by the local 'DNS' ...

    So, with you doing nothing, it already works just fine.


  • LAYER 8 Global Moderator

    Also at a loss why your firewall would need an alias in the first place to be honest.. Its 1 device, why would you not just access via its actual name and record? you normally don't host other services on it, like websites or something that you would want/need to use another name.



  • @johnpoz said in simple local DNS entries (unbound "vs" dnsmasq):

    Also at a loss why your firewall would need an alias in the first place to be honest.. Its 1 device, why would you not just access via its actual name and record? you normally don't host other services on it, like websites or something that you would want/need to use another name.

    That's a fair question. 3 partial answers :-) :-)

    1. naming convention I'm used to. "ns.mydomain.com" is the name for the domain server. Considering I don't do this kind of work all the time, there is substantial value to following naming conventions so when I come back in a year or two, it's easier to figure out what I did previously.

    2. Generally, I want to "change it once and leave it alone" when it comes to network settings across devices. That's particularly true for the ~10 devices on my home network (including iPhone/iPad)

    3. right now, the PFSense is NOT my router/firewall device. But come to think of it, if I do change that, I'll have to touch all the device network settings anyway.

    In the short run, I want to get DNS on PFSense working first. Then I can decommission the OS X Server instance that now provides DNS, knowing that (after I change the network settings across my network devices :-) ) name resolution will work. Then I can slowly experiment with other PFSense services. (Starting with VPN, then moving to DHCP and firewall.)

    And @Gertjan , no /etc/hosts access on iDevices like iPhone or iPad. There's not much dependency in these devices for local names in mydomain.com, but I still want things to be consistent across the set of devices. (I'm not quite sure how "Files" works on iPad, probably .local/bonjour networking....)



  • @deemery said in simple local DNS entries (unbound "vs" dnsmasq):

    @Gertjan , no /etc/hosts access on iDevices like iPhone or iPad.

    I have those in my /etc/hosts file. All of them. 4 iPhones, and an iPad.

    Because all these devices, from Samsung, Apple, Dell, etc do the same thing : they have and use a DHCP client. So the DHCP server answering them (pfSEnse) - and some code magic, and ... they wind up in /etc/.hosts
    And, again, this file is used by the unbound (resolver) or dnsmasq, the forwarder.
    The /etc/hosts file is the local (for pfSense) "database" with known local LAN based devices.


  • LAYER 8 Global Moderator

    The only issue with registering of dhcp clients in unbound, is it restarts unbound.. So depending on how many clients you have, and how short your lease time is.. There can be some issues with unbound restarting all the time.

    I don't register dhcp clients for this reason.. All clients I want to be able to resolve have reservations - which I do register..

    Most people will not have problem with unbound restarting... Not great for your cache ;) But normally people will not see any issues with it doing that.

    But yeah sure, out of the box you have some dhcp client - called billy, you would be able to resolve billy.yourdomain.tld because of the dhcp lease being registered in unbound, via addition of it in the host file.



  • @johnpoz Most of my Macs are both wired and wireless (some Apple services complain if they can't talk to WiFi). For those, I assign a fixed IP and DNS entry for the wired, and let the wireless pick up the DHCP.

    But I do have one laptop I carry around the house that is WiFi only. I suppose I should configure that as "DHCP with fixed IP Address" and the associated DNS A record entry.

    @Gertjan So your /etc/hosts is only on the PFSense box? That would meet my "define things in only 1 place" objective :-)


  • LAYER 8 Global Moderator

    @deemery said in simple local DNS entries (unbound "vs" dnsmasq):

    (some Apple services complain if they can't talk to WiFi).

    Huh? Just out of curiosity.. Your saying some box running some service, while it has a wired connection it puts up some error or info that wireless is not connected? So set these devices up multihomed? Both wired and wireless? That seems counterproductive to me..



  • @johnpoz Not an error, but a complaint. Example the Maps application complains "better location accuracy if WiFi is enabled." (Understandable, because I believe they use 'what WiFi can I see near me' to determine location. Google does the same thing, I believe.)



  • Well darn! I thought I had this figured out.

    I cabled a machine directly to the LAN port, and set the DNS server to the PFSense box using its LAN IP address. That worked, nslookup returned values.

    So then I unplugged the LAN cable, and set the DNS server to the PFSense box on the IP address of the WAN port. That did NOT work. And I'm not sure why.... nslookup times out.


  • LAYER 8 Global Moderator

    Well I don't have any apple devices with wired interfaces to test this with, but wouldn't just disable of the wifi interface remove such nonsense popups, etc..

    My iphone pops up such info, when using just cell data.. But don't recall ever seeing my PC doing anything like that.. It has a wifi adapter - its just disabled, guess I can turn it on and not connect it and see if get such popups asking to enable wifi..

    edit: ok just tested this on my windows PC going to google maps and clicking my location. While the browser asks if ok to hand out info (i have it set not to let sites use location info).. Sure mentions nothing about wifi, I have my wifi adapter enabled, just not connected to anything.

    Normally that is just disabled.

    Wouldn't it be easier to just disable the hardware of your wifi, if the device is hardwired? Shoot many a laptop device will auto disable wifi when ethernet is connected.. I sure wouldn't multihome a device to remove some info about some stupid app asking me to enable wifi ;) heheh.. If I couldn't turn that off - I wouldn't use such a shitty app to be honest..


  • Galactic Empire

    @johnpoz

    Wouldn't it be easier to just disable the hardware of your wifi, if the device is hardwired? Shoot many a laptop device will auto disable wifi when ethernet is connected.. I sure wouldn't multihome a device to remove some info about some stupid app asking me to enable wifi ;) heheh.. If I couldn't turn that off - I wouldn't use such a shitty app to be honest..

    You need to switch on Wi-Fi & Bluetooth if you want to unlock your Mac from an Apple Watch if you have one.

    Screenshot 2020-09-03 at 17.01.40.png

    It's a right pain, I have a wired Mac that I have to enable Wi-Fi & Bluetooth on.

    If I connect to another SSID at home, lets say my GUEST network from my phone and I haven't connected to it before, the SSID is then known on the Mac and it connects automatically, you then have to untick Automatically join this network.

    Screenshot 2020-09-03 at 17.05.38.png

    Apples logic on this seems a little braindead.


  • LAYER 8 Global Moderator

    @NogBadTheBad said in simple local DNS entries (unbound "vs" dnsmasq):

    Apples logic on this seems a little braindead.

    Yeah that is prob an understatement...

    If you want to do some proximity unlock thing - wouldn't bluetooth be the better option here? And really the only thing required to be on..


  • Galactic Empire

    @johnpoz said in simple local DNS entries (unbound "vs" dnsmasq):

    @NogBadTheBad said in simple local DNS entries (unbound "vs" dnsmasq):

    Apples logic on this seems a little braindead.

    Yeah that is prob an understatement...

    If you want to do some proximity unlock thing - wouldn't bluetooth be the better option here? And really the only thing required to be on..

    I'd have thought so :)


  • Galactic Empire

    @johnpoz

    edit: ok just tested this on my windows PC going to google maps and clicking my location. While the browser asks if ok to hand out info (i have it set not to let sites use location info).. Sure mentions nothing about wifi, I have my wifi adapter enabled, just not connected to anything.

    Normally that is just disabled.

    I wonder if Apple also have a database of known SSIDs to GPS location, Apple Maps without Wi-Fi enabled and with from my desktop Mac:-

    Screenshot 2020-09-03 at 17.26.59.png

    Screenshot 2020-09-03 at 17.34.57.png



  • As a quick update: I now have unbound running as expected, with the PFSense sitting (via the LAN port) on my local network.

    Thanks again for all the help. Now I need to decide whether I tackle VPN configuration, or work on PFSense as firewall. :-)


Log in to reply