How do I configure pfSense to resolve local hostnames?

hypernova

If I try ping pfSense, I get a response:

pfSense.localdoman

If I ping "server" which is the hostname of my server, I get:

ping: server: Name or service not known

I'm new to pfSense and couldn't find any info about this. It seems like something that should work out of the box by default, but doesn't, at least in my case.

... I also found a lot of incorrect information on reddit... I say no more...

johnpoz

Is your server getting an IP via dhcp? And you have register dhcp set in pfsense?

Since you say you can ping just pfsense, that assumes your device is adding the domain suffix localdomain

So if your server is via dhcp and your registering the dhcp you should be able to resolve it via what name it registered via dhcp.

If you setup server static IP on the server, you could always just create a host override to resolve.

hypernova

Hi,

I am a bit confused by your reply, but here are some more details:

The server has a DHCP reservation on pfsense. aka: Set static, by pfsense DHCP server - set by pfsense not by the server itself.

Does that help answer the question?

If I do ping server then I don't get any response.

Edit: I should say the response is "Name or service not known"

johnpoz

I take it you using unbound for dns on pfsense? If so make sure you have this checked.

This will register all your dhcp reservations into your dns.. So if you setup a reservation for say server it would resolve via server.localdomain

So that is reservation I have for my PC, and you can see when I ping it just by name, it comes back fully qualified since my client auto adds my local.lan as suffix.

hypernova

Thank you very much - seems like it was just that missing checkbox that resolved the issue.

Is there a security reason for why this is not enabled by default?

johnpoz

Not really a security reason.. I have been using unbound for so long, and updated through so many versions for such settings I am not always sure what is default or not default.

There is no security concerns with having it enabled that is for sure.

To be honest, the register dhcp I think is enabled by default.. But that can come with its own issues with unbound restarting upon lease renew of client and flushing the cache, and delays in startup if using pfblocker, etc.

Believe if you have regsiter dhcp enabled, it will register clients be it they get reservation or not.. So since that is enabled there is no reason to also have the static enabled. But there are many scenario were you just want reservations registered and not all dhcp clients.. Which is how I have it configured. Notice the register dhcp is unchecked in mine.

Gertjan

@hypernova said in How do I configure pfSense to resolve local hostnames?:

Is there a security reason for why this is not enabled by default?

By default, these are both checked / enabled :

For "comfort", not security - reasons I advise you strongly to un check the first - as the image shows.

hypernova

For "comfort", not security - reasons I advise you strongly to un check the first - as the image shows.

Not sure what you refer to here. On my system the defaults were:

"DHCP Registration: Register DHCP leases in the DNS resolver" = OFF
"Static DHCP": Register DHCP static mappings in the DNS resolver" = OFF

What is the security risk of enabling the first option?

Gertjan

@hypernova said in How do I configure pfSense to resolve local hostnames?:

On my system the defaults were:
"DHCP Registration: Register DHCP leases in the DNS resolver" = OFF
"Static DHCP": Register DHCP static mappings in the DNS resolver" = OFF

I (should have) checked that.

The default config :

	<unbound>
		<enable/>
		<dnssec/>
		<active_interface/>
		<outgoing_interface/>
		<custom_options/>
		<hideidentity/>
		<hideversion/>
		<dnssecstripped/>
	</unbound>

@hypernova said in How do I configure pfSense to resolve local hostnames?:

Not sure what you refer to here.
.... What is the security risk of enabling the first option?

"not security". Checking "DHCP Registration" will restart unbound on every incoming DHCP lease, as they are written to a file ( /etc/hosts) and for unbound (DNS) to take into account the (possible) changes in this file, it is started.
This can take time, especially for those who use huge DNSBL feeds, probably as they use the package pfBlockerng-devel. During this time, which can be tens of seconds : no DNS ...

As said, this subject comes alive on this forum ones a week or so. It often start with "Why my DNS stops working every hour ?"

Good news the settings isn't "set" by default. Pretty sure it was in the past. Thanks for pointing this out.

"Static DHCP" host => IP lines are also added to the /etc/hosts file, these tend to be very static == do not change. So this options can be set if you don't mind that de host name can be used to resolve devices locally.

johnpoz

Yeah its quite possible they use to be default, I do remember dhcp being enabled for sure - because of all the posts about unbound restarting..

It being off is prob a good default - but now will start seeing posts like this one ;)