(solved) 2.5 connecting via hostname not working across interfaces

Bob.Dig · Mar 1, 2021, 8:05 AM

@johnpoz Always used the most recent version and my client is Windows without a domain. And I changed the domain in 2.4.5p1 to home.arpa already and that hostname only thing still has worked for my. So the only thing changed was a fresh install of pfSense version 2.5!
If I remember correct you had to do a reboot on pfSense to get this working, after adding the static mappings in the DHCP server.

Gertjan · Mar 1, 2021, 8:13 AM

@bob-dig

cat /etc/hosts

Is the devices to which you RDP-connect listed ?

I can (pfSense 2.5.0) use host names :

No need to use the hostname.network.tld format, although that works to.

Btw : the device I RDP to have static DJCP MAC leases.

Bob.Dig · Mar 1, 2021, 8:21 AM

@gertjan Hey gertjan, they are listed with IP, domain name and hostname only and it is still not possible for me to connect via hostname only, if the target is on another interface/subnet. And that has worked before. Maybe it shouldn't work, then I am ok with it, I am open to change, but found it noteworthy.

Gertjan · Mar 1, 2021, 8:23 AM

@bob-dig

The /etc/hosts file is used to populate the local unbound resolve cache.
So, unbound knows about them.

Check for yourself, on the console :

dig @127.0.0.1 device

It should give you the correct answer.

Now, dig (or nslookup) on the device from where you RDP from. Is DNS working ? If yes, it should resolve the hostname you are using to connect to.

Bob.Dig · Mar 1, 2021, 8:43 AM

@gertjan It is not working like that in a fresh pfSense 2.5 I guess:

[2.5.0-RELEASE][admin@pfSense.home.arpa]/root: dig @127.0.0.1 mail

; <<>> DiG 9.16.11 <<>> @127.0.0.1 mail
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 57206
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;mail.                          IN      A

;; AUTHORITY SECTION:
.                       3600    IN      SOA     a.root-servers.net.nstld.verisign-grs.com. 2021030100 1800 900 604800 86400

;; Query time: 7 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Mon Mar 01 09:33:29 CET 2021
;; MSG SIZE  rcvd: 108

[2.5.0-RELEASE][admin@pfSense.home.arpa]/root: dig @127.0.0.1 mail.home.arpa

; <<>> DiG 9.16.11 <<>> @127.0.0.1 mail.home.arpa
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 29863
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;mail.home.arpa.                        IN      A

;; ANSWER SECTION:
mail.home.arpa.         3600    IN      A       192.168.92.10

;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Mon Mar 01 09:36:17 CET 2021
;; MSG SIZE  rcvd: 59

[2.5.0-RELEASE][admin@pfSense.home.arpa]/root:

Gertjan · Mar 1, 2021, 8:45 AM

@bob-dig
See the image of mu RDP connect above, it lists my LAn device I 'RDP' to .

The full (local) domain name was needed :

[2.5.0-RELEASE][admin@pfsense.me.net]/boot/kernel: dig Bureau2 +short
[2.5.0-RELEASE][admin@pfsense.me.net]/boot/kernel: dig Bureau2.me.net +short
192.168.1.2

From a windows device,it worked with the host name only :

C:\Users\Gauche>nslookup Bureau2
Serveur :   pfsense.me.net
Address:  2001:470:1f13:5c0:2::1

Nom :    Bureau2.me.net
Addresses:  2001:470:1f13:5c0:2::88
          192.168.1.2

Probably because my Windows prefixes (appended ?) the local domain name.

Bob.Dig · Mar 1, 2021, 8:50 AM

@gertjan It is not working here and my windows is not new. Host file is empty on it, just checked. And it had worked on the last days of the old pfSense, where I already changed the domain to home.arpa...

PS C:\WINDOWS\system32> nslookup mail
Server:  pfSense.home.arpa
Address:  192.168.1.1

*** pfSense.home.arpa can't find mail: Non-existent domain
PS C:\WINDOWS\system32> nslookup mail.home.arpa
Server:  pfSense.home.arpa
Address:  192.168.1.1

Name:    mail.home.arpa
Address:  192.168.92.10

PS C:\WINDOWS\system32>

Gertjan · Mar 1, 2021, 9:07 AM

@bob-dig said in 2.5 connecting via hostname not working across interfaces:

and my windows is not new. Host file is empty on it,

The host file on windows == don't care.
I was talking about the hosts file of pfSense.

Make your Windows IPv4 DHCP "domain name aware" :

Bob.Dig · Mar 1, 2021, 9:11 AM

@gertjan Thanks for the solution.
Although it was not the point of my posting.

Gertjan · Mar 1, 2021, 9:18 AM

@bob-dig said in 2.5 connecting via hostname not working across interfaces:

@gertjan Thanks for the solution.
Although it was not the point of my posting.

Ah, yes, the issue :

@bob-dig said in 2.5 connecting via hostname not working across interfaces:

I used to connect RDP via hostname, this has always worked for me with 2.4.5.
Now with a fresh 2.5 it works only on the same interface.

Check :

Can you actually connect from 'a network' to 'another network' : check your firewall wall rules on the 'a network' interface.
Also : the system you RDP to accepts connection form the 'a network' ? and not only from its own network ?

I didn't detect any changes. I can still RDP into my 'local' systems using aremote VPN access etc.

Bob.Dig · Mar 1, 2021, 9:42 AM

@gertjan RDP just works fine via FQDN, so it is the pfSense DNS-Resolver which now behaves differently, thanks to all our testing, I would say.

johnpoz · Mar 1, 2021, 11:37 AM

@bob-dig said in 2.5 connecting via hostname not working across interfaces:

DNS-Resolver which now behaves differently

Again what version of pfsense were you on?? 2.3.3 fixed the problem of resolving just hostnames.

https://docs.netgate.com/pfsense/en/latest/releases/2-3-3.html#dns-resolver-forwarder
Changed behavior of DNS Resolver overrides to only add FQDN entries, not short hostnames #6064

That was Feb of 2017

Bob.Dig · Mar 1, 2021, 11:46 AM

@johnpoz 2.4.5.p1, as I said, always the latest. So you say, it is not a bug, it is feature? I can't quite see it, but good to know.
I think I started with pfSense with 2.4.4., but not sure exactly.
The other change is I now use a gen2 VM instead of a gen1 VM and another NIC (Hyper-V).

johnpoz · Mar 1, 2021, 11:42 AM

It resolving just hostname was a bug yes.

dns - to resolve it must be fqdn.

JeGr · Mar 2, 2021, 8:22 AM

Or another thing that could be the culprit would be the DHCP Domain added to your client. If that changed in your new install of 2.5 or you added VLANs and used different Domain parts in DHCP for those (vlan1.home.arpa, vlan2.home.arpa, lan.home.arpa etc) and/or your windows client didn't get the domain search path (or a new one), a lookup of "nslookup <name>" won't get resolved anymore. With domain search path set to "home.arpa" that should be extended to "<name>.home.arpa" and if that won't exist or is unknown to unbound, that won't get you far. I think there was some bug/problem with DHCP and different default domains or search paths per VLAN but I'm not entirely sure ;)

But setting the domain search path in DHCP (or manually adding the suffix as Gertjan pointed out on the client itself) should let Windows resolve hostnames only

Bob.Dig · Mar 2, 2021, 8:32 AM

@jegr Definitely did none of those things before and now.

But RDP-Client is very sticky with targets anyway so there will be no discomfort once I have all of them in there and I deleted all hostnames.

Bob.Dig · Mar 10, 2021, 6:38 PM

Meanwhile it is working like in the past, hostname only connecting without a problem, although ubound still couldn't answer. Maybe a windows "feature".

Probably not related to pfSense in the first place.

johnpoz · Mar 10, 2021, 6:50 PM

@bob-dig said in [solved] 2.5 connecting via hostname not working across interfaces:

hostname only connecting without a problem

Your either doing discovery - which would be same L2, or your windows clients are adding suffix like they are suppose to..

Sorry but it is not possible to do discovery, be it broadcast, multicast, LLDP, WSD, etc. across vlans.. For dns to respond the query has to be fully qualified.

You running an old school WINS ;)

example... Here I only ask for sg4860, but you see the actual query sent via nslookup is sg4860.local.lan.. Because windows has that as its search suffix.

C:\>nslookup
Default Server:  pi-hole.local.lan
Address:  192.168.3.10

> set querytype=A
> set debug
> sg4860
Server:  pi-hole.local.lan
Address:  192.168.3.10

------------
Got answer:
    HEADER:
        opcode = QUERY, id = 2, rcode = NOERROR
        header flags:  response, want recursion, recursion avail.
        questions = 1,  answers = 1,  authority records = 0,  additional = 0

    QUESTIONS:
        sg4860.local.lan, type = A, class = IN
    ANSWERS:
    ->  sg4860.local.lan
        internet address = 192.168.9.253
        ttl = 3547 (59 mins 7 secs)

------------
Non-authoritative answer:
Name:    sg4860.local.lan
Address:  192.168.9.253

>

C:\>ipconfig /all

Windows IP Configuration

   Host Name . . . . . . . . . . . . : I5-Win
   Primary Dns Suffix  . . . . . . . : local.lan
   Node Type . . . . . . . . . . . . : Broadcast
   IP Routing Enabled. . . . . . . . : No
   WINS Proxy Enabled. . . . . . . . : No
   DNS Suffix Search List. . . . . . : local.lan

Bob.Dig · Mar 10, 2021, 6:58 PM

@johnpoz It is still looking different here:

PS C:\WINDOWS\system32> nslookup
Default Server:  pfSense.home.arpa
Address:  192.168.1.1

>  set querytype=A
>  set debug
> mail
Server:  pfSense.home.arpa
Address:  192.168.1.1

------------
Got answer:
    HEADER:
        opcode = QUERY, id = 2, rcode = NXDOMAIN
        header flags:  response, want recursion, recursion avail.
        questions = 1,  answers = 0,  authority records = 1,  additional = 0

    QUESTIONS:
        mail, type = A, class = IN
    AUTHORITY RECORDS:
    ->  (root)
        ttl = 612 (10 mins 12 secs)
        primary name server = a.root-servers.net
        responsible mail addr = nstld.verisign-grs.com
        serial  = 2021031001
        refresh = 1800 (30 mins)
        retry   = 900 (15 mins)
        expire  = 604800 (7 days)
        default TTL = 86400 (1 day)

------------
*** pfSense.home.arpa can't find mail: Non-existent domain

PS C:\WINDOWS\system32> ipconfig -all

Windows IP Configuration

   Host Name . . . . . . . . . . . . : U5
   Primary Dns Suffix  . . . . . . . :
   Node Type . . . . . . . . . . . . : Hybrid
   IP Routing Enabled. . . . . . . . : No
   WINS Proxy Enabled. . . . . . . . : No
   DNS Suffix Search List. . . . . . : home.arpa

Really have no clue why it is working again and not before.

Gertjan · Mar 11, 2021, 7:40 AM

@bob-dig

My turn :
I don't have a local host name called 'mail', but I have one called 'diskstation2' :

C:\Users\Gauche>nslookup
Serveur par dÚfaut :   pfsense.my-domain.net
Address:  2001:470:1f13:5c0:2::1

> set querytype=A
> set debug
> diskstation2
Serveur :   pfsense.my-domain.net
Address:  2001:470:1f13:5c0:2::1

------------
Got answer:
    HEADER:
        opcode = QUERY, id = 2, rcode = NOERROR
        header flags:  response, auth. answer, want recursion, recursion avail.
        questions = 1,  answers = 1,  authority records = 0,  additional = 0

    QUESTIONS:
        diskstation2.my-domain, type = A, class = IN
    ANSWERS:
    ->  diskstation2.my-domain.net
        internet address = 192.168.1.33
        ttl = 3600 (1 hour)

------------
Nom :    diskstation2.my-domain.net
Address:  192.168.1.33

>

C:\Users\Gauche>ipconfig -all

Configuration IP de Windows

   Nom de l’hôte . . . . . . . . . . : Gauche2
......
   Liste de recherche du suffixe DNS.: my-domain.net

Carte Ethernet Ethernet :

   Suffixe DNS propre à la connexion. . . : my-domain.net
   Description. . . . . . . . . . . . . . : Intel(R) Ethernet Connection (11) I219-LM
   Adresse physique . . . . . . . . . . . : A4-BB-AC-BA-16-A1
   DHCP activé. . . . . . . . . . . . . . : Oui
   Configuration automatique activée. . . : Oui
   Adresse IPv6. . . . . . . . . . . . . .: 2001:470:beef:5c0:2::c7(prefered)
   Bail obtenu. . . . . . . . . . . . . . : mercredi 10 mars 2021 06:51:57
   Bail expirant. . . . . . . . . . . . . : jeudi 11 mars 2021 10:04:47
   Adresse IPv6 de liaison locale. . . . .: fe80::410c:5e0d:e1a1:6075%10(prefered)
   Adresse IPv4. . . . . . . . . . . . . .: 192.168.1.6(prefered)
   Masque de sous-réseau. . . . . . . . . : 255.255.255.0
   Bail obtenu. . . . . . . . . . . . . . : mercredi 10 mars 2021 08:18:04
   Bail expirant. . . . . . . . . . . . . : vendredi 12 mars 2021 00:38:52
   Passerelle par défaut. . . . . . . . . : fe80::215:17ff:fe77:d118%10
                                       192.168.1.1
   Serveur DHCP . . . . . . . . . . . . . : 192.168.1.1
   IAID DHCPv6 . . . . . . . . . . . : 111459181
   DUID de client DHCPv6. . . . . . . . : 00-01-00-01-26-AC-DF-8D-BB-BB-6D-BA-16-A1
   Serveurs DNS. . .  . . . . . . . . . . : 2001:470:1f13:5c0:2::1
                                       192.168.1.1

Your 'unbound' doesn't know it lives in "home.arpa" so it should (should it ?) try also
mail.home.arpa
which should be in the /etc/hosts file on pfSense, thus known to unbound, as it reads /etc/hosts at start-up.
IF not, give that host called 'mail' a static DHCP MAC lease **, or host override it on the unbound settings page.

** and keep this checked :

edit : I'm not using a domain like "home.arpa". As I need known 'cert' on my LAN, I use a 'real' (rented) domain name for internal uses and acme. I don't think that difference matters.

My unbound knows that :diskstaion2 is local, as it is definced in /etc/hosts/

.....
192.168.1.33	DiskStation2.my-domain.net DiskStation2
....

Strange to see that unbound even bothers a main root server with a non valid host name like 'mail'.