(solved) 2.5 connecting via hostname not working across interfaces

Gertjan · Mar 11, 2021, 7:40 AM

My turn :
I don't have a local host name called 'mail', but I have one called 'diskstation2' :

C:\Users\Gauche>nslookup
Serveur par dÚfaut :   pfsense.my-domain.net
Address:  2001:470:1f13:5c0:2::1

> set querytype=A
> set debug
> diskstation2
Serveur :   pfsense.my-domain.net
Address:  2001:470:1f13:5c0:2::1

------------
Got answer:
    HEADER:
        opcode = QUERY, id = 2, rcode = NOERROR
        header flags:  response, auth. answer, want recursion, recursion avail.
        questions = 1,  answers = 1,  authority records = 0,  additional = 0

    QUESTIONS:
        diskstation2.my-domain, type = A, class = IN
    ANSWERS:
    ->  diskstation2.my-domain.net
        internet address = 192.168.1.33
        ttl = 3600 (1 hour)

------------
Nom :    diskstation2.my-domain.net
Address:  192.168.1.33

>

C:\Users\Gauche>ipconfig -all

Configuration IP de Windows

   Nom de l’hôte . . . . . . . . . . : Gauche2
......
   Liste de recherche du suffixe DNS.: my-domain.net

Carte Ethernet Ethernet :

   Suffixe DNS propre à la connexion. . . : my-domain.net
   Description. . . . . . . . . . . . . . : Intel(R) Ethernet Connection (11) I219-LM
   Adresse physique . . . . . . . . . . . : A4-BB-AC-BA-16-A1
   DHCP activé. . . . . . . . . . . . . . : Oui
   Configuration automatique activée. . . : Oui
   Adresse IPv6. . . . . . . . . . . . . .: 2001:470:beef:5c0:2::c7(prefered)
   Bail obtenu. . . . . . . . . . . . . . : mercredi 10 mars 2021 06:51:57
   Bail expirant. . . . . . . . . . . . . : jeudi 11 mars 2021 10:04:47
   Adresse IPv6 de liaison locale. . . . .: fe80::410c:5e0d:e1a1:6075%10(prefered)
   Adresse IPv4. . . . . . . . . . . . . .: 192.168.1.6(prefered)
   Masque de sous-réseau. . . . . . . . . : 255.255.255.0
   Bail obtenu. . . . . . . . . . . . . . : mercredi 10 mars 2021 08:18:04
   Bail expirant. . . . . . . . . . . . . : vendredi 12 mars 2021 00:38:52
   Passerelle par défaut. . . . . . . . . : fe80::215:17ff:fe77:d118%10
                                       192.168.1.1
   Serveur DHCP . . . . . . . . . . . . . : 192.168.1.1
   IAID DHCPv6 . . . . . . . . . . . : 111459181
   DUID de client DHCPv6. . . . . . . . : 00-01-00-01-26-AC-DF-8D-BB-BB-6D-BA-16-A1
   Serveurs DNS. . .  . . . . . . . . . . : 2001:470:1f13:5c0:2::1
                                       192.168.1.1

Your 'unbound' doesn't know it lives in "home.arpa" so it should (should it ?) try also
mail.home.arpa
which should be in the /etc/hosts file on pfSense, thus known to unbound, as it reads /etc/hosts at start-up.
IF not, give that host called 'mail' a static DHCP MAC lease **, or host override it on the unbound settings page.

** and keep this checked :

edit : I'm not using a domain like "home.arpa". As I need known 'cert' on my LAN, I use a 'real' (rented) domain name for internal uses and acme. I don't think that difference matters.

My unbound knows that :diskstaion2 is local, as it is definced in /etc/hosts/

.....
192.168.1.33	DiskStation2.my-domain.net DiskStation2
....

Strange to see that unbound even bothers a main root server with a non valid host name like 'mail'.

Bob.Dig · Mar 11, 2021, 7:42 AM

@gertjan Bonjour.
They all got a static mapping and this box is checked all the time.
So still no clue why this behavior changed and now has changed again.
C’est la vie...

Gertjan · Mar 11, 2021, 8:08 AM

@bob-dig said in [solved] 2.5 connecting via hostname not working across interfaces:

C’est la vie...

Coté fichier /etc/hosts : toutes tes hôtes y figurent ?

Bob.Dig · Mar 11, 2021, 8:15 AM

@gertjan I think we were there already.
Adieu

Gertjan · Mar 11, 2021, 8:33 AM

@bob-dig

I knew it. The question sounded familiar

Bob.Dig · Apr 4, 2021, 10:28 AM

I have to bring that up because it is an ongoing problem. Sometimes it works over other interfaces, sometimes it doesn't.

Bob.Dig · Apr 4, 2021, 5:25 PM

I enabled Register DHCP leases in the DNS Resolver in addition to the already enabled Register DHCP static mappings in the DNS Resolver and now it is working again, before even FQDN wasn't working. It is a mess.

Bob.Dig · Apr 7, 2021, 6:07 PM

I noticed that sometimes my windows can't connect even if via ip it is possible and even the dns resolution is working according to nslookup. It is making no sense to me.

johnpoz · Apr 7, 2021, 6:21 PM

Are you IPs changing? This isn't freaking rocket science ;) But it does require some basic understanding of dns and networking..

Bob.Dig · Apr 8, 2021, 8:04 AM

@johnpoz They don't change but the windows smb shares don't work anymore, unreachable, although via IP it is working.
But I don't know what the reason is, an ARP problem maybe? It is two Windows PCs across different interfaces.

But I just noticed that the problem was different when I started this thread. It somehow looks related to me but it might not be.

johnpoz · Apr 8, 2021, 9:53 AM

Well troubleshoot the problem - if its not working via IP, it has zero to do with name resolution.

Sniff - what happens.. Does pfsense send on the syn.. Then its not pfsense..

Bob.Dig · Apr 8, 2021, 1:10 PM

@johnpoz It always does work with IP, names some of the time.
But to my later problem, I had ACL one machine to use the resolver only for local stuff. Maybe windows will not use it anymore and will favor the other... hard to tell. I switched to ip and will stay there, at least in that vm.
The original problem, RDP just over the hostname seems gone, it always works so, even across interfaces.

johnpoz · Apr 8, 2021, 1:10 PM

@bob-dig said in 2.5 connecting via hostname not working across interfaces:

I had ACL one machine to use the resolver only for local stuff.

Huh? How exactly do you think that could work? While sure you can set the ACL to only be able to resolve local stuff. How would that client then resolve public stuff? You can't just point a client to 2 different NS that resolve different things and not have problems.

Bob.Dig · Apr 8, 2021, 1:11 PM

@johnpoz It worked for some time... but it is probably the reason for the latest problems.

Bob.Dig · Jun 30, 2021, 6:31 PM

I once again had to reinstall a fresh pfSense and guess what is not working again, RDP only via hostname.
But it seems related to using DHCP on my Windows. If I am using DHCP for IPv4, I can connect via hostname. If I dial-in the same settings manually, I only can connect via FQDN.
So it is all a windows "thingy". Weird but now I know at least this.

johnpoz · Jul 1, 2021, 6:37 AM

@bob-dig You can not resolve just hostname unless you are on the same L2 and broadcast for it.

If you actually setup your network correctly be able to resolve everything via FQDN, and your window devices would auto add the domain your using locally via domain suffix.

This is a layer 8 issue...

Bob.Dig · Jul 1, 2021, 6:38 AM

@johnpoz said in (solved) 2.5 connecting via hostname not working across interfaces:

This is a layer 8 issue...

I got you.

But there is still one missing puzzle peace. Why the heck it will work after some time (weeks), even if I dialed in the settings my self only in the first window of the IPv4 Properties, missing out on the DNS suffix field? Only Windows knows.

johnpoz · Jul 1, 2021, 1:47 PM

@bob-dig said in (solved) 2.5 connecting via hostname not working across interfaces:

missing out on the DNS suffix field? Only Windows knows.

Huh?? Sorry I can not make any sense of that... You either broadcast for a hostname, or you resolve a fqdn.. There is no "puzzle" to it..

Bob.Dig · Jul 1, 2021, 1:47 PM

@johnpoz said in (solved) 2.5 connecting via hostname not working across interfaces:

There is no "puzzle" to it..

Riddle me this. Why is it for some time not working and later it is?

johnpoz · Jul 1, 2021, 2:08 PM

@bob-dig said in (solved) 2.5 connecting via hostname not working across interfaces:

Riddle me this. Why is it for some time not working and later it is?

Have no freaking idea what your setup is... I can tell you this - YOU CAN NOT resolve a hostname from dns, it has to be fully qualified... That is how dns works.

I have no idea what your actually doing, or how your network is setup or what your trying to resolve and how.

For all we know why it some times worked and sometimes didn't is you had your client pointing to 2 different dns, and when it asked pfsense for host.domain.tld it worked, and when it asked your external dns it failed because it has no clue to your local domain.

You can not control what NS a client might ask when there is more than one..

What I can tell you is if setup correctly you could always resolve all your resources via just putting in a hostname because the client would auto added the suffix for whatever domain your using locally.. And now you have zero issues and can always resolve..

here I just put in nas, and it actually resolve the fqdn nas.local.lan because my client auto does that dns lookup by auto adding the suffix.

C:\>ping nas

Pinging nas.local.lan [192.168.9.10] with 32 bytes of data:
Reply from 192.168.9.10: bytes=32 time<1ms TTL=64

Here is it doing the fqdn query, even though I only used nas

suffix