• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

DNS Resolver Split outgoing interface

Scheduled Pinned Locked Moved DHCP and DNS
23 Posts 4 Posters 2.2k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • E
    erasedhammer
    last edited by Apr 4, 2021, 12:32 AM

    I have my pfsense box acting as a DNS resolver for all the clients on my network.

    Recently I setup up a domain controller which also acts as a DNS server, but I did not want clients using it as the primary dns server, so I set up a domain override on pfsense for any .local domain traffic (Windows Domain traffic) to get forwarded to the domain controller.

    Initially I had the problem where the queries weren't being forwarded because the domain controller is located off one of my LAN interfaces. So I added that interface to the outgoing interface list in the DNS resolver.

    That solved computers looking up the DC, but now pfsense is attempting to use this LAN interface as the source for internet DNS lookups (as well as its WAN interface).

    Is there a way to split which interface the resolver chooses for certain queries?
    Like only the LAN outgoing interface should be used by this domain override and not for internet lookups?

    J D 2 Replies Last reply Apr 4, 2021, 3:01 PM Reply Quote 0
    • V
      viniciusmerlim
      last edited by Apr 4, 2021, 2:49 AM

      Hey @erasedhammer ! Can you share your interfaces status ? Can you also offer more details of you need to put in place there?

      E 1 Reply Last reply Apr 4, 2021, 1:38 PM Reply Quote 0
      • E
        erasedhammer @viniciusmerlim
        last edited by erasedhammer Apr 4, 2021, 1:39 PM Apr 4, 2021, 1:38 PM

        @viniciusmerlim

        Brief overview of my network layout:

        b79727d0-b578-4122-88fa-c28a27a93b79-image.png

        So my domain controller that is also a dns server is in the Servers subnet
        In my DNS resolver, the outgoing interfaces are selected as : WAN, Servers
        Users subnet have pfsense set to their DNS resolver. But if the domain they are looking up is .local, then the domain override sends the queries to the DC

        My problem is that from an upstream router, I can see pfsense doing queries for internet domains from BOTH the WAN interface IP and the Servers interface IP, since I selected both Servers and WAN as outgoing dns resolver interfaces.
        But domain override doesn't work unless you select the interface that the other dns server is on as an outgoing interface.

        I just want internet DNS queries to originate from the WAN interface IP, and .local queries to originate from the Servers interface IP.

        1 Reply Last reply Reply Quote 0
        • J
          johnpoz LAYER 8 Global Moderator @erasedhammer
          last edited by Apr 4, 2021, 3:01 PM

          @erasedhammer said in DNS Resolver Split outgoing interface:

          attempting to use this LAN interface as the source for internet DNS lookups (as well as its WAN interface).

          How exactly would it do that, unless there is a gateway setup on this interface or using this interface?

          Your saying its sending a query to say 1.2.3.4 from 192.168.1.1 (pfsense lan IP).. To where? What mac address.. You can only use an interface to talk to IPs on that network.. Unless there is a gateway, how would it send traffic to 1.2.3.4 from 192.168.1.1??

          Could you post up what your seeing..

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.8, 24.11

          E 1 Reply Last reply Apr 4, 2021, 3:30 PM Reply Quote 0
          • E
            erasedhammer @johnpoz
            last edited by Apr 4, 2021, 3:30 PM

            @johnpoz

            Sorry, should have clarified, this pfsense box sits behind a firewall. Pfsense is not doing NAT, acting as a router/firewall for local traffic.

            Initially on the edge firewall I wasn't allowing any traffic from the gateway IPs for pfsense's lan subnets, just that pfsense boxes' WAN IP. Which is how I noticed that setting two outgoing interfaces, pfsense just hops between them for sending queries to upstream DNS servers.

            I am just wondering if there is any way to make the dns resolver only use an outgoing interface for certain domains?

            J 1 Reply Last reply Apr 5, 2021, 3:35 PM Reply Quote 0
            • J
              johnpoz LAYER 8 Global Moderator @erasedhammer
              last edited by johnpoz Apr 5, 2021, 3:38 PM Apr 5, 2021, 3:35 PM

              @erasedhammer said in DNS Resolver Split outgoing interface:

              I am just wondering if there is any way to make the dns resolver only use an outgoing interface for certain domains?

              It would only use an interface that it either attached to network its trying to send the query too. Or to a gateway it thinks could talk to that network via your routing, via specific routes or default routes.

              How would it send traffic out an interface to an IP that does not reside on that interface, or to a gateway IP it talks to via that network.

              If it want to talk to say 1.2.3.4 for domain.tld via your override. It can and will only send traffic out an interface that is on the network 1.2.3.4 sits on, and it can arp for. Or to a gateway it is setup with a route to the network 1.2.3.4 sits on, or a default gateway.. Where hey I don't have a route to 1.2.3.4 network - just send it to my default gateway..

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.8, 24.11

              E 1 Reply Last reply Apr 5, 2021, 5:01 PM Reply Quote 0
              • E
                erasedhammer @johnpoz
                last edited by Apr 5, 2021, 5:01 PM

                @johnpoz
                I am not sure how its doing, all I know is it IS doing it.

                From pfsense:
                splitdns-interfaces.png

                From upstream router:
                splitdns.png

                As you can see, its sending queries from both.

                1 Reply Last reply Reply Quote 0
                • D
                  Derelict LAYER 8 Netgate @erasedhammer
                  last edited by Apr 5, 2021, 5:07 PM

                  @erasedhammer said in DNS Resolver Split outgoing interface:

                  Recently I setup up a domain controller which also acts as a DNS server, but I did not want clients using it as the primary dns server,

                  Why would one invest in a domain controller but not have their clients use it as the source of information for the domain?

                  Genuinely curious.

                  Chattanooga, Tennessee, USA
                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                  E 1 Reply Last reply Apr 5, 2021, 5:31 PM Reply Quote 0
                  • E
                    erasedhammer @Derelict
                    last edited by Apr 5, 2021, 5:31 PM

                    @derelict
                    The domain override exists for clients to ask the domain controller domain related DNS queries. What I didn't want is the domain controller handling internet DNS queries.

                    But to directly answer your question, the domain controller is virtualized on a less than reliable server right now. It isn't that critical right now, nothing important relies on it at this point, just a couple of VDIs.

                    J 1 Reply Last reply Apr 5, 2021, 5:41 PM Reply Quote 0
                    • J
                      johnpoz LAYER 8 Global Moderator @erasedhammer
                      last edited by Apr 5, 2021, 5:41 PM

                      Lets see your gateway and routing table.. The only way pfsense would talk to some gateway from its lan IP, if the gateway is attached to the lan network.

                      This is how any router would work. Its not something special to pfsense.

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                      E 1 Reply Last reply Apr 5, 2021, 5:47 PM Reply Quote 0
                      • E
                        erasedhammer @johnpoz
                        last edited by Apr 5, 2021, 5:47 PM

                        @johnpoz
                        Heres the gateway list:
                        gateway.png

                        I don't have any internet static routes though, so everything gets sent to that default gateway.

                        J 1 Reply Last reply Apr 5, 2021, 5:50 PM Reply Quote 0
                        • J
                          johnpoz LAYER 8 Global Moderator @erasedhammer
                          last edited by Apr 5, 2021, 5:50 PM

                          But lets see the routing table.. Pfsense shouldn't use the lan IP when it wants to talk to 172.20.0.1

                          It shouldn't be able to.. Makes no sense to use that IP when trying to talk to something that is not on that network.

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                          E 1 Reply Last reply Apr 5, 2021, 5:54 PM Reply Quote 0
                          • E
                            erasedhammer @johnpoz
                            last edited by Apr 5, 2021, 5:54 PM

                            @johnpoz

                            I don't see anything saying to use one of the lan interfaces to go to the internet

                            routetable.png

                            J 1 Reply Last reply Apr 5, 2021, 6:01 PM Reply Quote 0
                            • J
                              johnpoz LAYER 8 Global Moderator @erasedhammer
                              last edited by Apr 5, 2021, 6:01 PM

                              Maybe @Derelict has some idea.. I am drawing a blank to how/why it could/would do that..

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.8, 24.11

                              1 Reply Last reply Reply Quote 0
                              • V
                                viniciusmerlim
                                last edited by Apr 5, 2021, 8:15 PM

                                Have you set the gateway for your server interface? I think you will need to create static routes and set these dns policies in DNS resolver. You will also need to allow this traffic in the rules and put the SERVERS gateway in advanced configuration of these rules for users to use this weird configuration.

                                What a tricky scenario.

                                E 1 Reply Last reply Apr 5, 2021, 8:30 PM Reply Quote 0
                                • E
                                  erasedhammer @viniciusmerlim
                                  last edited by Apr 5, 2021, 8:30 PM

                                  @viniciusmerlim

                                  What do you mean by gateway for the server interface? It is a gateway in itself.
                                  And by static routes, do you mean static routes inside the dns resolver itself? I am unfamiliar with how to do that.

                                  Is it a weird configuration? Domain overrides can be used for more than my weird domain controller setup.
                                  I think if the domain override could work without selecting additional outgoing interfaces, I wouldn't be seeing this behavior.

                                  D 1 Reply Last reply Apr 5, 2021, 8:39 PM Reply Quote 0
                                  • D
                                    Derelict LAYER 8 Netgate @erasedhammer
                                    last edited by Apr 5, 2021, 8:39 PM

                                    @erasedhammer What have you selected as the outgoing interfaces in DNS Resolver/unbound?

                                    No, you cannot source a connection for a specific domain from a specific source address. This is something dnsmasq (DNS Forwarder) could do but unbound cannot, unfortunately.

                                    Chattanooga, Tennessee, USA
                                    A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                    DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                    E 1 Reply Last reply Apr 5, 2021, 8:39 PM Reply Quote 0
                                    • E
                                      erasedhammer @Derelict
                                      last edited by Apr 5, 2021, 8:39 PM

                                      @derelict

                                      splitdns-resolveroutgoing.png

                                      D 1 Reply Last reply Apr 5, 2021, 8:41 PM Reply Quote 0
                                      • D
                                        Derelict LAYER 8 Netgate @erasedhammer
                                        last edited by Apr 5, 2021, 8:41 PM

                                        @erasedhammer So it is doing exactly what you told it to do? Source queries from both addresses?

                                        Chattanooga, Tennessee, USA
                                        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                        Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                        E 1 Reply Last reply Apr 5, 2021, 8:42 PM Reply Quote 0
                                        • E
                                          erasedhammer @Derelict
                                          last edited by Apr 5, 2021, 8:42 PM

                                          @derelict

                                          Correct, but the domain override and telling it to use an internal DNS server does not work without selecting the servers interface as outgoing.
                                          I guess that is the root of my question, why can't the domain override work without the interface being selected in the outgoing interfaces list.

                                          D 1 Reply Last reply Apr 5, 2021, 8:43 PM Reply Quote 0
                                          1 out of 23
                                          • First post
                                            1/23
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                            This community forum collects and processes your personal information.
                                            consent.not_received