Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    DNS resolver stopped resolving one hostname

    DHCP and DNS
    4
    17
    1.1k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • S
      silmaril
      last edited by

      I am experiencing a strange behaviour of the DNS in my LAN.

      pfsense 2.5.1-RELEASE is configured as DNS resolver and uses the upstream AVM FritzBox as it's DNS server.
      In general, DNS works fine for all clients in the LAN.
      But since a few days there is one hostname that cannot be resolved any more: muenchen.social.
      All other names are working fine.

      When I go to Diagnostics > DNS Lookup in pfsense and enter this hostname, it gets resolved just fine. Both A and AAAA records are retrieved successfully. I think this means, pfsense is able to retrieve the correct DNS information for this host.

      But when I try to resolve this hostname on any machine in my LAN, it won't work.

      If I do
      dig @<pfsense-IP> muenchen.social
      on a linux machine, I get no answer section.

      If I do
      dig @<FritzBox-IP> muenchen.social
      on the same machine, I get the correct answer.

      Other hosts are working fine, like
      dig @<pfsense-IP> chaos.social
      is giving the correct answer, too.

      From my point of view this looks like a setup that's working perfectly with the exception of this one hostname. I cannot see any reason, why this shoud be possible to happen.

      Restarting both the pfsense and the clients did not change this behaviour.

      Any ideas what could cause this or what I could try to improve this situation?

      S 1 Reply Last reply Reply Quote 0
      • S
        silmaril @silmaril
        last edited by

        @silmaril
        Just noticed there is an updae available, but I still see the exact same behaviour after upgrading to 2.5.2-RELEASE.

        KOMK 1 Reply Last reply Reply Quote 0
        • KOMK
          KOM @silmaril
          last edited by

          @silmaril Do you have any packages installed such as pfBlocker?

          S 1 Reply Last reply Reply Quote 0
          • S
            silmaril @KOM
            last edited by

            @kom
            Yes, there are several packages installed and pfBlockerNG is one of them - but it's currently disabled.
            I tried enabling it and adding .muenchen.social to the custom domain whitelist, but this didn't change the behaviour.

            I don't think that any of the other packages should interfere with DNS.

            johnpozJ 1 Reply Last reply Reply Quote 0
            • johnpozJ
              johnpoz LAYER 8 Global Moderator @silmaril
              last edited by johnpoz

              So do you have pfsense using itself for dns?

              What is the output of your dns gui query? Which you say works - does it just list 127.0.0.1 or some other dns?

              example - that resolves fine here, just using unbound for pfsense own queries. But if you have dns setup in general, or allowing dhcp to hand out dns to pfsense it could be using that in the gui. While if your clients ask, it would just be using unbound - which is resolving or forwarding (if so to where?)

              What are you using for your local domain? Do you have any domain overrides setup, etc.

              dnslookup.png

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.7.2, 24.11

              S 1 Reply Last reply Reply Quote 0
              • S
                silmaril @johnpoz
                last edited by

                @johnpoz
                126c3a45-e009-4a83-b43f-4a68a41ab3a1-image.png

                Yes, it seems it's using itself / localhost as DNS as well as another IP which is the DSL router on the WAN interface.

                An as far as I understand, it's getting the correct answer, but it doesn't tell me, if it got the same answer from both sources.

                This lead me to an additional test:
                I connected to the pfsense via SSH and did the dig there, too.

                dig @192.168.178.1 muenchen.social returns the correct IP, but both dig @127.0.0.1 muenchen.social and dig muenchen.social don't return an answer section.

                johnpozJ 1 Reply Last reply Reply Quote 0
                • johnpozJ
                  johnpoz LAYER 8 Global Moderator @silmaril
                  last edited by johnpoz

                  Why doesn't 127.0.0.1 answer? is unbound not actually running?

                  Do you not have it listening on loopback? You for sure should be able to do a query on pfsense going to loopback.

                  and just normal dig should do that too..

                  [21.05-RELEASE][admin@sg4860.local.lan]/root: dig muenchen.social
                  
                  ; <<>> DiG 9.16.15 <<>> muenchen.social
                  ;; global options: +cmd
                  ;; Got answer:
                  ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 3216
                  ;; flags: qr rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
                  
                  ;; OPT PSEUDOSECTION:
                  ; EDNS: version: 0, flags:; udp: 4096
                  ;; QUESTION SECTION:
                  ;muenchen.social.               IN      A
                  
                  ;; ANSWER SECTION:
                  muenchen.social.        1414    IN      A       159.69.89.221
                  
                  ;; Query time: 0 msec
                  ;; SERVER: 127.0.0.1#53(127.0.0.1)
                  ;; WHEN: Sun Jul 11 16:17:48 CDT 2021
                  ;; MSG SIZE  rcvd: 60
                  
                  [21.05-RELEASE][admin@sg4860.local.lan]/root: 
                  

                  You can see there it used loopback for the query.

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                  S 1 Reply Last reply Reply Quote 0
                  • S
                    silmaril @johnpoz
                    last edited by

                    @johnpoz
                    Not sure what's happening here, but after I woke up this morning, resolving the problematic host is working again.

                    pfBlockerNG is still disabled, so I don't think it has anything to do with my whitelist entry.

                    I'm still trying to understand the problem. What do you mean by "is unbound running"? Which options should I check here?

                    (Sorry, I don't have much knowledge about DNS, until now that was just something that worked fine 😄 ).

                    GertjanG 1 Reply Last reply Reply Quote 0
                    • GertjanG
                      Gertjan @silmaril
                      last edited by Gertjan

                      @silmaril said in DNS resolver stopped resolving one hostname:

                      pfBlockerNG is still disabled,

                      Was it ( pfBlockerNG ) running when you found out that muenchen.social wasn't resolving - the first time ?
                      Was it resolving to something like "10.10.10.1" or just nothing at all ?

                      No "help me" PM's please. Use the forum, the community will thank you.
                      Edit : and where are the logs ??

                      S 1 Reply Last reply Reply Quote 0
                      • S
                        silmaril @Gertjan
                        last edited by

                        @gertjan
                        As far as I can reproduce it, I am pretty sure, pfBlockerNG was not running when the problem first occured.
                        It did not return any IP.

                        When testing with Network Analyzer on an Android phone, I got a SERVFAIL error, which seems strange, because usually it's NXDOMAIN if the name cannot be resolved.

                        GertjanG 1 Reply Last reply Reply Quote 0
                        • GertjanG
                          Gertjan @silmaril
                          last edited by Gertjan

                          @silmaril said in DNS resolver stopped resolving one hostname:

                          Network Analyzer on an Android phone

                          For the next time :
                          Use

                          dig muenchen.social +trace
                          

                          on the console (or : easier : ssh) access.
                          You'll have all answers on the screen.

                          Or, on a PC :

                          nslookup
                          

                          and activate the debug :

                          set debug=on
                          

                          Now enter :

                          muenchen.social
                          

                          and you have all the details.

                          I don't have android device - neither would I use such a device for these tests.

                          No "help me" PM's please. Use the forum, the community will thank you.
                          Edit : and where are the logs ??

                          S 1 Reply Last reply Reply Quote 0
                          • S
                            silmaril @Gertjan
                            last edited by

                            @gertjan said in DNS resolver stopped resolving one hostname:

                            @silmaril said in DNS resolver stopped resolving one hostname:

                            Network Analyzer on an Android phone

                            For the next time :
                            Use

                            dig muenchen.social +trace
                            

                            on the console (or : easier : ssh) access.
                            You'll have all answers on the screen.

                            That's awesome! Thanks for this hint!

                            Or, on a PC :

                            nslookup
                            

                            My PC is running Linux ;-)

                            I don't have android device - neither would I use such a device for these tests.

                            It was just interesting because of this error code - but I will use dig ... +trace, if I encounter similar problems in the future.

                            johnpozJ 1 Reply Last reply Reply Quote 0
                            • johnpozJ
                              johnpoz LAYER 8 Global Moderator @silmaril
                              last edited by johnpoz

                              btw you can install dig on your pc.. Its a MUST have for me ;)

                              Just install the bind package from isc and pick tools only..

                              here is my windows machine

                              C:\>dig
                              
                              ; <<>> DiG 9.16.18 <<>>
                              

                              if linux than yeah easy as well to install dig if you don't have it.

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                              GertjanG 1 Reply Last reply Reply Quote 0
                              • GertjanG
                                Gertjan @johnpoz
                                last edited by

                                For pfSense :

                                pkg install bind-tools
                                

                                No "help me" PM's please. Use the forum, the community will thank you.
                                Edit : and where are the logs ??

                                johnpozJ 1 Reply Last reply Reply Quote 0
                                • johnpozJ
                                  johnpoz LAYER 8 Global Moderator @Gertjan
                                  last edited by

                                  @gertjan didn't they make it default installed? I know I am on clean install of pfsense+ and I don't recall installing that package..

                                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                                  If you get confused: Listen to the Music Play
                                  Please don't Chat/PM me for help, unless mod related
                                  SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                                  GertjanG 1 Reply Last reply Reply Quote 0
                                  • GertjanG
                                    Gertjan @johnpoz
                                    last edited by

                                    @johnpoz said in DNS resolver stopped resolving one hostname:

                                    didn't they make it default installed?

                                    I don't think so. But I can't remember.
                                    Installed pfSense ones, version 1 ? When I was fiddling with M0n0wall. Or something like that. Seems ages (a decade ?) to me. Been upgrading since, never re installed, it.

                                    edit :

                                    Joined 29 Dec 2005, 21:40
                                    

                                    Ok, more then a decade.

                                    No "help me" PM's please. Use the forum, the community will thank you.
                                    Edit : and where are the logs ??

                                    johnpozJ 1 Reply Last reply Reply Quote 0
                                    • johnpozJ
                                      johnpoz LAYER 8 Global Moderator @Gertjan
                                      last edited by

                                      I think it is part of base install now... When 2.5/+ came out I did clean installs.. And I don't recall having to install that, and I have dig..

                                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                                      If you get confused: Listen to the Music Play
                                      Please don't Chat/PM me for help, unless mod related
                                      SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                                      1 Reply Last reply Reply Quote 0
                                      • First post
                                        Last post
                                      Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.