Problem with DNS
Hi to all,
I have really weird issue. I cannot open one website (harveynorman.si). I’m using pfsense as DNS resolver, and pfblocker also. When I’m trying to access website that is blocked over pfblocker I got message that site is blocker, and this is fine. But when I’m trying to access just that one specific site I got error ERR_CONNECTION_TIMED_OUT. I tried DNS lookup on pfsense and got right IP it is 126.96.36.199, also over cmd on Windows host nslookup resolves the website in to right IP.
If I try to reach that site over cellular on my Android phone everything works fine. But on LAN I cannot access that no matter what.
Any help would be great.
bingo600 last edited by
1: You can resolve the DNS name
2: You seem to be able to Traceroute to the ip
Basic pre-reqs. for accessing that website is in order.
I don't use pfBlocker ... But have you tried to stop that one , and redo the test ??
Gertjan last edited by
I have really weird issue.
It's called 'round robin' or 'roulette russe'.
For some reason you gave pfSense a choice.
Use 127.0.0.1 to resolve DNS - and that will be Unbound - and while using unbound, pfBlockerNG also parses the output, and handles upon it.
Use 188.8.131.52 - who ever that might be.
Use 184.108.40.206 - - who ever that might be.
I don't know how pfSense decides what DNS to use, probably, 'the next one' after every request (round robon) or 'random' : the russe game.
I guess you understand that the last two don't use pfBlockerNG. So, when a DNS request is send to one of these, nothing gets blocked.
Why did you enter / use 220.127.116.11 and/or 18.104.22.168. Consider these as remote resolvers.
Supplying (ISP) external DNS servers is something of the past. pfSense has it's own build in resolver.
Also has something else going on - his 10.10.33.1 which I assume is pfsense should resolve to the pfsense name vs unknown
example.. My pfsense running unbound on 192.168.9.253 for dns, it resolves its own name.
> harveynorman.si Server: sg4860.local.lan Address: 192.168.9.253 Non-authoritative answer: Name: harveynorman.si Address: 22.214.171.124
is 10.10.33.1 not pfsense?
@gertjan thank you for your reply. I enabled override DNS over PPP, that's why there are 3 different DNS servers. But also with that config I'm unable to open harveynorman.si website. Now I disabled the other 2 servers but still, this site is unreachable.
Do you have any suggestions maybe?
@johnpoz you're correct, 10.10.33.1 is VIP of pfblockerNG, I can ping that IP and is reachable from my LAN. Today I will turn off pfblocker to see if that is the cause. But it's really weird thing because only that one website is unreachable.
Gertjan last edited by
I enabled override DNS over PPP
And is there a reason for this ?
It short cuts the local DNS Resolver, ans stops pfBockerNG from doing its work.
You don't need the DNSs of your ISP, neither 126.96.36.199 or 188.8.131.52 or who ever.
True, ISP can offer DNS for their clients - "stupid" ISP boxes use them so they can implement a very simple forwarder like dnsmasq.
pfSense contains real resolver.
Still, my resolver, using default settings, can resolve harveynorman.si just fine.
Btw : harveynorman.si is using TLS 1.0 and 1.1 : These should be removed.
harveynorman.si is using TLS 1.0 and 1.1
Yeah I checked as well when you mentioned it.. But also 1.2 so browser should connect via 1.2.. But what maybe could be causing you an issue? Depending on what browser your using??
"This site works only in browsers with SNI support" is listed from the ssl test site.. Not all browsers do that.
The site loads here, it resolves without issue.. So either you have something blocking it. Or browser issue? You show it resolving to the IP that it is using.. If pfblocker was blocking it - you wouldn't get back the IP, etc.
Unless you were using some other firewall rules with pfblocker that using IP to block from some list?
sorry for my late reply. You found the issue, as you guys mentioned the IP (10.10.33.1) of DNS was wrong. I don't know how this happened, but now everything is working perfectly. Thank you all. You're the best
Very detailed instructions! Thank you!