• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

How to setup a Host Override

Scheduled Pinned Locked Moved DHCP and DNS
58 Posts 4 Posters 10.7k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • J
    jimfreeze
    last edited by Nov 12, 2021, 2:14 PM

    Hello.

    I'm new to pfsense and am trying to setup a custom DNS override on my LAN, e.g., pfsense.local => 192.168.1.1.

    I have added a "Host Override" with parent domain of "pfsense.local" with the above IP address.

    Testing the pfsense.local in Diagnostics / DNS Lookup works as expected, but that address is not resolvable from any PC on the network.

    I can ssh into the firewall and it resolves fine also.

    What am I missing?

    Thank you.

    J 1 Reply Last reply Nov 12, 2021, 2:18 PM Reply Quote 0
    • J
      johnpoz LAYER 8 Global Moderator @jimfreeze
      last edited by johnpoz Nov 12, 2021, 2:26 PM Nov 12, 2021, 2:18 PM

      @jimfreeze well using .local is bad idea to be honest.. But where are your clients pointing to for dns?

      pfsenselocal.jpg

      An intelligent man is sometimes forced to be drunk to spend time with his fools
      If you get confused: Listen to the Music Play
      Please don't Chat/PM me for help, unless mod related
      SG-4860 24.11 | Lab VMs 2.8, 24.11

      J 1 Reply Last reply Nov 12, 2021, 2:46 PM Reply Quote 0
      • J
        jimfreeze @johnpoz
        last edited by Nov 12, 2021, 2:46 PM

        @johnpoz

        As I understand, the clients get their DNS from pfsense when it assigns an IP address via DHCP. This is what I'm seeing in /etc/resolve.conf

        # This file is automatically generated.
        #
        search home.arpa
        nameserver 8.8.8.8
        nameserver 8.8.4.4
        
        J 1 Reply Last reply Nov 12, 2021, 2:57 PM Reply Quote 0
        • J
          johnpoz LAYER 8 Global Moderator @jimfreeze
          last edited by Nov 12, 2021, 2:57 PM

          @jimfreeze well clearly if that is your client he isn't pointing to pfsense for his dns, so no he wouldn't be able to resolve your host override.

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.8, 24.11

          J 1 Reply Last reply Nov 12, 2021, 2:59 PM Reply Quote 0
          • J
            jimfreeze @johnpoz
            last edited by Nov 12, 2021, 2:59 PM

            @johnpoz Do I need to configure a General setting in pfsense so clients will be able to resolve host overrides properly?

            Thank you.

            J 1 Reply Last reply Nov 12, 2021, 3:03 PM Reply Quote 0
            • J
              johnpoz LAYER 8 Global Moderator @jimfreeze
              last edited by Nov 12, 2021, 3:03 PM

              @jimfreeze out of the box your dhcp server on pfsense should point clients to its IP on the interface you enabled dhcp on. If your client is not getting dhcp from pfsense, or you modified those settings or client is static etc..

              You sure there is not some other dhcp on your network handing out google for dns?

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.8, 24.11

              J 1 Reply Last reply Nov 12, 2021, 3:17 PM Reply Quote 0
              • J
                jimfreeze @johnpoz
                last edited by Nov 12, 2021, 3:17 PM

                @johnpoz This is the current general setup screen. I think the only change is the "DNS Server Override" is checked.

                Screen Shot 2021-11-12 at 9.10.21 AM.png

                The pfsense is the only router in the house other than the ATT modem, which is configured as passthrough DHCPS-dynamic and is handing out addresses

                DHCPv4 Start Address	192.168.1.64
                DHCPv4 End Address	192.168.1.253
                

                All addresses inside the LAN are 192.168.100.0/24.

                1 Reply Last reply Reply Quote 0
                • J
                  jimfreeze
                  last edited by Nov 12, 2021, 3:26 PM

                  So, there is this on the Dashboard.

                  DNS server(s)	
                    `127.0.0.1`
                    `192.168.1.254`
                    `2600:1702:4c72:c400::100:`
                  
                  J 1 Reply Last reply Nov 12, 2021, 3:30 PM Reply Quote 0
                  • J
                    johnpoz LAYER 8 Global Moderator @jimfreeze
                    last edited by Nov 12, 2021, 3:30 PM

                    @jimfreeze well clearly your client isn't using what dhcp handing out..

                    Why are you pointing dns to itself there in general - out of the box that should just be nothing, and your also allowing overide from dhcp on wan.

                    What does your dhcp show..

                    dhcpserver.jpg

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                    J 1 Reply Last reply Nov 12, 2021, 3:36 PM Reply Quote 0
                    • J
                      jimfreeze @johnpoz
                      last edited by Nov 12, 2021, 3:36 PM

                      @johnpoz Ahh, sorry about self pointing dns address. That has been fixed.

                      I was missing the config of the DHCP server. This is what I have now and it seems to work fine.

                      Screen Shot 2021-11-12 at 9.34.14 AM.png

                      Screen Shot 2021-11-12 at 9.36.02 AM.png

                      J J 2 Replies Last reply Nov 12, 2021, 3:43 PM Reply Quote 0
                      • J
                        jimfreeze @jimfreeze
                        last edited by Nov 12, 2021, 3:43 PM

                        @johnpoz Not sure if I still have an issue or not, but trying to access the router via DNS Override returns this message in the browser.

                        Potential DNS Rebind attack detected, see http://en.wikipedia.org/wiki/DNS_rebinding
                        Try accessing the router by IP address instead of by hostname.
                        
                        1 Reply Last reply Reply Quote 0
                        • J
                          johnpoz LAYER 8 Global Moderator @jimfreeze
                          last edited by johnpoz Nov 12, 2021, 3:46 PM Nov 12, 2021, 3:44 PM

                          @jimfreeze if you would of left those just blank - they would point to interface address.

                          Pointing to both pfsense and google is bad idea - you have no idea which of those your client might use. And if he asks google for your pfsense.local - he would get nx, and not going to ask any of his other listed NS for it - why should he - he got told it didn't exist, etc..

                          you should only ever point client to NS that actually resolve the same way, be it with local records or with filtering, etc.. If you point to more than 1 NS, and they might not resolve stuff the same way you just asking for grief..

                          edit: as to your rebind.. why would you not just access pfsense via its pfsense.home.arpa address? pfsense.local is not pfsense correct name, so yeah that could cause all kinds of issues..

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                          J 1 Reply Last reply Nov 12, 2021, 4:00 PM Reply Quote 0
                          • J
                            jimfreeze @johnpoz
                            last edited by Nov 12, 2021, 4:00 PM

                            @johnpoz So, here is the general setup:

                            Screen Shot 2021-11-12 at 9.52.42 AM.png

                            I removed all Host Overrides on DNS Resolver

                            And here is the DHCP Server

                            Screen Shot 2021-11-12 at 9.53.36 AM.png

                            Clients receive the following when connecting

                            #
                            search home.arpa
                            nameserver 192.168.100.1
                            

                            I'm not understanding how to access "pfsense.home.arpa". It returns the following when doing a DNS Lookup test

                            Screen Shot 2021-11-12 at 9.59.42 AM.png

                            J 1 Reply Last reply Nov 12, 2021, 4:09 PM Reply Quote 0
                            • J
                              johnpoz LAYER 8 Global Moderator @jimfreeze
                              last edited by johnpoz Nov 12, 2021, 4:10 PM Nov 12, 2021, 4:09 PM

                              @jimfreeze well you got something a bit wonky there.. the hostname of pfsense should resolve to its LAN ip..

                              example.

                              localIP.jpg

                              Get rid of your allow wan dhcp to set dns in your general setup.. looks like your asking 192.168.1.254 for dns as well?

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.8, 24.11

                              J 1 Reply Last reply Nov 12, 2021, 8:28 PM Reply Quote 0
                              • J
                                jimfreeze @johnpoz
                                last edited by Nov 12, 2021, 8:28 PM

                                @johnpoz As far as I can tell, pfsense is getting the 192.168.1.254 resolver when it gets its address via DHCP from the ATT modem.

                                I have unchecked "Allow DNS server list to be overridden by DHCP/PPP on WAN" from the general setup.

                                Still getting a failure on DNS lookup.

                                Screen Shot 2021-11-12 at 2.24.57 PM.png

                                J 1 Reply Last reply Nov 12, 2021, 8:31 PM Reply Quote 0
                                • J
                                  johnpoz LAYER 8 Global Moderator @jimfreeze
                                  last edited by Nov 12, 2021, 8:31 PM

                                  @jimfreeze well is unbound even running? Pfsense name would what it resolves too out of the box..

                                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                                  If you get confused: Listen to the Music Play
                                  Please don't Chat/PM me for help, unless mod related
                                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                                  J 1 Reply Last reply Nov 12, 2021, 8:38 PM Reply Quote 0
                                  • J
                                    jimfreeze @johnpoz
                                    last edited by Nov 12, 2021, 8:38 PM

                                    @johnpoz I don't think unbound is running.

                                    I went ahead and set up a Host Override for that domain.

                                    Thank you for all the help.

                                    Jim

                                    J 1 Reply Last reply Nov 12, 2021, 8:53 PM Reply Quote 0
                                    • J
                                      johnpoz LAYER 8 Global Moderator @jimfreeze
                                      last edited by johnpoz Nov 12, 2021, 8:53 PM Nov 12, 2021, 8:53 PM

                                      @jimfreeze said in How to setup a Host Override:

                                      I don't think unbound is running.

                                      Then host overrides wouldn't be working either..

                                      Do you have unbound listening on localhost? or All?

                                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                                      If you get confused: Listen to the Music Play
                                      Please don't Chat/PM me for help, unless mod related
                                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                                      J 1 Reply Last reply Nov 12, 2021, 8:57 PM Reply Quote 0
                                      • J
                                        jimfreeze @johnpoz
                                        last edited by Nov 12, 2021, 8:57 PM

                                        @johnpoz I'm not seeing unbound in the web GUI, but it has a process on the box.

                                        unbound 84523   0.0  0.3  65236 28860  -  Ss   14:40      0:00.90 /usr/local/sbin/unbound -c /var/unbound/unbound.conf
                                        
                                        J 1 Reply Last reply Nov 12, 2021, 9:22 PM Reply Quote 0
                                        • J
                                          johnpoz LAYER 8 Global Moderator @jimfreeze
                                          last edited by Nov 12, 2021, 9:22 PM

                                          @jimfreeze go to status services do you see it running?

                                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                                          If you get confused: Listen to the Music Play
                                          Please don't Chat/PM me for help, unless mod related
                                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                                          J 1 Reply Last reply Nov 12, 2021, 9:45 PM Reply Quote 0
                                          1 out of 58
                                          • First post
                                            1/58
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                            This community forum collects and processes your personal information.
                                            consent.not_received