How to setup a Host Override
-
As I understand, the clients get their DNS from pfsense when it assigns an IP address via DHCP. This is what I'm seeing in
/etc/resolve.conf# This file is automatically generated. # search home.arpa nameserver 8.8.8.8 nameserver 8.8.4.4 -
@jimfreeze well clearly if that is your client he isn't pointing to pfsense for his dns, so no he wouldn't be able to resolve your host override.
-
@johnpoz Do I need to configure a General setting in pfsense so clients will be able to resolve host overrides properly?
Thank you.
-
@jimfreeze out of the box your dhcp server on pfsense should point clients to its IP on the interface you enabled dhcp on. If your client is not getting dhcp from pfsense, or you modified those settings or client is static etc..
You sure there is not some other dhcp on your network handing out google for dns?
-
@johnpoz This is the current general setup screen. I think the only change is the "DNS Server Override" is checked.
The pfsense is the only router in the house other than the ATT modem, which is configured as passthrough DHCPS-dynamic and is handing out addresses
DHCPv4 Start Address 192.168.1.64 DHCPv4 End Address 192.168.1.253All addresses inside the LAN are
192.168.100.0/24. -
So, there is this on the Dashboard.
DNS server(s) `127.0.0.1` `192.168.1.254` `2600:1702:4c72:c400::100:` -
@jimfreeze well clearly your client isn't using what dhcp handing out..
Why are you pointing dns to itself there in general - out of the box that should just be nothing, and your also allowing overide from dhcp on wan.
What does your dhcp show..
-
@johnpoz Ahh, sorry about self pointing dns address. That has been fixed.
I was missing the config of the DHCP server. This is what I have now and it seems to work fine.
-
@johnpoz Not sure if I still have an issue or not, but trying to access the router via DNS Override returns this message in the browser.
Potential DNS Rebind attack detected, see http://en.wikipedia.org/wiki/DNS_rebinding Try accessing the router by IP address instead of by hostname. -
@jimfreeze if you would of left those just blank - they would point to interface address.
Pointing to both pfsense and google is bad idea - you have no idea which of those your client might use. And if he asks google for your pfsense.local - he would get nx, and not going to ask any of his other listed NS for it - why should he - he got told it didn't exist, etc..
you should only ever point client to NS that actually resolve the same way, be it with local records or with filtering, etc.. If you point to more than 1 NS, and they might not resolve stuff the same way you just asking for grief..
edit: as to your rebind.. why would you not just access pfsense via its pfsense.home.arpa address? pfsense.local is not pfsense correct name, so yeah that could cause all kinds of issues..
-
@johnpoz So, here is the general setup:
I removed all Host Overrides on DNS Resolver
And here is the DHCP Server
Clients receive the following when connecting
# search home.arpa nameserver 192.168.100.1I'm not understanding how to access "pfsense.home.arpa". It returns the following when doing a DNS Lookup test
-
@jimfreeze well you got something a bit wonky there.. the hostname of pfsense should resolve to its LAN ip..
example.
Get rid of your allow wan dhcp to set dns in your general setup.. looks like your asking 192.168.1.254 for dns as well?
-
@johnpoz As far as I can tell, pfsense is getting the
192.168.1.254resolver when it gets its address via DHCP from the ATT modem.I have unchecked "Allow DNS server list to be overridden by DHCP/PPP on WAN" from the general setup.
Still getting a failure on DNS lookup.
-
@jimfreeze well is unbound even running? Pfsense name would what it resolves too out of the box..
-
@johnpoz I don't think unbound is running.
I went ahead and set up a Host Override for that domain.
Thank you for all the help.
Jim
-
@jimfreeze said in How to setup a Host Override:
I don't think unbound is running.
Then host overrides wouldn't be working either..
Do you have unbound listening on localhost? or All?
-
@johnpoz I'm not seeing unbound in the web GUI, but it has a process on the box.
unbound 84523 0.0 0.3 65236 28860 - Ss 14:40 0:00.90 /usr/local/sbin/unbound -c /var/unbound/unbound.conf -
@jimfreeze go to status services do you see it running?
-
@johnpoz Ahh, yes, thank you. It is running.
-
@jimfreeze well then it should timeout after 800 some ms.. for pfsense name.. Its right there in the file.. See mine sg4860.local.lan
Again will ask - is it listening on all or if not all atleast has localhost (127.0.0.1) listed
