How to setup a Host Override

[johnpoz]

@jimfreeze home.arpa is the new standard use local domain.

https://datatracker.ietf.org/doc/html/rfc8375
Special-Use Domain 'home.arpa.'

And yes not exactly sure what exact version of pfsense moved to it vs .localdomain.. But from your previous post that is what you showed as your pfsense name and domain.. pfsense.home.arpa

I kept meaning to move to it from my local.lan - but have a lot certs I have created using local.lan in them, and just haven't bothered to switch yet.

I haven't added anything to /etc/hosts.

Please show it like I did - this will show us what pfsense fqdn should be and any host overrides, etc. you have created. I just snipped mine because I have a lot of stuff in there and was just wanting to what my sg4860.local.lan is listed in there from my general page setup.

BTW - are you using pfblocker? And have something odd setup there? But pfsense from the diag host lookup should for sure be able to lookup its own name ;)

[jimfreeze]

@johnpoz Thank you. That's great information.

/etc/hosts looks standard to me.

% cat /etc/hosts
##
# Host Database
#
# localhost is used to configure the loopback interface
# when the system is booting.  Do not change this entry.
##
127.0.0.1	localhost
255.255.255.255	broadcasthost
::1             localhost

127.0.0.1	local.host

I installed pfblocker a few hours ago. I just did the basic install.

And, it still doesn't seem to be able to find the home.arpa domain.

[johnpoz]

@jimfreeze that doesn't look like pfsense hosts file..

[jimfreeze]

@johnpoz Looking at the link you set, should the domain setting under general setup be home.arpa. and not home.arpa?

[johnpoz]

@jimfreeze dude that is not your pfsense hosts file..

Here

[jimfreeze]

@johnpoz Hey, sorry about that. I saw your post and responded, but it didn't go through.

cat /etc/hosts
127.0.0.1	localhost localhost.home.arpa
::1	localhost localhost.home.arpa

BTW, I'm not sure how this setup has changed, but it NOW recognizes pfsense.home.arpa, without a host override.

[johnpoz]

@jimfreeze said in How to setup a Host Override:

without a host override.

Because you shouldn't have to do that - since that is pfsense default name.

Now can your clients resolve pfsense.home.arpa? And can you access the webgui via that name.

But your failing to show your full hosts file - since your not showing pfsense.home.arpa in there and just the first 2 lines..

[jimfreeze]

@johnpoz Yes, clients can ping pfsense.home.arpa and web access also works.

That is the full /ect/hosts file.

8) Shell

Enter an option: 8

[21.05.2-RELEASE][admin@pfSense.home.arpa]/root: cat /etc/hosts
127.0.0.1	localhost localhost.home.arpa
::1	localhost localhost.home.arpa
[21.05.2-RELEASE][admin@pfSense.home.arpa]/root:

[johnpoz]

@jimfreeze how exactly would you be resolving pfsense.home.arpa if its not in your hosts file?

edit: ah look in here
cat /var/unbound/host_entries.conf

[jimfreeze]

@johnpoz Hmmm

[21.05.2-RELEASE][admin@pfSense.home.arpa]/root: cat /var/unbound/host_entries.conf
local-zone: "home.arpa." transparent
local-data-ptr: "127.0.0.1 localhost.home.arpa"
local-data: "localhost. A 127.0.0.1"
local-data: "localhost.home.arpa. A 127.0.0.1"
local-data-ptr: "::1 localhost.home.arpa"
local-data: "localhost. AAAA ::1"
local-data: "localhost.home.arpa. AAAA ::1"
[21.05.2-RELEASE][admin@pfSense.home.arpa]/root:

[21.05.2-RELEASE][admin@pfSense.home.arpa]/root: cat /etc/hosts
127.0.0.1	localhost localhost.home.arpa
::1	localhost localhost.home.arpa
[21.05.2-RELEASE][admin@pfSense.home.arpa]/root:

However, when I opened my laptop up this time (no changes to pfsense), it is NOT resolving

arm64:~ % ping pfsense.home.arpa
ping: cannot resolve pfsense.home.arpa: Unknown host
arm64:~ % ping home.arpa
ping: cannot resolve home.arpa: Unknown host
arm64:~ % ping localhost.home.arpa
PING localhost.home.arpa (127.0.0.1): 56 data bytes
64 bytes from 127.0.0.1: icmp_seq=0 ttl=64 time=0.077 ms
64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.097 ms
^C

[johnpoz]

@jimfreeze Well no it can not and would not resolve if there is no entry there..

[jimfreeze]

@johnpoz So, how do clients recognize the home.arpa domain without setting a host override?

[johnpoz]

@jimfreeze Huh.. home.arpa is your domain that is being handed out via dhcp.. Why you have no entry for pfsense.home.arpa I have no idea what your actually doing..

Your general setting that you posted before showed pfsense with home.arpa as the domain. This is a default.

Did you change that?

But if there is no entry for pfsense.home.arpa for unbound to know about, then no it can return an answer for that via a dns query.

[jimfreeze]

@johnpoz The home.arpa was "just there" when I installed pfsense. I don't know that that means anything, that is, that such a domain exists. If it exists, it seems it needs to be defined by pfsense somewhere.

The DHCP service was already running, I only configured the port range and main address.

[johnpoz]

@jimfreeze again yes home.arpa is default... And right there in your dhcp server it clearly states that system will be used

And again if unbound has no entry for the system name.. Did you change that or get rid of it?

From your previous post

So again - if unbound has no entry for pfsense.home.arpa or whatever other domain you might set in system. Then NO it could not respond for a query.. How would it know what to respond with, etc..

[jimfreeze]

@johnpoz I don't think you understand the problem. The problem is not that I believe the router should break the laws of physics or that it should function in a way it's not supposed to. The problem is there are multiple touchpoints in configuring a system to work, and they do not work out of the box. That is, they do not define the home.arpa domain and clients are not able to resolve home.arpa when that domain is defined in "General Setup".

So far we have talked about 3 configuration points to get a local domain defined and resolvable:

• "General Setup": Hostname and Domain
• "DHCP Server": Gateway and 'Domain name' left blank to use default host
• "DNS Resolver": No config added

The above steps do not allow clients to resolve home.arpa.
I am not seeing in the docs how this setup should be done. It seems like it should be a basic procedure.

[johnpoz]

@jimfreeze said in How to setup a Host Override:

and they do not work out of the box.

Sorry but they do.. I have setup pfsense countless times.. All of it just works out of the box..

are not able to resolve home.arpa when that domain is defined in "General Setup".

What would they resolve home.arpa too? That is just the domain, there is no host there.. So no trying to resolve just home.arpa wouldn't resolve to anything... What should resolve is pfsense.home.arpa since that would be the default fqdn..

Out of the box pfsense

Working just fine...

Here is that other file I said to look at - on a default fire up of pfsense..

So I am not sure what you have going on - but this works just out of the box..

[jimfreeze]

@johnpoz So, that is the real question. Why is that line not getting defined on my router?

arm64:~ % nslookup pfsense.home.arpa
Server:		192.168.100.1
Address:	192.168.100.1#53

** server can't find pfsense.home.arpa: SERVFAIL

arm64:~ % ping pfsense.home.arpa
ping: cannot resolve pfsense.home.arpa: Unknown host

It's almost certain that I have some config that is preventing that from happening, but I don't know what it could be. You have verified the settings are correct on General setup, DNS resolver and DHCP server.

/etc/hosts is still the same and does not include the pfSense line like yours does.

[21.05.2-RELEASE][admin@pfSense.home.arpa]/root: cat /etc/hosts
127.0.0.1	localhost localhost.home.arpa
::1	localhost localhost.home.arpa
[21.05.2-RELEASE][admin@pfSense.home.arpa]/root:

Can you think of a configuration setting that I changed that would cause this?

[MoonKnight]

@jimfreeze

What DNS servers do you have in your General Setup?

[jimfreeze]

@ciscox None