Force primary DNS as pfsense DNS
-
I need to force all my users in the network to use my pfsense as primary DNS.
Then they can set their own like 8.8.8.8, but it needs to be secondary.
The problem I have is that if the 192.168.8.1 (my DNS) is last in the chain, the local custom hosts do not work.
It seems to query 8.8.8.8 and then abandon.
How can I achieve this? -
You are learning one of the first lessons about DNS servers. You really only want your users pointing to pfSense and nothing else. You can't control which DNS server a given client may choose to query when it has more than one to pick from. Not all clients will honor "primary" and "secondary" like you think they should.
But in your case, the root problem is that 8.8.8.8 will return "NXDOMAIN" (or non-existent domain) for your local hosts, thus the client gives up looking further. A client only checks a secondary DNS when the primary fails to respond at all. After a timeout, the client will check any other DNS servers it has configured. But if the primary responds, the client takes its answer and does not query any further. So the Google DNS server tells your client the host (or domain) does not exist, and the client says "OK, thank you -- I'm done looking for this.".
Point your clients to pfSense as their only DNS server. Then on pfSense you can configure resolving (which is the default anyway if you change nothing). You can even go farther and do DNS redirection so even if your clients attempt to configure their own DNS server, any traffic destined for ports 53 or 853 can be redirected to your pfSense DNS server.
-
@bmeeks said in Force primary DNS as pfsense DNS:
Not all clients will honor "primary" and "secondary" like you think they should.
In particular, Windows will use the "last known good" DNS server first and not honor the "order" in the network settings.
-
Thanks
I ended up creating a nat firewall rule redirecting all dns requests port 53 to local.Just wondering if this puts a toll on pfsense
-
@wastapi Probably not a noticeable one but it would take a few extra CPU cycles per lookup.
Also look into DoH (DNS over HTTPS).
