Why does resolver require ALL network interfaces?
-
I tried to set the DNS resolver to listen to queries on the LAN but it doesn't like it. It wants either ALL or localhost.
Doesn't ALL mean the resolver will bind to the WAN? Shouldn't I avoid this if I already have a DNS server on the WAN net?
What does localhost mean? It only accepts queries from itself?
Is this explained somewhere in the docs? I don't find it.
I'm using pfsense CE 2.5.2. Thanks!
-
@ken-teh The default is all I assume in case you add an interface later.
Localhost is the pfSense itself, by default it queries itself for DNS. On page System/General Setup, see option "DNS Resolution Behavior."
Unless you create a rule allowing connections to WANIP:53, the Internet/WAN devices can't connect to that port anyway.
Having another DNS server on the WAN doesn't matter...you may be thinking of DHCP? For DHCP you want only one DHCP server per network. (unless there's a failover or something, but in general one so they don't give out conflicting info)
-
@steveits The wan:53 firewall rule clarifies it for me. Thanks!
-
In addition to the firewall rules the DNS Resolver also has strict internal ACLs which only allow queries from known local networks. So unless you've done something silly like add an ACL for
0.0.0.0/0to allow queries, unbound would just toss them out anyhow.
