DNS Resolver / Forwarder

linnet

Sorry if this seems like a stupid question. If you enter DNS servers under general setup, and in the DHCP server settings. Does DNS resolver or forwarder still need to be enabled?

Thanks, Linnet

johnpoz

@linnet if you don't want anything using unbound or forwarder or unbound in forwarder mode - ie asking pfsense to do dns for it, even itself - then no you do not need to run either.

Your not going to be able to resolve any local resources - unless your pointing to some other dns on your network?

If your not running unbound on pfsense then you wouldn't be able to use pfblocker, etc.

linnet

@johnpoz Thanks for the response! I have no other DNS server running. My thoughts were that the DNS servers I defined would just be forwarded to the clients. Not sure if this is the way to go about it...

SteveITS

@linnet The General Setup settings are for pfSense itself, or if DNS Forwarder is used.

edit: didn't mean to save. doc link: https://docs.netgate.com/pfsense/en/latest/config/general.html#dns-server-settings
and
https://docs.netgate.com/pfsense/en/latest/config/general.html#dns-resolution-behavior

johnpoz

@linnet said in DNS Resolver / Forwarder:

Not sure if this is the way to go about it...

Not the way I would do it - but you do you.. Why would you not just want pfsense to cache what it looks up.. If you have client A on your network wanting to go to say www.google.com - client B would have to query where you have them set to go, same with client C, D etc..

So every single client on your network would have to query say 1.1.1.1 for everything, and they would have only their local cache - you do not share cache for all your clients, etc.

Without running your own local dns - you can not resolve anything locally other then via mdns or broadcast, etc.

You not doing any sort of filtering via dns.. Other than specifically at the client, etc..

But sure you can let your clients use whatever dns you want, same with pfsense.. You don't need to run dns on your network.. Its just common to do so, etc.

Now a days your browsers mostly doing doh anyway.. Unless you specifically tell it not too - so yeah you don't have to run local dns if you don't have want or need for it.

linnet

@steveits Thanks, I'll be sure to read those!

linnet

@johnpoz Thanks for the information. I'll use resolver, I mostly get what you're getting at. I'll have to do more studying on networking perhaps to understand some of these things better. The help is appreciated!