help with Gateway/DNS configuration

fox95 · Oct 25, 2022, 10:35 AM

need some help here with gateway and dns setup.

I have pfsense installed on a old pc that has 4 lan port card

one lan is dedicated to wan in
and the the other 3 are lan out (1 to a wifi router, 1 to another wifi router, 1 to a wired only ethernet network)

i had all ipv6 stuff disabled and i couldnt get to the internet, i could ping around to other devices on the lan but could not ping 8.8.8.8 or get out anywhere.

so i set pfsense back to default settings and left ipv6 enabled. and it appears that it is using it as the gateway to get out to the internet as seen in the pic. the wan above it it is the ipv4 and appears to not work. How should i be configuring the gateways? each lan out has its own IP address scheme where one is 10.x.x.x another is 192.168.x.x. and another is 172.x.x.x. etc....

and not to complicate matters any more but, would someone mind telling me what i should be doing to configure dns servers? and where to enter the info and where not to. i'd prefer that the entire network only use 1.1.1.1 for dns.

thanks for the help hopefully this is a easy questions(s) to answer.

johnpoz · Oct 25, 2022, 4:59 PM

@fox95 well your not going to get anywhere if the gateway is offline, if pfsense can not ping its gateway it will show offline, and then no it will not be used. If your gateway doesn't answer ping - then you either need to manually set the gateway as online, or you need to pick another IP you can ping via that gateway that answers so pfsense knows the gateway is up.

For your clients to use 1.1.1.1 via unbound on pfsense. You would need to set 1.1.1.1 in your dns, do not let dhcp override and then set unbound to forwarder mode.

fox95 · Oct 25, 2022, 4:59 PM

@johnpoz said in help with Gateway/DNS configuration:

If your gateway doesn't answer ping - then you either need to manually set the gateway as online, or you need to pick another IP you can ping via that gateway that answers so pfsense knows the gateway is up.

-----how do i manually set the gateway as online?

or

-----how do i pick another IP that can be pinged through that gateway that will answer? (what IP? I don't understand this)

thanks for the reposonse

fox95 · Oct 25, 2022, 5:02 PM

For your clients to use 1.1.1.1 via unbound on pfsense. You would need to set 1.1.1.1 in your dns, do not let dhcp override and then set unbound to forwarder mode.

would i do this in the DNS forwarder or DNS resolver? in host overrides or domain overrides?

johnpoz · Oct 25, 2022, 5:12 PM

@fox95 its not a domain override... Out of the box pfsense uses unbound in resolver mode. If you want it to forward, then you have to set it to forward mode, and you set the dns you want it to forward to in the dns setup under general.

If your going to forward its good idea to uncheck do dnssec in the resolver. Since when you forward where you forward to either does dnssec or not. That setting becomes moot and can cause issues if left checked when forwarding.

fox95 · Oct 25, 2022, 5:53 PM

@johnpoz said in help with Gateway/DNS configuration:

@fox95 its not a domain override... Out of the box pfsense uses unbound in resolver mode. If you want it to forward, then you have to set it to forward mode, and you set the dns you want it to forward to in the dns setup under general.

If your going to forward its good idea to uncheck do dnssec in the resolver. Since when you forward where you forward to either does dnssec or not. That setting becomes moot and can cause issues if left checked when forwarding.

ok, i'll skip this for now, this is not a issue just more of my wanting to understand how things work.

the more important issue is why the gateway is listed as offline. I will need some direction on the steps on how to fix this.

stephenw10 · Oct 25, 2022, 5:54 PM

Yes, in System > Routing > Gateways edit the WAN_DHCP gateway and set a different monitoring IP. You could use 1.1.1.1 since you're using that for DNS anyway.

Add that DNS server in System > General Setup.

Steve

johnpoz · Oct 25, 2022, 5:55 PM

@fox95 if you manually to be online - does it work?

fox95 · Oct 25, 2022, 6:10 PM

@johnpoz said in help with Gateway/DNS configuration:

@fox95 if you manually to be online - does it work?

yes, i checked both boxes (disable gateway monitoring and disable gateway monitoring action) that changed the gateway to online now(green).

but i have realised that I do have a DNS issue.

devices connected to the lan cannot get to the internet unless you manually configure DNS addresses in them. example in my iphone wifi setting i have to set DNS to manual and enter in 1.1.1.1 for it to get to any web sites.

and in my PC i have to set the ethernet adaptor DNS manaully for it to get to the internet.

so somewhere i missing a setting in the config

stephenw10 · Oct 25, 2022, 6:21 PM

By default pfSense will pass it's own interface IP via DHCP for clients to use for DNS. Have you changed that?

And also by default the Unbound DNS service running in pfSense will answer those queries. have you changed the DNS Resolver settings from their defaults?

fox95 · Oct 25, 2022, 6:38 PM

@stephenw10

so in DNS resolver I checked "enable forwarding mode"

and now things appear to work as expected......without the manual dns entry in the devices.

not sure if this is right or not?

im still fuzzy on when to use the DNS resolver or DNS forwarder?

i guess my question is, these are settings i never changed so why dont the defaults of pfsense out of the box work for me?

johnpoz · Oct 25, 2022, 7:12 PM

@fox95 said in help with Gateway/DNS configuration:

im still fuzzy on when to use the DNS resolver or DNS forwarder?

Normally out of the box you should just resolve, this is pfsense default.. Everything should work out of the box, clients via dhcp would auto get handed pfsense as their gateway and dns. Unbound would resolve what you want to go to.

If you want to forward.. Is the only time you should have to change anything. That choice of resolving or forwarding is up to you.

If your going to forward, I would suggest you uncheck use dnssec support. It serves no purpose if your forwarding.

stephenw10 · Oct 25, 2022, 7:44 PM

@johnpoz said in help with Gateway/DNS configuration:

If your going to forward, I would suggest you uncheck use dnssec support. It serves no purpose if your forwarding.

Yup, that^.

Gertjan · Oct 26, 2022, 10:37 AM

@fox95 said in help with Gateway/DNS configuration:

i guess my question is, these are settings i never changed so why dont the defaults of pfsense out of the box work for me?

Go here, and read the message at the top ;)

Additional information : A resolver like unbound, used by pfSense, uses these root servers. The list with their host names and, more important, their IPv4 and IPv6 addresses, are build ('compiled') into unbound.
These rarely (if ever) change. And if one doesn't answer, another is used. There are 13 of them, so pretty redundant.

If pfSense (unbound) can't reach any of the 'root servers', you have a severe "connection to the Internet" issue.
You can test that yourself : ping, using their IP addresses, them all.