PFSense unable to resolve cloudflare entries when not proxied?

cromat

All I have a DNS registered in cloudflare call it mydomain.net and I have DNS entries for *.mydomain.net that point to a local IP.

From the machines on my network I can resolve mydomain.net but not anything off the *.mydomain.net. pfSense is my router with DNS Resolver enabled and upstream is pointing at cloudflare DNS.

My the machines on my network if I do a nslookup testing.mydomain.net 1.1.1.1 it will resolve correclty, but if I omit the DNS server, it goes to the pfsense box and refuses to resolve.

Using the pfsense DNS Resolver lookup, any subdomain which is "cloudflare proxied" resolved but not just standard DNS records. Off network it resolves fine for example from my office network.

Am I missing something super obvious?

NOTE: I do not have any local zone defined, that might be my alternative to fix this but I would really like to understand what obvious bit I'm missing.

bingo600

@cromat

I seem to remember unbound would "default" reject rfc1918 answers.

I think ... Not 100% sure
You have to add a

server:
private-domain: "mydomain.net"

In the custom options window, in order to get it to accept rfc1918 answers, for that domain.

It is some unbound tickery that allows those answers

/Bingo

cromat

@bingo600 Thank you so much! This is exactly the problem and with your hint I also found the portion of the documentation I missed.

For others.
https://nlnetlabs.nl/documentation/unbound/unbound.conf/

private-domain: <domain name>
Allow this domain, and all its subdomains to contain private ad-
dresses. Give multiple times to allow multiple domain names to
contain private addresses. Default is none.

johnpoz

@cromat its a really bad idea to put rfc1918 in public dns.. There is a rfc that clearly states it should not be done.

The whole reason for rebind protection, etc..While your private domain will work, it normally meant when you talking to another local dns and not public dns.

rfc1918 space does not belong in public domain dns..

cromat

@johnpoz I know, I just needed to test this out, it will be removed and a local zone will end up being used on the network as an override.