Error: dns_probe_started
-
Im having this error randomly. When it happens, the entire LAN is without internet. I tested it on Chrome, Firefox, Edge, Opera, etc. After a few minutes, DNS works normally again.
My DNS configuration:
DHCP distributes pfSense IP > pfSense (DNS Resolver with pfBlocker) forwards to AD DNS > AD forwards to OpenDNS.
What could this problem be?
-
Well, you have AD DNS, as do I (server 2016) but you work backwards from me… I point all my clients to my two Windows DNS servers (which also do AD) and even go out of my way to NAT redirect the hard coded IOT back to my two AD DNS servers. Everything starts at AD DNS. AD DNS resolves all the internal stuff, and forward to PFSense anything that they can’t. I just don’t see the efficiency of sending clients to PFSense first, then bounce to the AD DNS, then out to internet from there. If they go to PFSense first, PFSense should forward the external right then and there to the internet, and only send to AD DNS the internal stuff. What’t the point of having them go to PFSense first if they end up being forwarded to your AD DNS server, to only be forwarded again to the internet from there (‘AD forwards to OpenDNS’) if I am reading this right. Just makes more sense, (and works very well BTW) to send everyone to AD DNS first. Your error indicates something is wrong with DNS and a quick GOOGLE of that provides ‘expert’ ways to fix… I would just say to make your DNS less complicated; try not to send clients back and fourth if you can help it (again, provided I am reading it right).
-
If you are running Microsoft DNS then it needs to forward to pfsense DNS. It should all be a chain linked together not depend. Since you are running pfBlocker you need to use resolver. You can use resolver forwarding to OpenDNS. It is an option in the settings.
-
@Tzvia idk why I just did this way.. evrything works fine. I can set my DNS like you said, but everything will work the same. This problem dns_probe_started is a random error, that happen eventually.
-
@coxhaus ill try this config. But everything works fine with my config, just this random error happens eventually.
-
@Tzvia now i remember why i did this way.
All social media are blocked in pfBlocker. Some hosts need to have access to social media.
So what I did is: Hosts that can have access to social media, I use NAT to OpenDNS (those hosts dont need to resolve internal stuff). If I use ur configuration, pfBlocker will deny all access.
-
@guile said in Error: dns_probe_started:
@Tzvia now i remember why i did this way.
All social media are blocked in pfBlocker. Some hosts need to have access to social media.
So what I did is: Hosts that can have access to social media, I use NAT to OpenDNS (those hosts dont need to resolve internal stuff). If I use ur configuration, pfBlocker will deny all access.
PFBlocker doesn't really choose what to block; you do by the feeds you choose. I am running PFSense at home- and users yes do use stuff like Facebook, Twitter and I am using probably 28 different feeds, some DNSBL and some IP based. We have no problems here. All you have done was setup PFBlocker, then not use it by having everyone go from PFSense > AD DNS > an internet DNS provider, jumping OVER what you have set in PFSense/PFBlocker. That's not fixing the issue. If you use a feed that blocks social media, well, use another feed that doesn't, and add domains to the DNSBL whitelist as needed.
EDIT: on second read- you want to block some users but not others.... Realize that jumping OVER PFSense DNS with those users takes PFBlocker out of the equation entirely. -
@guile do you use IPv6 ? My ISP has not IPv6 so it's set to none. I noticed I had to add advanced options to DNS resolver for unbound to only resolve A records and ignore AAAA records. Even with it set to none for IPv6 on LAN and WAN interfaces the unbound was still resolving and handing out AAAA records.
Make sure to upvote
-
@JonathanLee said in Error: dns_probe_started:
set to none for IPv6 on LAN and WAN interfaces the unbound was still resolving and handing out AAAA records.
because AAAA records can be resolved over IPv4. if your client asks for AAAA then it will be resolved. Would depend on your client if it asks for AAAA, I found that firefox for example even when the client has no viable IPv6 GUA it will still ask for AAAA.
you can disable that in firefox with setting in about:config
network.dns.disableIPv6
Set it to true and firefox no longer asks for AAAA
I get it maybe the resource is local, and AAAA will resolve to some link local address? But what about when the client machine firefox is running doesn't even have a link-local IPv6 address.. Why would it ask for AAAA?
Connection-specific DNS Suffix . : local.lan Description . . . . . . . . . . . : Killer E2600 Gigabit Ethernet Controller Physical Address. . . . . . . . . : B0-4F-13-0B-FD-16 DHCP Enabled. . . . . . . . . . . : Yes Autoconfiguration Enabled . . . . : Yes IPv4 Address. . . . . . . . . . . : 192.168.9.100(Preferred) Subnet Mask . . . . . . . . . . . : 255.255.255.0 Lease Obtained. . . . . . . . . . : Friday, June 30, 2023 8:53:43 AM Lease Expires . . . . . . . . . . : Thursday, July 6, 2023 8:53:43 AM Default Gateway . . . . . . . . . : 192.168.9.253 DHCP Server . . . . . . . . . . . : 192.168.9.253 DNS Servers . . . . . . . . . . . : 192.168.3.10 NetBIOS over Tcpip. . . . . . . . : Enabled -
@Tzvia nah.. i NEED to block social media in my work. But some users can access. Thats why im using pfBlocker.
-
@JonathanLee i dont use ipv6.. i just set to none in the configuration. Ill try what u said.
-
@guile This is mine, I do have some redundant settings per johnpoz.
(now my DNS resolves only A records)I also block DoH with my proxy. Now it only resolves to A records.
-
This post is deleted! -
Just happened again. The problem is DNS related, but I can ping and nslookup Google:
-
@guile said in Error: dns_probe_started:
The problem is DNS related, but I can ping and nslookup Google:
well then its Not dns related. Its your browser, most likely trying to do doh that is the problem.. clearly dns is working if you can do a nslookup and ping the name and it gets an IP.
-
@guile notice what is resolved first it's a IPv6 you got to fix that in your resolver.
-
@johnpoz i mean.. the problem says: dns_probe_started. Thats why im supossing is DNS related.
I tested on all browsers: Chrome, Firefox, Opera and Edge.. all the same error. Maybe is DNS related, because im blocking DoH with pfBlocker.
pfBlocker > IP > IPV4:
DNSBL Safesearch:
-
@guile if you do a nslookup to pfsense IP and it resolves, ie answers your fqdn query. then how is it dns related - unless your browser is not using pfsense for its dns..
Unless your unbound is restarting and your browser asks, and fails, and by time you ask via your nslookup it has restarted. Look in your log, is unbound restarting a lot?
Do a query like this to see how long its been running.
[23.05.1-RELEASE][admin@sg4860.local.lan]/: unbound-control -c /var/unbound/unbound.conf status version: 1.17.1 verbosity: 1 threads: 4 modules: 2 [ validator iterator ] uptime: 94572 seconds options: control(ssl) unbound (pid 3856) is running... [23.05.1-RELEASE][admin@sg4860.local.lan]/:So my unbound has been running for 94500 seconds, or 26 some hours.. Which makes sense because I had restarted it yesterday a few times playing with something else for another thread.
If you weren't using doh, then blocking doh would have no effect.. If you were blocking doh and the browser was trying to use it - then it would always fail.. But from your ping and nslookup dns is working, so maybe its restarting a lot - which if your registering dhcp that can be a problem, etc
-
I had this same issue when I updated to the new PfSense. To resolve it I had to add in the custom settings in DNS resolver for unbound. It was like my IPv4 was trying to connect to IPv6 websites intermittently even with DoH blocked. That custom setting fixed it for me as I have no IPv6 from the ISP
-
My unbound status:
[2.6.0-RELEASE][admin@firewall.local.com]/root: unbound-control -c /var/unbound/unbound.conf status version: 1.13.2 verbosity: 1 threads: 2 modules: 2 [ validator iterator ] uptime: 7006 seconds options: control(ssl) unbound (pid 39208) is running...I restarted the service when the error ocurred. Ill keep checking the status using the command.
Im not using DoH, im just trying to block users to use DoH. All the configurations I posted, can I disable them all?
