Pfsense and hostname resolution

rjcab · Feb 18, 2024, 8:23 PM

Hello all,

I have researched the solution on the forum but not found a solution so far.
It's very simple,
I have a lot machine in the networtk 192.168.1.0 and I want to reach them via the hostname.

Here below an extract of the dhcp resa

Then an extract of the conf:

I want the DNS request which are external pass through the DNS 8.8.8.8 and all internal via the Pfsense.
May be I wrong when I specified an external DNS ?

From a LAN machine:

➜  ~ ping jeedom       
ping: cannot resolve jeedom: Unknown host
➜  ~ ping jeedom.local.lan
ping: cannot resolve jeedom.local.lan: Unknown host
➜  ~

From Pfsense:

 ssh admin@192.168.1.1
(admin@192.168.1.1) Password for admin@fw.local.lan:
pfSense - Netgate Device ID: 0755f82c3dd2db23ab78

*** Welcome to pfSense 2.7.2-RELEASE (amd64) on fw ***

 WAN (wan)       -> ue0        -> v4: 192.168.10.253/24
 LAN (lan)       -> re0        -> v4: 192.168.1.1/24

 0) Logout (SSH only)                  9) pfTop
 1) Assign Interfaces                 10) Filter Logs
 2) Set interface(s) IP address       11) Restart webConfigurator
 3) Reset webConfigurator password    12) PHP shell + pfSense tools
 4) Reset to factory defaults         13) Update from console
 5) Reboot system                     14) Disable Secure Shell (sshd)
 6) Halt system                       15) Restore recent configuration
 7) Ping host                         16) Restart PHP-FPM
 8) Shell

Enter an option: 8

[2.7.2-RELEASE][admin@fw.local.lan]/root: ping jeedom
ping: Unknown host
[2.7.2-RELEASE][admin@fw.local.lan]/root: ping jeedom.local.lan
ping: Unknown host
[2.7.2-RELEASE][admin@fw.local.lan]/root: ping fw
PING fw.local.lan (192.168.1.1): 56 data bytes
64 bytes from 192.168.1.1: icmp_seq=0 ttl=64 time=0.218 ms
64 bytes from 192.168.1.1: icmp_seq=1 ttl=64 time=0.176 ms
^C
--- fw.local.lan ping statistics ---
2 packets transmitted, 2 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 0.176/0.197/0.218/0.021 ms
[2.7.2-RELEASE][admin@fw.local.lan]/root: ping fw.local.lan
PING fw.local.lan (192.168.1.1): 56 data bytes
64 bytes from 192.168.1.1: icmp_seq=0 ttl=64 time=0.228 ms
64 bytes from 192.168.1.1: icmp_seq=1 ttl=64 time=0.393 ms
©64 bytes from 192.168.1.1: icmp_seq=2 ttl=64 time=0.286 ms
64 bytes from 192.168.1.1: icmp_seq=3 ttl=64 time=0.472 ms
^C
--- fw.local.lan ping statistics ---
4 packets transmitted, 4 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 0.228/0.345/0.472/0.094 ms
[2.7.2-RELEASE][admin@fw.local.lan]/root:

if you have any clue, am the newbie :-)

viragomann · Feb 18, 2024, 10:21 PM

@rjcab said in Pfsense and hostname resolution:

I want the DNS request which are external pass through the DNS 8.8.8.8 and all internal via the Pfsense.
May be I wrong when I specified an external DNS ?

Yes, that's wrong. It instruct the client to use the external server for DNS, which cannot resolve your local names.

Go to System > General Setup and enter the external DNS server there.

Uncheck "DNS Server Override".

At "DNS Resolution Behavior" select "use local DNS, fallback to remote.."

Go to Services > DNS Resolver. Assuming it it enabled.
Check "DNS Query Forwarding" and "Static DHCP".

This also assumes, that you're using ISC DHCP, not KEA.

Gertjan · Feb 18, 2024, 10:22 PM

@rjcab

Yo are aware of he fact that 8.8.8.8 will never ever register your :

So : telling the DHCP server that it should hand out '8.8.8.8' is a ..... ok .... but then do not be surprised that every LAN network devie will use 8.8.8.8 and 8.8.8.8 is not aware of your network hosts.
And 8.8.8.8 will not register that "nest" is 192.168.1.6 as I'm already using that IP and it is called NAS ;) (actually, 8.8.8.8 will drop all RFC1918 IPs).

So, why entering 8.8.8.8 anywhere ? I'm using it no where.
This field :

is empty on my pfSense.
And DNS works fin for all my devices, I can resolve my local host names just fine.
And for hos names that are not local, the resolver goes out resolving. Small bonus : and it will not inform 8.8.8.8 about it. ( I don't know why they should ).

The idea is this :
ll network devices use the gateway IP == also their DNS server for all DNS requests.
If a device ( host is local, then it, the resolver, can answer right away.
If not, it goes out, doing its resolver thing, and when an answer exists, in will get communicated to the network host hat initially made the request.

When you installed pfSense, this was how it was set up.
For DNS to work, nothing needed to be changed / added / whatsoever.

rjcab · Feb 18, 2024, 10:38 PM

thanks for taking the time to reply.
I did remove the DNS 8.8.8.8.

then un renew dhcp from a local computer, then:

➜  ~ dig

; <<>> DiG 9.10.6 <<>>
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 17637
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 13, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;.				IN	NS

;; ANSWER SECTION:
.			81903	IN	NS	l.root-servers.net.
.			81903	IN	NS	d.root-servers.net.
.			81903	IN	NS	a.root-servers.net.
.			81903	IN	NS	g.root-servers.net.
.			81903	IN	NS	e.root-servers.net.
.			81903	IN	NS	h.root-servers.net.
.			81903	IN	NS	c.root-servers.net.
.			81903	IN	NS	j.root-servers.net.
.			81903	IN	NS	k.root-servers.net.
.			81903	IN	NS	b.root-servers.net.
.			81903	IN	NS	m.root-servers.net.
.			81903	IN	NS	f.root-servers.net.
.			81903	IN	NS	i.root-servers.net.

;; Query time: 49 msec
;; SERVER: 192.168.1.1#53(192.168.1.1)
;; WHEN: Sun Feb 18 23:36:05 CET 2024
;; MSG SIZE  rcvd: 239

➜  ~ ping jeedom.local.lan
ping: cannot resolve jeedom.local.lan: Unknown host
➜  ~ ping 192.168.1.12
PING 192.168.1.12 (192.168.1.12): 56 data bytes
64 bytes from 192.168.1.12: icmp_seq=0 ttl=64 time=41.103 ms
64 bytes from 192.168.1.12: icmp_seq=1 ttl=64 time=5.583 ms
^C
--- 192.168.1.12 ping statistics ---
2 packets transmitted, 2 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 5.583/23.343/41.103/17.760 ms
➜  ~

I am still not able to reach local device name. :(

johnpoz · Feb 18, 2024, 10:45 PM

@rjcab are you using kea? It will not register dhcp or static reservations as of yet.

rjcab · Feb 18, 2024, 10:46 PM

@viragomann said in Pfsense and hostname resolution:

DNS Query Forwarding

Thanks also @viragomann

I did everything, but same issue :(

rjcab · Feb 18, 2024, 10:49 PM

@johnpoz
My conf of dns resolver

<unbound>
	<enable></enable>
	<dnssec></dnssec>
	<active_interface>all</active_interface>
	<outgoing_interface>all</outgoing_interface>
	<custom_options>c2VydmVyOmluY2x1ZGU6IC92YXIvdW5ib3VuZC9wZmJfZG5zYmwuKmNvbmY=</custom_options>
	<hideidentity></hideidentity>
	<hideversion></hideversion>
	<dnssecstripped></dnssecstripped>
	<port></port>
	<tlsport></tlsport>
	<sslcertref>65d11843d78d1</sslcertref>
	<regdhcpstatic></regdhcpstatic>
	<system_domain_local_zone_type>transparent</system_domain_local_zone_type>
</unbound>

Yes I use

johnpoz · Feb 18, 2024, 10:53 PM

@rjcab do you have it set to register static?

this says you don't

rjcab · Feb 18, 2024, 10:53 PM

but when I choose DNS Query ForwardingEnable Forwarding Mode I got:

The following input errors were detected:

At least one DNS server must be specified under System > General Setup to enable Forwarding mode.

rjcab · Feb 18, 2024, 10:55 PM

:-)

johnpoz · Feb 18, 2024, 10:56 PM

@rjcab ok - if your in forwarding mode, you have to have something to forward too..

rjcab · Feb 18, 2024, 11:00 PM

@johnpoz

I follow the advice :-)

johnpoz · Feb 19, 2024, 8:29 AM

@rjcab well that is some bad wording it seems.

If you want pfsense to ask 8.8.8.8 for dns, that is forwarding mode, and yes your 8.8.8.8 needs to be in dns settings. Unbound in forwarding mode - and turn off dnssec in unbound.. Using dns when you forward is going t be nothing but problems.

Clients should be asking pfsense for dns, you would not hand the clients 8.8.8.8 in dhcp. by default dhcp hands out pfsense on that interface to clients for dns.

That settings is for pfsense itself, and has nothing to do with clients on your network.

rjcab · Feb 19, 2024, 8:29 AM

@johnpoz thanks for the clarification. So new am a bit lost, I follow only your advice but not working so far.
When I look at what I want it seems very easy but actually tricky to configure :(

Gertjan · Feb 19, 2024, 9:24 AM

@rjcab said in Pfsense and hostname resolution:

When I look at what I want it seems very easy but actually tricky to configure :(

Starting from a pfSense with 100 % default settings :

don't activate the new KEA DHCP server - make sure that ISC DHCO is active. [ so basicly, do nothing ]
option A) On the unbound / resolver main settings page, make sure this option is set :

(the first DHCP Registration)

Or, Option B) don't cehck "DHCP Registration", as Static DHCP is already checked : add for every device a DHCP MAC Lease like this :
On the DHCP server page, at the bottom.

And now you're good.
Remember : don't switch to KEA.

Notice : don't need to forward - why would you ? (can you tell me why you think you have to forward to some DNS server like 8.8.8.8 ? ) no need to add 1.1.1.1 or 8.8.8.8 etc.
Everything works

rjcab · Feb 19, 2024, 2:50 PM

Well done :-)
I missed that

johnpoz · Feb 19, 2024, 2:56 PM

@rjcab what are you doing normal dhcp, or your previous posted image showed static reservations. You do not need to register dhcp if your doing reservations for all your devices.

This is a reservation, and they are loaded when unbound starts..

And they will resolve be it the client is on or off, or has gotten its reservation or not..

Now if you want to resolver xyz.yourdomain.tld that is some dhcp client that you have not set a reservation for - then yes you would have to register dhcp clients.

Leon Straathof · Feb 19, 2024, 7:19 PM

@johnpoz I did come here too when my config went to shit. I changed several configurations and then FQDN just broke and also DNS registrations between different networks. Why the hell do they scare you too go to KEA when the damn thing is not finished at all. Because i did other configuration in custom options i did think it was me that made a mistake in configuration and pulled my hair out for 2 hours. But it works out to be pfSense devs pushing shit out that ain't ready yet.

rjcab · Feb 21, 2024, 6:26 PM

thanks a lot for your support

rjcab · Feb 21, 2024, 6:32 PM

Now I have another issue:

I got 502 Bad Gateway, nginx message so I did 16) Restart PHP-FPM and it works for several minutes and then down again.
I went to the log files and I saw a lot of:

could not connect to /var/run/php-fpm.socket pfsense

I found on internet and some guys are talking about ethernet drivers. I have one interface LAN embedded with the NUC and I have an USB ethernet plug (WAN).

 WAN (wan)       -> ue0        -> v4: 192.168.10.253/24
 LAN (lan)       -> re0        -> v4: 192.168.1.1/24

When I unplug the usb it seems working. The USB plug is well recognised.

If you have an idea :-)